Topic starter
15/01/2026 4:46 pm
TL;DR: SaaS-first operating models are expanding attack surfaces faster than manual audits and point-in-time tools can track, with Valence Security citing a 58% SaaS security incident rate in the past year as organizations struggle to manage decentralized ownership, shadow SaaS, and NHI sprawl. Continuous discovery and identity-centric remediation now matter more than periodic posture checks.
Editorial analysis by NHI Mgmt Group, based on content published by Valence Security: “Taming the Beast: The 5 Essential Pillars of SaaS Security”.
By the numbers:
- 58% of organisations suffered a SaaS security incident in the past year.
Key questions
Q: What breaks when SaaS security is managed with point-in-time audits?
A: Point-in-time audits miss the rate of change in decentralised SaaS environments.
Q: Why do app-store integrations increase SaaS governance risk?
A: Because every connected app adds another entitlement path that can outlive the original approval.
Q: How do security teams know if SaaS identity controls are actually working?
A: Look for evidence that lower-assurance identities are fully segregated from sensitive backend paths, not just authenticated differently.
Practitioner guidance
- Build continuous SaaS discovery Track sanctioned and unsanctioned applications together, and keep discovery running often enough to catch daily change rather than monthly drift.
- Inventory all SaaS identity types Map employees, former employees, contractors, partners, service accounts, integrations, and OAuth tokens into one governed ownership model.
- Remove dormant and excessive access Prioritise dormant accounts, guest users with excessive privileges, and inactive identities that still retain file-sharing or application access.
Bottom line: SaaS sprawl turns governance into a continuous control problem because access and ownership change faster than manual audits can track.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:14 pm
Continuous discovery is now the baseline control for SaaS governance: point-in-time review models cannot keep pace with decentralised app adoption, shadow SaaS, and daily configuration drift. When ownership is spread across business units, the security team is no longer dealing with a finite inventory but with a moving target. The practical conclusion is that continuous discovery has to sit ahead of any remediation or review workflow.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise remediation or discovery first in SaaS security?
A: They need both, but discovery comes first if they do not know where their access paths are. Once the inventory is accurate, remediation should be tightly automated so stale sharing, excessive privilege, and forgotten integrations are removed quickly. Otherwise, the programme becomes a reporting exercise.
👉 Read our full editorial: SaaS sprawl is widening the NHI governance gap for security teams