How should organisations evaluate SaaS subscriptions before renewal?

Why This Matters for Security Teams

Subscription renewal is not just a procurement exercise. For security teams, it is a control point where unused, over-privileged, or poorly owned software can quietly persist long after business value has faded. That matters because SaaS tools often hold NHIs such as API keys, tokens, and service accounts, and those identities can outlive the workflow they were meant to support. The result is unnecessary exposure, duplicate access paths, and weak accountability.

NHIMG research shows that 97% of NHIs carry excessive privileges, which makes stale subscriptions a governance problem as much as a cost problem. Security teams should treat renewals as a chance to verify ownership, access scope, and dependency fit, not assume that spend equals necessity. This is especially important where the app also contains secrets or integrations documented in the Guide to the Secret Sprawl Challenge and the Top 10 NHI Issues. In practice, many security teams encounter stale SaaS risk only after an owner leaves or an integration is breached, rather than through intentional renewal review.

How It Works in Practice

Effective renewal review starts with evidence. The first step is to identify the business owner, the actual users, the connected workflows, and any non-human identities tied to the subscription. Then compare this picture against usage telemetry, support tickets, and integration logs. If the app is lightly used, duplicated elsewhere, or only retained because no one wants to disrupt a legacy workflow, the renewal should be downgraded or rejected.

Security and IT should evaluate three questions together: does the tool still support a live business process, does it expose secrets or privileged integrations, and does it fit the current access model. This is where OWASP Non-Human Identity Top 10 is useful as a control lens, because many SaaS renewals preserve hidden machine access even when human usage drops. NHIMG’s NHI Lifecycle Management Guide reinforces that lifecycle ownership, inventory, and offboarding should be part of the renewal decision.

• Confirm named business ownership and technical stewardship before approval.
• Measure real usage over time, not just login counts at month end.
• Inventory connected NHIs, OAuth grants, API keys, and service accounts.
• Check whether a lower tier, shared platform, or existing enterprise tool already covers the need.
• Require a disposition: renew as-is, downgrade, remediate, or retire.

Where possible, tie renewal to access review and secret hygiene checks so the same decision closes both spend waste and identity risk. These controls tend to break down in decentralised organisations where app ownership is informal and procurement renews on auto-pilot because no single team can prove the subscription is still needed.

Common Variations and Edge Cases

Tighter renewal governance often increases administrative overhead, requiring organisations to balance speed against control. That tradeoff is real, especially in departments that buy SaaS directly for fast-moving projects. Current guidance suggests using risk-based thresholds rather than a single approval rule for every subscription.

High-risk tools deserve deeper scrutiny: any SaaS with production data, admin roles, external sharing, or machine-to-machine integrations should trigger an evidence pack and a technical owner review. Lower-risk tools can use a lighter workflow, but they still need a named sponsor and expiry decision. Where subscriptions are embedded in customer-facing or regulated processes, the question is not only whether staff still use the tool, but whether replacing it would create hidden operational or compliance gaps.

There is no universal standard for renewal frequency yet, but best practice is evolving toward continuous inventory, periodic usage review, and explicit offboarding. The Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs and Salesloft OAuth token breach both underscore why dormant integrations and retained tokens should influence renewal choices. The hardest edge case is a subscription with low human usage but critical machine dependencies, because cancelling the licence without first mapping those dependencies can interrupt automations that no one remembered existed.

Related resources from NHI Mgmt Group

• What should organisations prioritise before SaaS contract renewals?
• Who should be accountable for cancelling unused SaaS tools before renewal?
• How do organisations know if SaaS renewal controls are working?
• What breaks when organisations rely on auto-renewals for SaaS subscriptions?