Organisations often underestimate the impact of Shadow SaaS, which creates an underground digitalisation, increasing exposure to security breaches and cyberattacks.

Shadow IT and digital resilience: SaaS Management on the ExCom agenda

In today's dynamic workplace, understanding and managing the ever-evolving landscape of Software as a Service (SaaS) applications has become a crucial challenge for IT teams and organisations. 

Beamy’s Web Browser Extension (WBE) emerges as a game-changer, reshaping how large companies detect and monitor their SaaS ecosystem.

After years of managing SaaS detection across various sectors within large companies, Beamy has encountered the limitations inherent in traditional methods. These conventional approaches to identifying Shadow IT suffer from shortcomings in accuracy and coverage. These challenges are notably intensified in large organisations due to the substantial number of users, diverse application landscapes, and myriad of user behaviours. 

: Traditionally, Shadow IT detection has relied on tools such as Cloud Access Security Brokers (CASBs) and analysis of navigation / proxy logs. However, these present a myriad of challenges. 

: An alternative method employs Single Sign-On (SSO) to uncover Shadow IT by relying on login data. While SSO is an effective approach for monitoring SaaS usage and managing access to known applications, its effectiveness is hindered by limited coverage. This is particularly prevalent as many SaaS applications do not integrate SSO as part of their basic plans. It leads to significant detection gaps, notably with Shadow IT applications often inappropriately utilised under basic free plans.

Financial data analysis tools provide another way of detecting Shadow IT. While financial data can provide valuable insights regarding costs and which cost centres are liable, it usually lacks information on how these applications are used. Additionally, financial data fails to identify applications purchased outside the usual procurement process, such as direct purchases by employees and free applications in use. 

With the explosion of SaaS adoption, the limitations of existing detection mechanisms have become even more problematic. This underlines the pressing need for innovative solutions capable of accurately and comprehensively detecting and monitoring the ever-expanding SaaS landscape.

Beamy's Web Browser Extension (WBE) disrupts this conventional approach by introducing a revolutionary method to detect and manage SaaS usage. WBE's groundbreaking technology transcends the limitations of traditional tools:

: Operating within the browser environment, WBE's direct navigation data analysis enables accurate SaaS app detection, drastically reducing false positives and the need for extensive manual intervention.

Distinguishing Professional and Personal Usage

: Using login cues, WBE identifies the distinction between personal and professional email domains, ensuring a nuanced understanding and eliminating irrelevant non-work-related applications.

 The WBE's approach doesn't rely solely on SSO logins, ensuring comprehensive coverage across all SaaS apps, regardless of their login capabilities. Unlike tools analysing financial data, the WBE provides a comprehensive view that includes applications purchased outside usual processes or available for free. Identifying these apps, which are often inadequately covered by the legal department, ensures their inclusion within an organisation's contractual framework.

The Beamy WBE offers a range of additional advantages beyond its accurate detection capabilities:

: The WBE ensures data security through local in-browser processing, stringent encryption protocols during data transmission and storage, and a transparent, auditable codebase.

: the WBE minimises data collection, pseudonymizes and aggregates user data, and ensures compliance with EU data privacy regulations.

: Facilitating effortless deployment at scale across diverse IT environments through standard management tools like Mobile Device Management (MDM), Remote Monitoring and Management (RMM), Group Policy Object (GPO), or Google Workspace.

: The WBE serves as the cornerstone of Beamy's SaaS Monitoring offering. Beyond its primary function of detecting SaaS apps and Shadow IT, the WBE provides comprehensive insights on user demographics by department and country, detailed metrics regarding app adoption and engagement. These granular insights empower IT leaders and teams to gain a comprehensive understanding of their SaaS landscape over time.

Beamy’s Web Browser Extension represents a significant leap in SaaS management, offering comprehensive insights, unparalleled security, and effortless deployment. Its transformative capabilities redefine how organisations detect, monitor, and govern their SaaS ecosystem, offering accurate data, comprehensive coverage, and an unprecedented level of understanding.

Redefining Shadow IT Discovery

Given the frenetic growth of New Tech (SaaS, AI, low code…), continuous monitoring of the IT ecosystem is crucial. Yet, keeping track of how many applications are used has become challenging due to market evolution and changing business needs. This concern now spans across various departments (security, purchasing, business, etc.) and has gained significant more and more attention from the Executive Committee.

This is an Executive Summary of the Alliancy's Editorial: '

For years, technology and SaaS were exclusively managed by the IT department, which had a firm grasp on the IT ecosystem composed of dozens of applications. However, in recent times, the number of applications has surged from dozens to hundreds, and this figure continues to grow at a frenetic pace. This challenge is no longer confined to IT; it has become a cross-functional and strategic concern within organisations, involving a wider range of departments (security, purchasing, business, etc.) and drawing greater attention from the Executive Committee.

This shift is primarily due to the rapid evolution of the SaaS market, reinforced by a general move towards the digitalisation of Business Units and organisations. These trends are shaping the future of enterprise IT, especially with the introduction of new technologies like AI and low code. In 2022, Gartner projected that 40% of global IT spending would be absorbed by some form of shadow IT. According to Cisco, the average ratio in the largest companies between the number of applications fully controlled by the IT department and all of them, including shadow IT, was a disturbing “one to fifteen”.

Tackling Shadow IT/AI is no longer optional. It is a necessity! Continuous monitoring of the IT ecosystem has become paramount. However, it is increasingly challenging for IT departments to maintain a comprehensive view of the usage of these applications, thereby mitigating risks and establishing robust governance. Traditional static audit methods have demonstrated their limitations in a constantly changing environment, especially in the face of the ‘SaaS Wall’.

It is essential for CIOs to understand that one-shot audits are not the answer to having a comprehensive view of SaaS applications. The market is evolving constantly, as well as the habits and needs of the Business Units (BUs).

Moreover, one-shot audits have a paralysing effect. The IT department suddenly discovers a ‘Wall of SaaS’ composed of 400 SaaS where it thought it had 40… This, of course, brings tensions onto the IT/BUs relationship, but also, no one knows where to start to take back control and start managing this new ecosystem effectively.

To get around this problem, organisations should take 2 steps:

: continuous and dynamic detection is the key where IT is informed when a new solution is detected, when a SaaS is going from ten users to a hundred or when it leaves a business unit in a particular country to go to other parts of the organisation.

2. Set a dedicated team - a SaaS Community:

 creating a full-time SaaS Manager position will help define and drive forward SaaS Governance programs. The SaaS Manager will be in charge to establish the scope and a team around SaaS Management. 

Want to know more about the SaaS manager role and how to set a SaaS community, click 

CASB & SaaS Management Platforms: complementary roles in SaaS Management

CASB tools and SaaS Management Platforms are frequently compared due to their complementary capabilities. CASB primarily focus on the thorough analysis of data exchange volumes, often coupled with a DLP (Data Loss Prevention) system. This approach allows it to pinpoint high-risk applications and potential data leaks in the cloud, making it particularly valuable for security-sensitive scenarios.

On the other hand, SaaS Management Platforms adopt a different perspective, emphasising governance and collaboration with business users. Their primary objective is to dynamically catalogue all available solutions, gaining an in-depth understanding of their evolution. This empowers IT teams to assess the criticality of their usage and, more importantly, guide business users towards the ‘application blueprint’: applications and their designated uses, all in alignment with the philosophy and goals defined by the company.

In essence, CASB and SaaS Management Platforms play complementary roles in SaaS Management. CASB stands as a crucial guardian of security, meticulously scrutinising data exchanges to safeguard against risks. Meanwhile, SaaS Management Platforms serve more as a vital governance tool to amplify the digital transformation in collaboration with all stakeholders involved (IT to Security, Purchasing, etc), ensuring that the adoption and evolution of SaaS solutions align with the company’s strategic vision and objectives. Together, they form a robust framework for a secure and optimised SaaS landscape within the organisation.

Why the CIO is best placed to lead this technological governance

The Chief Information Officer (CIO) plays a pivotal role in raising awareness among the members of the Executive Committee of the evolution of the IT ecosystem, its uses and the needs of the business users. Simultaneously, she/he has the crucial responsibility of ensuring the resilience and security of Information Systems (IS). In this context, the IT department fulfills its mandate of overseeing and regulating the IT infrastructure while actively responding to the technological aspirations of business users in close partnership with key stakeholders such as the CISO, CTO and CFO.

The CIO emerges as the pivotal architect in orchestrating this decentralisation of technology. He/she champions a sustainable and secure approach, working hand-in-hand with governance stakeholders to steer the organisation towards a future technological landscape. This approach ensures not only the seamless functioning of IT operations but also fosters innovation and responsiveness to the evolving needs of business users.

To achieve this, CIOs can rely on the SaaS Management maturity matrix as a starting point towards the establishment of solid governance and the implementation of a SaaS Center of Excellence. It is a step-by-step approach highlighting the people, processes and tools needed at each stage of the maturity. 

The first step is to set up a continuous management system, which will then enable the successive implementation of a cost and contract knowledge system, followed by multi-party governance of the tools in conjunction with the business lines, to facilitate, for example, the addition of a new tool or the renewal of an application already in place. The most mature companies then aim to set up a form of ‘App Center’, a veritable digital catalogue of tools available to more autonomous business units. You can use our 

 to determine your current level of SaaS management, understand what you need to do to get to the next level, and the typical value and outcomes SaaS Governance will deliver.

It is becoming increasingly important to manage SaaS effectively and tackle Shadow IT risks. Yet these matters are, still, too often underestimated. As companies increasingly pivot towards digitalisation, it has become a critical strategic concern for maintaining competitiveness. This is why SaaS Management should be on the 

’s agenda. Consequently, achieving comprehensive and continuous visibility of the SaaS landscape and effectively managing associated risks has become imperative.

Although, these challenges cross multiple functions and involve various departments within the company, CIOs remain central to driving this digital transformation and overseeing the democratisation of technology. A SaaS Management Platform can play a pivotal role, providing the means to monitor the ecosystem and implement a strong governance framework. Navigating the potential hurdles of SaaS adoption will be a significant undertaking, making the choice of the right SMP, a strategic decision.

Why should New Tech be at the top of the Comex agenda?

This article, inspired by Perrine Huveateau's Medium post, "

Shadow-IT: The monster lurking in your business

", is a stark reminder of the risks associated with Shadow IT.

As CISOs continue to grapple with the enduring risks posed by Shadow IT, the emergence of AI generative technology and new stringent regulations have added urgency to the need for IT departments to prioritise the monitoring and governance of SaaS applications.

Shadow IT is not a recent issue. However, IT departments are generally only aware of 

a third of the SaaS applications in use, as highlighted in the Gartner Market Guide 2022.

 This lack of knowledge poses significant risks and challenges within an organisation. Gartner's projections indicate that those who fail to establish centralised visibility and effectively manage SaaS lifecycles could face at least a 25% overspend on SaaS by 2027, as well as a five-fold increase in exposure to cyber risks and potential data loss.

The risks stemming from using SaaS applications vary from security and compliance concerns to financial implications, as well as operational and efficiency challenges.

Shadow IT poses severe security threats as these unapproved applications operate beyond organisational security measures, making them targets for cyberattacks and data breaches. Randori’s State of Attack Surface Management 2022 report reveals that nearly 70% of organisations have been compromised by shadow IT in the past year because of a lack of visibility over their IT assets by the IT department. Additionally, IBM’s 2022 findings show that 45% of companies suffered cloud-based data breaches, costing an average of $4.35 million.

Shadow IT exposes organisations to compliance risks since these applications often evade scrutiny. Regulations like GDPR and industry standards like HIPAA and DORA necessitate meticulous compliance, especially for large enterprises subject to rigorous oversight. In a recent example, in August 2023, the 

 issued orders for four financial institutions to pay $260 million for the use of non-approved methods of communication (WhatsApp, Signal…) to engage in business-related communications, in violation of firm policy.

Apart from compliance fines and data breach costs, unknown applications can lead to overspending on unused IT resources. According to 

, companies will overspend $750 million on unused features of IT software this year alone. This complicates IT budget management, particularly in larger enterprises where 

 surge in SaaS usage. It has become urgent for organisations to assess the risk associated with their use and implement appropriate security measures.

Shadow IT can impact the IS and bring unexpected challenges for IT teams, due to its total lack of planning and good IT practice. This forces the technical team to provide unanticipated support, including setting up workflow configurations, identifying risks, managing data, and so on. All tasks that could have been avoided with prior consultation. This results in diverting end-users and IT teams from their core tasks as well as frustration and tensions between teams: BUs blame IT for not providing the necessary tools and visibility, while IT points fingers at the business for not adhering to established guidelines and protocols. It becomes crucial for IT departments to address those risks and educate BUs more effectively, as they operate in an increasingly complex and regulated environment, particularly in the European market, due to stricter regulations.

The IT landscape has changed radically over the past few years. The new tech-savvy generations have made SaaS applications an intrinsic part of working habits. At the same time, shadow IT has taken hold in organisations, with dangers that can have far-reaching consequences for organisations.

However, it would be counter-productive to prevent the use of these applications in order to control the spread of Shadow IT. IT leaders are faced with a very complex challenge: striking a balance between robust IT governance and meeting the autonomy needs of business users. To achieve this, IT teams need to establish a governance framework that maximises the full potential of this technology while minimising risks.

Beware the shadows: The dangers of the ‘Sh-IT’ monster

The rise of generative AI (GenAI) has led to the emergence of Shadow AI, adding a new layer of risk to those of Shadow IT. Employees are increasingly using these tools without proper training or guidance.

The widespread adoption of Generative AI (GenAI) has sparked enthusiasm among employees across all sectors, by enabling the creation of content, and other media with remarkable speed and quality.

These highly publicized tools are now rapidly adopted in the workplace, without any training or guidelines for proper use. And just as it is difficult for organisations to avoid Shadow IT (the use of any software, hardware or IT resource without the IT department’s approval, knowledge or oversight), it will be difficult to prevent Shadow AI.

 study conducted among over 11,000 corporate employees revealed that 68% of employees who use ChatGPT and other AI tools are currently doing so without informing their immediate superiors or the IT department. The study also shows that the adoption of GenAIs by employees has significantly increased, with nearly one in two employees using such AI to assist them in their professional tasks.

This unchecked adoption introduces major legal and security risks, which may exceed those of Shadow IT.

Like SaaS applications, AI tools are now an integral part of employee work habits. Obstructing its use would be counter-productive as they are reshaping industries and offering unprecedented opportunities for enterprises.

IT leaders must prioritise managing the hundreds of tools that keep crawling into their IS. Yet striking a balance between solid governance and business needs for autonomy is proving to be a daunting challenge, especially when using a variety of sources/tools to make sense of this ecosystem.

Instead, IT teams need to establish a framework that harnesses the full potential of this technology while ensuring compliance with the company’s policy on confidentiality and compliance, in order to minimise the risks.

From Shadow IT to Shadow AI: A New Layer of Risk

Discover interviews of CIOs and CDOs of large companies on the current state of IT democratisation in their organisations and their views on anticipating future challenges.

For a long time, CIOs of large corporations have perceived the massive growth of Software-as-a-Service (SaaS) as a governance challenge and focused on the “fight against shadow IT”. With an expected annual growth rate of 18% until 2030, this SaaS trend is here to stay and represents a massive challenge for IT departments. The digitalisation process has led to a major shift, from a traditional model where IT supplied all software applications to a model where even the least tech-savvy business units choose their solutions on their own. This has forced CIOs to anticipate a profound cultural transformation. The challenge? Ensuring complete visibility over all IT assets, establishing optimal management of costs and risks, and offering a brand-new digital experience for employees.

How should companies organise their digital transformation to make it an “opportunity to be seized and leveraged”, as Andréa Jacquemin, CEO and Co-founder of Beamy, describes it? To answer this strategic question, CIOs from large companies such as LVMH, L’Oréal, BNP Paribas Asset Management, Schneider Electric, Heineken and Equans have agreed to share their views. Despite the fact that they each work in different industries and environments, there is a consensus on what needs to be addressed in the next 10 years.

The changing relationship between IT & Business Units

The digitalisation of Business Units (BUs) is a tremendous vector for digital transformation, provided that it is carried out in collaboration with

the IT department. Rather than being put off by BUs’ initiatives, Franck Le Moal, Chief Information Officer at LVMH, believes that 

“a more detailed discussion between every stakeholder is necessary to build the right architecture and standardisation of the IS to support this transition”

. A stance shared by Stéphane Pain, Chief Digital & Technology Officer at Heineken France, who believes the growth of SaaS can not only facilitate cultural change at the level of a group but also positively transform the relationship between BUs and the IT department.

BUs need to evolve and take on more responsibility

With the heterogeneity of SaaS solutions, it has become essential for BUs to evolve in how they adopt new solutions. L’Oréal, for instance, has implemented a 100% SaaS strategy 

“co-engagement, co-steering and co-development”

, as explained by Étienne Bertin, Chief Information Officer at L’Oréal group. As for Fatia-Fatma Balit, Chief Information Officer at BNP Paribas Asset Management, she believes 

“we need to reinforce the overall understanding of the impact of the democratisation of technology, within both the Business Units and IT teams”

BUs’ autonomy, orchestrated by the IT department

Transforming governance around SaaS is also a way to address the complex issue of technical debt within the company. BUs must be responsible for the types of data and uses of the applications while avoiding duplicates. 

“The objective is to give Business Units more autonomy under the IT department’s governance. This is the very essence of the democratisation of technology trend that we are experiencing today”

, explains Andréa Jacquemin. Equans, for instance, has set up a virtual network as well as a centralised governance system that aim to leverage IT skills directly where they are within the organisation.

With this influx of SaaS solutions within organisations, it is essential to build an accurate inventory of all use cases and solutions. 

“An ‘app store’, for instance, is an interesting way of offering an adapted catalogue while controlling access and downloads”

, suggests Étienne Bertin. With this idea in mind, the IT department of BNP Paribas AM has set out to build an automated inventory that can easily be updated. This would help manage shadow IT, although Emmanuel Gachet, Chief Information Officer at Equans, prefers to call it “flex IT”.

The growth of SaaS makes it even more necessary to have a very fine-tuned vision of the standardisation of processes. This is a point stressed by LVMH’s CIO: data consistency should be a priority for both the IT department and the BUs. At Schneider Electric, business architects have been appointed to define the processes that BUs can rely on. Its CIO Europe Robert Auffray believes “the fact SaaS can contribute to the standardisation process is absolutely key to support business transformation”.

The tidal wave of SaaS adoption has also led to increased cyber risks, because the larger and more fragmented and clustered an information system is, the more exposed the company is. That’s why at Equans, security and cybersecurity are among the company’s “must haves”. The same is true for Heineken France, which is focusing on three “sovereign” aspects of the company: cybersecurity, GDPR compliance and adherence to procurement procedures. The aim is to not hinder adoption but rather to regulate it, with a security effort for SaaS on a case-by-case basis, as L’Oréal’s CIO argues.

Each in their own context and industry, the CIOs all agree: it is urgent and imperative to support this fundamental shift brought upon by the advent of SaaS. The challenge is to have a comprehensive and continuous overview of the digitalisation process in order to monitor all applications used within the company. The management of security risks, GDPR compliance and IT architecture coherence depend on it. The entire organisation needs to be involved, and this beneficial transformation will only be possible by implementing strong collaboration between all stakeholders, especially the BUs and IT department.

How to anticipate the massive leap forward in the democratisation of technology?

SaaS governance is how companies can be sure about the integrity of their security measures and predict potential casualties. It not only protects the financial interests of the organisation but also ensures reduced downtime to overcome any casualty without hindering the productivity of the employees. 

Check the 3-Steps to achieve SaaS governance for optimal flexibility, predictability, and security.

90% of CIOs expect their organisation’s overall IT budget to either increase or remain the same over the next 12 months, according to the

The biggest contributor to the tech budget increase according to this report? Need for security improvements.

There is always a greater need when it comes to security, even with the most effective governance in place, because business operations and priorities are constantly evolving. With the emergence of appealing technologies, increased employee demands, and customer expectations, comes the need for adaptable and flexible governance.

Software-as-a-service (SaaS) has quietly accommodated itself into the organisation’s technology portfolio. IT departments unknowingly let hundreds of SaaS applications that may pose security threats invade the organisation without adequate vetting. And, for governance to stay relevant through the years, it must be granular and should extend to every corner of the organisation.

Originally IT governance teams may have focused on the on-prem giants, prioritised because of the associated financial risk – Microsoft, Oracle, SAP, IBM, VMWare, and Salesforce, referred to as the “Big-6” by the

The governance radar covers the management of these tier-1 software publishers by default because the financial risk resulting from their non-compliance is fairly large.

But the challenge has changed and, now, the IT departments are forced to wrap their head around how they can possibly govern the underlying growth of the organisation’s SaaS portfolios with a framework as robust as that of the on-prem software.

SaaS vendors are selling directly to the end-users who don’t find it necessary to run their purchase decisions by the IT department. Therefore, the need for SaaS governance doesn’t become apparent until IT learns that the business departments’ buying spree has resulted in persisting shadow IT or several unvetted SaaS applications presenting new data storage and privacy threats.

Lack of SaaS governance doesn’t stop at resulting in the wastage of financial resources; rather also exposes the organisation to cybersecurity, operational, regulatory, reputational and organisational risks.

SaaS governance is how companies can be sure about the integrity of their security measures and predict potential casualties. It not only protects the financial interests of the organisation but also ensures reduced downtime to overcome any casualty without hindering the productivity of the employees.

Step 1. Gain complete visibility of your SaaS ecosystem:

The best possible way to start is deep-diving into the SaaS environment of the enterprise. The discoveries resulting from this campaign will set the baseline for SaaS governance. Larger the organisation, the trickier the hunt.

The biggest challenge is excavating the myriad of shadow SaaS that would’ve piled over time when employees purchase subscription-based SaaS tools for personal or departmental use without notifying the IT department.

The best approach is the initiation of an audit across the organisation to discover and flag the managed or unmanaged applications. This formal audit should aim for a pan-organisation check for the SaaS purchases, employees’ navigations logs, SSO data, checking personal devices, browser extensions, etc.

Data from all levels of the organisation - SaaS for personal use by employees, departmental SaaS, and business unit portfolio; should be combined and monitored in real-time to understand trends in SaaS adoption.

The real-time data extracted from the company’s ecosystem will indicate faulty trends and malpractices like unchecked auto-renewal of SaaS subscriptions, functionally redundant tools, no stakeholder responsible for the SaaS’ lifecycle and more such anomalies.

Step 2. Establishing a SaaS governance “Framework”:

The trends observed after the visibility campaign allow us to set forth guidelines and policies, and list best practices to guard every step - from procurement to offboarding of the SaaS app throughout its lifecycle in an organisation. Flexibility, predictability and security are the three main pillars that should be kept in mind during the design of this model.

The challenge is to ensure the right amount of flexibility in the framework. The ease of procuring these SaaS tools has encouraged the end-users to be autonomous and choose the technology that they think fits. And, the last thing the IT teams can do is to put an end to this innovation from the bottom up due to the strict policies.

While there is no standard framework and every structure will be different according to the industry and other factors in question, the one thing that can be in common is its flexibility.

Designing a SaaS governance framework will take rigorous efforts, wherein IT will need to involve external stakeholders specialising in different aspects like security, procurement, finance and even end-users. Already existing procedures like the ones for vetting the SaaS vendor can be optimised in accordance with corporate objectives, communication between the business units can be revised, and data-backed (or ROI-backed) decisions can be given priority in the newly developed model to minimise security vulnerabilities and optimise costs.

Step 3. Create ordered and guided freedom within the teams:

Encouraging the company’s departments to operate within the guardrails of this governance model is a challenge that can be mitigated with the right approach from IT. The governance will only be effective if every SaaS decision remains aligned with the company’s business objectives. SaaS enablement is IT's responsibility.

IT and the departments have been long-advised to collaborate over technology decisions. One approach by which IT can come closer to them is by being sensitive to their technology needs. Introducing a SaaS Directory and an App Store can be that stepping stone toward a collaborative future.

 provides access to over 50K SaaS solutions, including those already in use within the company as well as those on the market that can help meet the employee’s specific needs.

 is an all-in-one platform where teams can request apps through workflow, find key guidelines or best practices relative to the governance policy, engage with other teams to ask for advice about a solution or a need and use the market directory. Essential features of the app store are security criticality scoring, application owner info, approval status and more.

An effective SaaS governance project will reflect in two ways - financially and as an overall changed mindset; where teams are aware of what possible turns can their purchase decision take and how distant their step is from the organisation’s corporate objectives.

What is SaaS Governance? 

SaaS Sprawl is the unchecked proliferation of third-party cloud applications procured directly by employees or business units without adequate vetting, sanctioning and SaaS life-cycle management.

Its impact amplifies exponentially in the context of large organisations. This article discusses the challenges of SaaS Sprawl, with listed recommendations and best practices to prevent or overcome it.

Software-as-a-service (SaaS) vendors have made no mistakes in extending their technology’s target persona from just the IT teams to end-users (employees).

Looking back at the SaaS industry growth, they solved the problem even before it showed up. When the pandemic forced companies to operate online; the ones already thorough with the SaaS model fared better than the conventional ones with on-prem software.

But over-consumption of anything, no matter how good, can be harmful. The same is true of SaaS tools.

There hasn’t been a cap to this consumption lately, and this uncapped adoption of SaaS software is the so-called, “SaaS Sprawl”.

SaaS Sprawl is the unchecked proliferation of third-party cloud applications procured directly by the employees or the business departments without adequate vetting, sanctioning and SaaS life-cycle management.

SaaS Sprawl has a different meaning altogether, and its impact amplifies exponentially in large organisations (1000 employees or more), where collaborative efforts will have to address an extra layer of business units before sorting out sprawling at the departmental level. This article discusses the challenges of SaaS Sprawl, with listed recommendations and best practices to prevent or overcome it, once and for all.

Although Google Docs serve the same purpose as Notion or any other collaborative workspace tool, the latter is a specialised platform and thus more relevant to its niche. SaaS publishers have managed to know the ins and outs of their target market; it is only natural that their customers reciprocate their efforts.

Subscription-based cloud software with a short time to value (TTV) and extensive scalability is in itself a very sustainable model and explains how SaaS has become the de facto standard in application delivery.

Not to mention how its qualities are not just limited to the feasibility of its model; credit also goes to these applications’ capabilities, designed specifically by keeping the digital consumer in mind. For example, no-code solutions are lowkey revolutionary or some vendors offer ample irresistible customisation options like self-service SaaS models.

The pace of SaaS adoption reflects a rapid digital transformation in organisations, but with that comes the challenges of managing the constantly upgrading tech stacks.

All these qualitative factors help SaaS tools to multiply their quantitative reach in organisations giving way to unintentional SaaS sprawl.

SaaS users are always looking for tools that can help them improve their efficiency and productivity, and no employee has to think twice before switching to a better alternative. But with such extensive choices come grave consequences.

Plenty of options mean that the employees don’t have to adjust to other departments’ choices and would want to use the most familiar technology.

It is a growing trend or rather a ‘common practice’ - that employees have become autonomous in choosing SaaS apps by and for themselves, also decentralising the typical tech procurement and sanctioning methods. The lack of sanctioning these apps by the IT department results in their unauthorised use by the employees or the so-called Shadow IT.

But IT departments have only recently offloaded the burden to obtain and manage technology to these innovative business teams. They have every reason not to stop this innovation from the bottom up as it only allowed them to come closer to the businesses. But it also brings in the unforeseen challenge of persisting SaaS Sprawl.

3. Digital Employee Experience (DEX) & collaboration gap:

A marketing team might prefer Hubspot as their CRM, while the sales team might choose Salesforce, depending on their expertise and preferences.

Unchecked SaaS sprawl results in hundreds of unmanaged SaaS applications across an organisation, each acting as an exposure point for unwanted risks.

Unmanaged SaaS apps present a significant challenge in the following ways:

Beamy’s client organisations (large enterprises) add an average of 30% of new SaaS tools to their tech stack yearly. This proves that SaaS is becoming mainstream and accounts for a significant share of the Enterprise IT budget. But on the other hand, measuring the ROI of every SaaS procured is not feasible because it depends on the extent of its adoption (or usage) by the employees. Underused licenses, inactive applications, overlapping apps, etc. signify unoptimised and wasteful spending.

The SaaS inventory is replenished every year as the business scales, and the outdated apps must retire to avoid risks like data breaches from the SaaS Sprawl. But most companies are not agile enough to upgrade in such a manner every year.

With additional cloud software being procured to address the unique challenges of a large enterprise, the old data gets siloed. Collaborators are spread across all levels in a company. Automated SaaS Management solutions should be introduced to avoid the fragmentation of existing processes and keep agility unimpaired. 

6 Best practices to mitigate SaaS Sprawl:

What is SaaS Sprawl?

Unoptimised SaaS apps are an excellent source of wasteful technology spending in organisations. SaaS Spend Optimisation is a 3-step process aimed at minimising the costs incurred from underused, overlapping, unnecessary SaaS tools and their unoptimised renewals, possible cancellations and consolidations.

Tech vendors are going the extra mile to help their customers trust them.

“Try it free for a month” always sounds interesting.

The aftermath of trying it for free, for some of us, looks like this: we subscribe to tech solutions available online temporarily, to address an immediate need and the next thing we know is that its free subscription ended a while ago, and our company has now been paying for the service we subscribed to, for months.

But until we make room for regret to kick in for using the free subscription, it is too late for the IT department to ask for a refund from the vendor. 

Such shortcomings of SaaS Management are an excellent source of wasteful spending for the IT department.

A lot of focus is placed on software’s ROI in companies but how do we plan to keep up, when their volume itself is unknown? Such is the case of SaaS software, whose standalone prices aren’t high enough to draw the attention of the ROI police but cumulative and unoptimised, they represent a significant share of wasteful technology spend.

In this article, we’ve discussed all the possible optimisations in SaaS operations and assets.

SaaS Spend Optimisation (or SaaS Cost Optimisation) aims at reducing the costs incurred from unoptimised SaaS platforms (often existing as unused, overlapping tools) and their unmanaged renewals, cancellations and possible consolidations.

What are the steps of SaaS Spend Optimisation?

Discussed below, is a 3-step process of obtaining relevant data, assigning stakeholders to process that data and finally optimising the SaaS spend based on the gathered insights.

Overspend results from incomplete visibility on subjects like unknown app users, unmanaged subscriptions and so on. Mapping and tracking this missing information could've been a job already half-done for locating the source of overspend. But most organisations are behind schedule and for them, the best time to start is right now. 

 is the best course of action for getting started. 

This SaaS directory should be a manual spreadsheet, shared between the project owner (PM for SaaS Spend Optimisation) and the individual application stakeholders (discussed later in detail). 

The directory should ideally include the following information:

As the project advances, other important information can be introduced after a deeper investigation and involvement of other departments.

These data can be obtained by means of an audit - a pan-organisation check which should include the financial footprint from the SaaS purchases to locate each and every application which is paid for and can also be extended to a screening of the personal devices in hybrid working environments.

This step of 'discovery' gives us a blueprint of the company’s SaaS environment, now available for further optimisation.

This directory will also serve as an MVP for further advancement in the project using an 

 discovery dashboard and an internal real-time app store for the company’s SaaS ecosystem.

Step 2. Assigning an owner to each SaaS app

With ample information now available, we can move on to the next step. Which is assigning a stakeholder (or owner) for each application, who will oversee its management throughout the SaaS app’s lifecycle. 

An owner can be anyone with an understanding of the SaaS tool and the ins and outs of the external provider. 

External SaaS providers also tend to compromise their client organisations' security in the form of 

Such scenarios signify the importance of having someone accountable for the application and its provider, to keep the situation from going haywire.

, the collaboration distance between the IT department and the end-users (employees, who procure the SaaS software) is extremely wide. Astronomical amounts of SaaS tools await proper management and new apps keep appearing in no time.  In such instances, it is highly recommended to assign a business application owner from the

for all apps to avoid any mismanagement later on.

An application owner(s) should be responsible for the management of the following:

A one-man army cannot optimise hundreds of SaaS and it should be expected of the Finance or the Procurement department to be involved in all the stages of SaaS Spend Optimisation as their insights will only refine the raw data.

 An enterprise-level approach, which includes operational actions to address the most urgently required optimisations in the current tech stack. These optimisations will ideally have an extensive influence on the company’s budget and will allow the setting of the best course of action for future SaaS investments.

 A long-term optimisation approach should address all the ongoing and future optimisations of the tech stack based on the in-depth benchmarking, adequately defined processes and accountable stakeholders to prepare an unfailing foundation for any future tech needs. 

7 Best Practices in SaaS Spend Optimisation

1. Deprovisioning abandoned or underused SaaS apps:

Over 30% of new SaaS tools are added to the SaaS portfolio, year over year, in Beamy's client organisations.

A percentage of these new applications will eventually be abandoned with time as they become too outdated for further usage, or as new applications replace the older ones. 

With this practice, organisations often end up with multiple SaaS platforms, with little to no significant usage. These SaaS tools exist in the background and the 

 of the SaaS applications can only be proved through their level of usage or the level of adoption by the respective teams. Tracking usage also improves future purchase decisions. 

With clear visibility of what apps have no longer a purpose to solve, companies can bring a balance between the budget spent on acquiring new SaaS apps and getting rid of the older, unused ones.

Application owners should be responsible for reporting such underused or abandoned tools, followed by their timely de-provisioning from the SaaS portfolio, thereby saving significant money on idle software.

2. Reducing duplicate and overlapping SaaS apps:

While companies cannot disregard employees’ satisfaction in using the tools of their choice, they sometimes tend to overlook the possibility that different departments could be using 

 apps - different apps serving the same purpose. 

For example, it is only wise that the Customer Success department uses a different video conferencing tool than the rest of the teams because their clients utilise that tool. But this comes with a cost.

Sometimes the features that a team wants in an app are not distinct enough from what was already present in the tech portfolio. For e.g. some employees choose Notion over Google Docs as their preferred collaborative workspace. 

, the tendency of duplication or overlap in SaaS apps is higher, as the redundancies occur on a 

 instead of only between different business teams.

There lies ample financial opportunity to eliminate such redundancies by improving the overall visibility of SaaS software in use and its overlapping functionality. A collaboration between the business units (or departments) can help identify such redundant software. 

Request a demo

Get in touch with our SaaS experts