Organisations often underestimate the impact of Shadow SaaS, which creates an underground world, increasing exposure to security breaches or cyberattacks.

Beamy raises US$9 million in Series A funding. 

Beamy and MEGA International, respectively leaders in SaaS governance and enterprise architecture, announce their strategic partnership aimed at fully integrating the SaaS ecosystem into IT’s control. With this partnership, MEGA and Beamy can offer customers significant integrations and synergies between their products.

A complete and powerful solution to eliminate shadow IT

The current context of business digitalization highlights the explosion in the number of SaaS applications used within organizations, creating a phenomenon of underground digitization. Several hundred SaaS applications are frequently used by the business lines, often bypassing those involved in corporate governance (only 32% of SaaS applications are controlled by the IT department, 17% by the data protection officer, and 13% by security)*. According to KPMG, this explosion is expected to escalate, with the cost of the SaaS ecosystem in enterprises being nine times higher by 2030.

Aware of the critical risks that the SaaS ecosystem poses to security and regulatory compliance (GDPR in particular), and more broadly of the need to align SaaS ecosystems with organizations’ IT strategy, Beamy and MEGA decided to combine their strength and integrate Beamy's Discovery SaaS technology with MEGA's HOPEX enterprise architecture platform.

This new integration guides large companies in their adoption of more efficient IT strategies by listing all the applications and technologies used on-premises and in the cloud. Thanks to the search automation offered by Beamy's Discovery solution, IT teams can optimize time management, reduce costs, and reduce the risk of their infrastructure being exposed to cyberattacks.

A strategic partnership between two leading players 

By partnering with MEGA, a recognized global leader, notably within the Gartner Magic Quadrant for Enterprise Architecture, Beamy is taking another step forward in accelerating its growth. It now benefits from enhanced visibility with 2000 MEGA customers in Europe, the United States, Latin America, and Asia. Beamy thus consolidates its position as a benchmark player in SaaS governance, natively integrated into current corporate governance tools.

For MEGA, the goal is to maintain its leadership position in enterprise architecture by offering the most comprehensive platform possible and integrating the best technologies on the market. The integration between Beamy and MEGA’s solution should appeal to MEGA customers, for whom this phase of identification and inventory of SaaS applications is a major pillar of any transformation project.

Founded in 1991, MEGA International is a global software company and a recognized market leader for twelve years. The company partners with customers to improve governance and accelerate transformation by leveraging technology. MEGA helps companies better analyze how they can operate and make the right decisions to accelerate the creation of value. The HOPEX Platform connects business, IT, data, and risk perspectives in a single place that integrates across an entire company’s ecosystem. The MEGA Services team partners with customers to deliver projects with a pragmatic approach.

Beamy is the leader in SaaS (Software-as-a-Service) Management in Europe and works with a broad range of major players such as BNP Paribas, Fnac Darty, Macif, Gameloft and Engie. Large corporations are currently experiencing very rapid growth in the number of SaaS applications they are hosting. In addition, the resulting underground digitalization is real and largely unseen by IT departments, thereby generating security and GDPR risks. Thanks to its innovative technology, Beamy provides a SaaS governance platform that can be used to detect and control the entire SaaS environment of its clients to eliminate Shadow IT. In this way, Beamy can help the CIOs of large organizations regain control of this parallel IT and rebuild effective governance so that Business Units can expand their digitalization through SaaS within the context of a defined framework. Beamy’s goal is to make SaaS Governance one of the priorities of large enterprises in Europe and across the world.

Partnership MEGA

With a forecast of an average annual growth of 25% through 2030, the rapid rise to power of cloud computing raises major issues in terms of security and governance. The French government's initiatives to establish "cloud sovereignty" fail to adequately address the impact of SaaS, despite the fact that it is creating underground (or shadow) IT systems in companies, thereby dramatically increasing their exposure to cyberattacks.

The use of SaaS among employees is booming, creating an underground digital world

According to a KPMG study carried out last May, as part of the French government's initiative on data sovereignty and the Cloud, the European cloud computing market is set to expand, reaching €560 billion by 2030. It distributes €230 billion equally between infrastructure needs - IaaS/PaaS -, and software/application requirements: SaaS. But, while data infrastructure has dominated the sovereignty debate over the past few months, with the European Gaia-X initiative and the defence of French providers OVH, Orange and Scaleway against US tech giants such as Amazon, Google and Microsoft, little or nothing has been said about its software equivalent: SaaS. 

And yet, often unbeknownst to IT Departments and upper management teams, the use of SaaS among employees is booming, creating a kind of underground digital world with little regard for security (GDPR) or digital sovereignty issues.

As a result, in the top firms listed in France's CAC 40 index, and across large companies as a whole, SaaS is now a key vector in digitalising their business. Often referred to as Shadow IT, the SaaS ecosystem generally relies on the widespread use of tools made available online, which are usually extremely specific and operate on a subscription basis. These tools are deployed without the oversight of onerous corporate governance procedures, and mostly pass under the company's radar since “the group doesn't bother looking at anything under €100k”, even if they represent millions of euros in cumulative annual costs. This outsourcing of IT regularly manifests as unrestricted use of personal data (more than 40% of SaaS used is American), potentially generating a multitude of future security issues and compliance vulnerability.

Only 14% of SaaS providers in CAC 40 companies are properly managed 

Therefore, these are without a doubt "underground" digital systems, with an average of over 190 different Cloud providers for a company with more than 1000 employees. Out of these 190 providers, only 60 are managed by an IS Department, 44 by the DPO, and 36 by security teams. And if, as predicted by KPMG, the Cloud continues to grow, then more than a thousand different SaaS providers could be used by a single company in 2030. Establishing a clear governance framework for cloud-based SaaS will therefore be vital for the future, since it brings to the fore issues of data sovereignty, cyber defence and the digital performance of our companies.

Allowing business lines to manage their own digital transformation

Since digital transformation is everyone's business, and especially that of the teams themselves, it's only natural for them to want to tackle it hands-on. Particularly those from the latest generation: the generation of smartphones and apps that can be installed and uninstalled in a click. This "one-click" generation expects companies to provide the very best that technology has to offer, whether in terms of processing speed, user-friendly interfaces, or the use of tools to simplify and enhance their work performance. And what’s more, it would be something of an understatement to suggest that this is not yet part of the solutions offered by major companies.

Despite the fact that the technology required is available on the global market - almost 100,000 SaaS - with venture capital investments in the hundreds of billions of euros. These solutions rank among the fastest, the most powerful and the best-suited to ensuring the digitisation of processes, but are also those that store and use the most personal data abroad. What is needed, therefore, is the creation of a kind of App Store for each company, to give businesses the ability to choose the best software for themselves, while carefully guiding them to select, use and de-risk these tools in the long term.

Coordinating business units and IS teams for effective digital governance 

The CIO holds a strategic position in this regard: that of providing the company with a framework for decentralising digitalisation. Of making sure, despite the technological progress pursued by operational teams, that a regulatory framework is respected, that personal data processed by these tools are properly protected, and that external security breaches are brought down to a minimum. In this context, the CIO acts as the orchestrator of the digital ecosystem, giving freedom to business units while making sure that the application landscape is optimised and safe.

The focus on a "sovereign cloud" will remain a futile endeavour if SaaS, which counts for half of Cloud Computing, is still placed in the background. Within companies, it is up to general management to initiate the construction of decentralised approach to digital governance, the only thing capable of successfully bringing structure to this volatile part of the Cloud. It's a strategy that requires the involvement, not only of the CIO, but of the entire executive committee, and all departments affected by the challenges of digital transformation.

But for now, the most pressing priority is to take stock of the existing Shadow IT being used in this way!

Tribune Shadow IT

In the last few years, the rise of SaaS in companies has been perceived as a double-edged sword. A major source of freedom and acceleration for businesses, it has also been synonymous with headaches for IT departments, particularly from a security and compliance standpoint. Didier Fleury, CIO of the French mutual insurance group Macif, and Andréa Jacquemin, CEO of the start-up Beamy, which specialises in supporting this phenomenon, give their recipes for finding the right balance in organisations.

Alliancy. Why did you commission a company like Beamy to detect the SaaS tools used at Macif?

The starting point was really detecting shadow IT (the use of IT resources in the company that are not controlled by the IT department, editor’s note) in a concrete way. The teams often talked about it and we're already trying to have a more comprehensive picture, but the phenomenon had to be objectified.

With Beamy we started with a process of identifying all the SaaS tools used. This highlighted what I already suspected:  the ones we were aware of were just the tip of the iceberg. This starting point opened up the discussion: what does SaaS really do for our organisation?

In fact, the ubiquity of SaaS is understandable. Start-ups are attracting businesses by offering highly relevant solutions in specific verticals, so the interest is obvious. What’s more, the initial costs are low, it’s easy to get started, and there’s no complex integration... And, most of the time, you can get started with such a solution without having to go through the Purchasing Department indeed, given the needs and amounts involved at the outset, a simple business bank card can bypass conventional purchasing processes. This makes sense because businesses need to move fast. The problem is that when the subject is detected too late, the place it has taken in the IT environment is very important, but without taking on board GDPR compliance, regulatory compliance and compliance with the ACPR (

‘Autorité de contrôle prudentiel et de résolution

’ - the French supervisory authority that supervises banks and insurance companies), even though these are essential points in our activities.

The growth of SaaS is not something new. How aware are CIOs of the problem today?

 There was an extra surge during the health crisis, especially in marketing and HR activities. Everything went very fast in companies. In the best of cases, businesses have taken a declarative approach, such as MARIE, but this is seldom verified in detail. This explains the current gap between what CIOs think they know about shadow IT and the reality. In our case, for example, we had about 50 identified solutions, but the discovery showed us that there were actually more than 150 in use.

 This is in line with the average numbers we see in the 1000+ companies we work with. On average, out of 190 SaaS in an organization, only 27 are fully managed by the IT department, and another 46 are partially approved... That leaves nearly 120 that are completely unknown. The phenomenon is systemic and can no longer be dismissed as residual shadow IT. It affects all types of companies, but SaaS is a more difficult subject for traditional organisations, compared to those founded in the digital age, for whom this technological approach is often the basis of the business. Above all, few CIOs are still humble enough to say they are not sure. We still often hear arguments like, ‘in my company it’s different’... The phenomenon is considerably underestimated.

What should be the new role for CIOs in this context?

 In our case, we were able to sort it out thanks to Beamy’s application dictionary, which presents the typical attributes of the various SaaS, their referencing, and their hosting. This gives CIOs a basis for checking and creating a catalogue of validated and consistent applications... We don’t want to prevent businesses from having ideas, but we want to be able to guarantee that they won’t reinvent the wheel and that they will integrate security and compliance dimensions into their quick selections. The role of the CIO is, therefore, to enable anticipation, in order to avoid breakdowns later on, after the projects have progressed.

 The debate is potentially explosive, because it pushes us to break out of our old habits, and it questions the traditional IT-business relationship. But this debate must take place. In a recent study, KPMG estimates that the volume of SaaS in companies will increase ninefold in ten years. This means that there will be an average of more than 1,000 applications of this type in 2030, with the proportion managed directly by the IT department in a centralised manner remaining very low compared to that managed by the business departments, which is soaring... The issue is, therefore, one of ensuring the proper decentralisation of IT, because, in any case, digital technology is everywhere nowadays. In this context, the role of the CIO is to detect and build a catalogue in conjunction with the business departments. This is to make them responsible for their solutions, by creating an ad-hoc governance of this new decentralised environment.

It is, therefore, a long-term approach that we recommend, based upon specific data models for each sector and type of company. The role of CIOs is changing significantly to allow them to give this autonomy to business departments through a matrix of responsibilities.

 Indeed, discovery is not enough. There must be ongoing monitoring of the applications used, but also, and more importantly, the implementation of a governance framework that is truly adapted. It’s not just a question of wanting to police. That would be pointless.

What should be the characteristics of this governance framework?

 It starts with a common rule, in order to be a point of reference for all the business and IT parties, with business representatives who will be able to check what solutions already exist in relation to their needs and match them to projects already underway. In this way, we move away from very sequential processes and better integrate the IT-business relationship, with the CISO engaging constructively on the issue of security.

 When we speak of governance, we must also speak of accountability: the spirit is to define a framework of freedom for the business departments according to the specific characteristics of each company, but in which responsibilities are clearly established. Transparency and the communication that goes with it are, therefore, also essential features.

 That was one of the things I hired for when I arrived: having someone whose job it really is to do IT marketing and communication is very valuable. When a CIO doesn’t make it known that he or she understands the business, it’s very difficult to be credible and to be listened to... There’s no point in having nice consultant speeches about agility, without real life experience and the difficult questioning required by these changes.

In terms of the IT-Business relationship, the problem of the traditional project management and project control approach has, I think, been known for a long time. Depending on the period, project management assistance, which was the link between the two, tended to lean more to one side or the other, and this was more or less well received by the stakeholders...

But in fact, that’s not the issue. IT must define set rules, infrastructure and cybersecurity; and from there, the business solutions are the direct responsibility of the business departments, with the associated IT skills, enabling them to manage their entire responsibility within the framework of the rules set out.  This has already been tried in the past, but now we are trying to take a comprehensive approach. By gradually moving away from V-cycles, we are asking for a change in the mindset of the teams, which is clearly moving in this direction. And the effects can be seen at the highest level: for the past two years, the general management has been paying close attention to the challenges of the information system as a whole.

Macif

Beamy, a European pioneer in SaaS management for large companies, has raised more than 9 million dollars in Series A funding. This funding round was led by the 

 funds, as well as business angels Nicolas Hernandez (

). The solution has already attracted notable customers including 

 to provide a framework for governing the decentralisation and implementation of their SaaS tools across their businesses.

Becoming aware of the explosion of SaaS in business is vital.

, offers companies a unique solution that can detect and control the explosion of SaaS applications used in a decentralised way. The platform thus helps CIOs and other IT leaders to control this parallel IT/digitalisation and strengthen their employees' technological autonomy while preserving corporate governance.

The days of cumbersome and complex software suites being solely implemented and managed by IT departments are over. For years, SaaS has been exploding uncontrollably in large companies, creating underground digitalization.

In companies with more than 1,000 employees, there are on average several hundred different SaaS solutions in use, representing several million dollars in annual costs. According to a recent study by KPMG, the SaaS budget of companies is set to increase by 90% in the next 10 years, covering several thousand different solutions. A new IT paradigm is emerging.

However, this massive adoption of SaaS is largely outside of the IT department’s control, which leads to a considerable underestimation of the real volume of SaaS applications already used by the business lines. Consequently, these companies become highly vulnerable to the risks of cyber attacks: each uncontrolled SaaS application represents a potential security breach. Finally, SaaS budgets, representing an ever-increasing share of corporate IT, are largely under-optimized. Many SaaS solutions cover the same uses and are thus redundant, while others are underused or even completely unused. 

The need to build a framework of technological autonomy for all professionals

There is a change in the way large enterprises procure, implement, use and manage SaaS software applications. It's more than just an IT phenomenon - the explosion of SaaS has introduced a real change in business organisation: 

Accepting this trend means allowing employees who consider technology to be vital to the completion of their activities, to be engaged and become the primary actors in their IT landscapes. 

For this, Beamy has developed powerful scoring algorithms capable of detecting all of the SaaS applications actually implemented in the company. Beamy is then able to follow the evolution of each application over time, provide employees with a catalog of all applications implemented in the company, define an autonomy matrix according to the potential risks of future applications, and navigate an app store of more than 50,000 applications on the market.

Beamy thus guarantees a global approach to SaaS governance necessary to support large companies in the long term to structure their IT decentralisation and establishing synergy between all stakeholders (CEOs, CIOs/other IT leaders, and business teams).

Beamy wants to accelerate its international expansion

With an impressive end to 2021, this fundraising will allow the company to accelerate its international development (Beamy already being present in France and the United Kingdom on the international market), to create global leadership, and to strengthen customer relations by supporting them in their long-term governance efforts. “We are convinced that SaaS issues are major issues for large companies, whether French or international. With this fundraising from major investors including Agaé Ventures and Isai, both of whom are recognized for offering cutting edge expertise in the tech sector, we are setting out to conquer the international market,” explains Andrea Jacquemin.

To do this, Beamy plans to focus its investments on two major areas: recruitment, with plans to hire 40 more team members in the next twelve months, and product development, with the strengthening of detection technology and decentralisation workflows to further streamline collaboration between IT and business lines in the implementation and management of new SaaS solutions.

Thanks to its innovative technology, Beamy offers a SaaS governance platform that detects and controls the entire SaaS environment of its customers and eliminates Shadow IT. Beamy thus helps the CIOs of large companies to regain control of this parallel IT and rebuild effective governance to enable businesses to amplify their digitalization through SaaS while framing it. Beamy's ambition is to make SaaS Governance one of the priorities of large companies in Europe and internationally. To learn more, visit https://www.beamy.io

Aglaé Ventures, the “tech” investment vehicle of Groupe Arnault, invests between €100k and €100m in fast-growing technology companies. Present in France and the United States, Aglaé Ventures focuses on SaaS software, marketplaces and content platforms. Companies supported by Aglaé Ventures include Airbnb, Algolia, Backmarket, Databricks, Lyft, Meero, Riskified, Slack and Spotify.

Nearly 300 successful entrepreneurs, who have invested in ISAI funds, and more than 50 ISAI-backed start-up co-founders share the collective ambition of co-writing great entrepreneurial stories. ISAI invests in differentiated projects run by ambitious teams that it selects rigorously and actively supports. ISAI Gestion, an investment management company approved by the AMF, with over €500 million under management, aims to finance and support high potential Tech companies, at the seed/post-seed stage (venture capital, ticket from € 150k ticket to € 3m with participations in successive rounds) or when they have already reached the break-even stage (Tech Growth/LBO, tickets from €5m to €50m). More information on 

Request a demo

Get in touch with our SaaS experts