Why do usage logs matter in vendor renewals?

Why This Matters for Security Teams

Usage logs are the evidence layer that turns vendor renewals from procurement habit into operational decision-making. For security teams, they reveal whether a platform, license tier, or add-on is actually being exercised, whether access is concentrated in a few accounts, and whether renewals are masking shelfware. That matters because dormant capability still creates cost, governance overhead, and security exposure, especially when entitlements are broad but usage is thin.

For non-human identities, the same logic applies with more urgency. NHIs often outnumber human identities by 25x to 50x in modern enterprises, and visibility is still poor: only 5.7% of organisations have full visibility into their service accounts, according to NHI Mgmt Group in the Ultimate Guide to NHIs. In practice, renewal reviews frequently uncover licenses, integrations, or API access that have not been meaningfully used since onboarding. That is why usage data belongs in the same conversation as access review, rotation, and offboarding. It gives security and procurement a factual basis for reducing exposure and eliminating unnecessary renewals, rather than guessing from contract size or vendor claims. Current guidance from the OWASP Non-Human Identity Top 10 also reinforces that visibility gaps are a recurring control failure. In practice, many security teams discover over-licensed access only after a renewal notice has already been approved, rather than through intentional evidence gathering.

How It Works in Practice

Effective renewal analysis starts by separating license entitlement from actual consumption. Teams should review authentication volume, last-login dates, feature activation, API call counts, and the number of distinct identities using a tenant or integration. For NHI-heavy environments, that should include service accounts, application tokens, and machine-to-machine integrations, not just named users. The goal is to identify whether the vendor is supporting an active workflow or whether the organisation is paying for capacity that has not been used for a meaningful period.

Good practice is to combine usage logs with lifecycle records from onboarding, ownership, and offboarding. The NHI Lifecycle Management Guide and the Ultimate Guide to NHIs — Static vs Dynamic Secrets both point to the same operational reality: if an identity is active only by contract, not by usage, then renewal is a governance decision, not a technical necessity. A practical review sequence is:

• Compare billed seats or enabled capabilities against authenticated users and active service accounts.
• Check last-login or last-authentication dates across the renewal period.
• Validate whether premium features were actually invoked, not just enabled.
• Confirm whether any dormant access belongs to decommissioned projects or abandoned integrations.
• Require an owner sign-off before renewing anything with no recorded business use.

This approach is especially important where secrets sprawl is already present, because inactive but still-valid credentials can persist well beyond the business need that created them. NHI Mgmt Group reports that 71% of NHIs are not rotated within recommended time frames, which makes usage logs useful not only for cost control but also for spotting stale access paths that deserve removal before renewal. These controls tend to break down in environments with shared service accounts and poor attribution because logs cannot reliably map activity back to a specific workload or owner.

Common Variations and Edge Cases

Tighter renewal governance often increases review overhead, requiring organisations to balance savings against the time needed to reconcile logs, ownership, and contract terms. That tradeoff becomes sharper when vendors bundle multiple modules under one SKU or when platform telemetry is incomplete.

There is no universal standard for this yet, but current guidance suggests treating renewal evidence differently by product type. For low-risk collaboration tools, a last-login threshold may be enough. For security-sensitive platforms, a more complete view is needed: feature-level usage, admin actions, and service-to-service activity. This is where vendor-provided metrics should be checked against internal logs, because vendor dashboards often show activity only inside their own tenant and may not reflect downstream use.

Edge cases also matter. An identity or integration may appear unused during a quarter but still be required for disaster recovery, batch jobs, or monthly reporting. Similarly, some agentic and automated workloads generate bursts of activity that do not fit human-style usage patterns. In those cases, the right question is not whether the account logged in recently, but whether it performed an approved function within its expected operating window. The Ultimate Guide to NHIs — The NHI Market and the Top 10 NHI Issues are useful references when renewal questions overlap with visibility, ownership, and lifecycle gaps. The right renewal decision still depends on evidence, but the evidence must match the workload’s actual pattern of use.

Related resources from NHI Mgmt Group

• Why do audit logs matter so much for regulatory compliance?
• Why do dashboards matter in NHI governance?
• Why do application testing tools matter for NHI governance?
• Why do Shai Hulud style attacks matter to NHI governance?