Shadow IT and digital resilience: SaaS Management on the ExCom agenda

, Stéphane Louerat, the Director of Infrastructure, Cybersecurity, 

 at Clarins, faced a significant challenge: a lack of visibility over the SaaS applications used by the company's Business Units (BUs). Some departments and subsidiaries have begun to adopt applications to meet their needs.

Due to the group's growth, Stéphane Louerat, the Director of Infrastructure, Cybersecurity, and IT Markets at Clarins, faced a significant challenge: a lack of visibility over the SaaS applications used by the company's Business Units (BUs). Some departments and subsidiaries have begun to adopt applications to meet their needs.

The IT democratisation and BUs autonomy to choose their own application led to the explosion of unknown solutions within the IT ecosystem, whose increasing volume jeopardised the group. As a result, Clarins enlisted Beamy to tackle three key issues: (1) detecting and cataloguing all SaaS applications (including on-premise solutions), (2) securing and rationalising the SaaS ecosystem, and (3) establishing dedicated cross-functional governance.

This challenge was especially significant given that each group’s subsidiary operates as a “profit centre” with IT managed locally.

Clarins is a French family-owned business specialising in skincare and makeup products, distributing its products through its 28 subsidiaries in France and nearly 150 countries worldwide.

Detection & Cataloguing of all SaaS applications

BUs got into the habit of deploying solutions without IT management's approval. The IT department identified this trend as a result of the absence of specific processes or guidelines for SaaS applications. This lack of oversight caused friction with the BUs and and wasted significant time for IT teams, who were only called for support months later when security risks emerged.

Clarins' goal was to regain complete visibility of the company's entire SaaS ecosystem, including On-Premise solutions in the long term, 

to effectively manage the risks associated with SaaS growth (cyber threats, regulatory compliance…)

Data consolidation and security for all SaaS applications

Upon discovering shadow IT applications, the IT department realised that some unknown SaaS applications

It became critical to gain a global understanding of risks for effective management and establishing uniform security protocols across the organisation.

The aim was to identify high-risk applications and include them in the IT department's established policies

—creating a collaborative framework with BUs for using SaaS solutions or when requesting new solutions.

Establishing cross-functional governance for the SaaS ecosystem

Beyond cataloguing its applications, Clarins sought real-time monitoring of its SaaS ecosystem. This ongoing monitoring aimed to eliminate tedious manual tasks for the IT department, such as identifying duplicates and categorising applications. The objective was to better understand business needs and ensure they weren't already met, confirm the relevancy of used SaaS solutions, and control that new solution choices complied with Clarins's digital, IT, and cybersecurity policies.

Complete visibility of all SaaS applications, including Shadow IT

Beamy played a pivotal role in helping Clarins identify, catalogue and gain a comprehensive insight into all SaaS solutions used within the organisation, including those in Shadow IT. Through an in-depth analysis of accounting data, proxy logs, and the existing IT repository, the company conducted a comprehensive diagnostic of all applications used within the group. After a year of effort, the IT department, thanks to Beamy’s platform, highlighted over 270 applications, with 235 categorised as shadow IT, while only 35 were initially referenced. The long-term goal was also to integrate all On-Premise applications.

Efficiency through automation of low-value manual tasks

Business Units chose SaaS applications to improve their efficiency,

which did not follow IT governance processes. However, without adequate planning or IT best practices, this approach led to internal disruption.

For instance, IT was often approached by departments to subsequently connect SaaS to the Single Sign-On (SSO), requiring the allocation of unforeseen resources, especially for high-risk applications. Additionally, IT had to provide technical support for new, unplanned applications, configure data flows, identify risks associated with unused licenses, and manage personal data. By using Beamy's platform, the IT department saved time and resources, eliminating tedious and time-consuming tasks—such as manual application inventory campaigns, thanks to portfolio analysis.

Risk remediation for security and compliance

Beamy supported Clarins in pinpointing applications with potential risks, focusing on data protection and compliance. A thorough review of each SaaS application ensured adherence to security and compliance standards. After identifying 270 applications, including 235 not referenced in the group's IT information system, Beamy played a crucial role in assessing each application's criticality level.

This process uncovered several high-risk applications. These SaaS were subjected to the IT governance process, allowing the IT department to regain control and implement necessary measures to mitigate these risks. This significantly reduced risks associated with shadow IT and improved Clarins' overall security posture.

Mastering the SaaS budget, including Business Units’ budget

Beamy’s portfolio enabled Clarins to regain control over SaaS-related budgets and continues to do so for new solution requests. The company recognised that the technological budget had been underestimated, as executive management traditionally considered only the IT budget. A significant portion of BU budgets is now allocated to SaaS applications. 

Beamy provides an overview of the organisation's spending, with direct visibility of all applications in use, improving synergies with governance teams.

This consolidation will enable the following year's budget to be drawn up more reliably. With a precise understanding of business expenses, the IT department will better anticipate future needs, which are expected to increase annually. Consequently, IT teams will be better equipped to justify the budget to the executive committee, given their comprehensive grasp of current and future needs.

With the surge in SaaS solutions, companies increasingly rely on Cloud services. SaaS providers take advantage of this by imposing sometimes abusive conditions: higher prices, unclear renewal conditions, complex contract compliance, etc. The client/supplier dynamic is shifting. Beamy helps large organisations regain control and address these challenges proactively.

The massive adoption of Cloud applications by business departments and technological evolution have transformed how IT departments manage IT assets.

With Beamy, Clarins acquired continuous visibility of SaaS applications and a global understanding of their usage while also implementing governance to reduce risk, secure IT assets, and optimise budgets.

The objective was not to hinder business initiatives but rather to strike a balance between control and risk management on the one hand and business agility and time-to-market on the other. This approach has enabled Clarins to protect its IT ecosystem effectively while promoting innovation and collaboration with Business Units, aligning with a strategic perspective that focuses on anticipating, comprehending, and adapting to changes in Clarins' SaaS landscape.

Today, Beamy serves as a unified platform for managing the complexities of the SaaS landscape, enabling better monitoring and understanding of SaaS usage, and implementing governance processes tailored explicitly to SaaS applications to improve collaboration between departments.

Clarins customer story

Beamy, the leading SaaS Management Platform (SMP) player in Europe, is pleased to announce that it has received the ISO 27001:2023 certification delivered by Afnor.

This certification underscores Beamy's commitment to maintaining the highest data security and confidentiality standards for our clients. It ensures we have implemented an effective management system to identify and manage cyber threats. The ISO 27001 certification encompasses all of Beamy’s products: its SaaS Management platform, customer data processing, and web browser extensions.

ISO 27001, created by the International Organization of Standardization, stands as a recognised standard that specifies the requirements for establishing, implementing, maintaining, and continually improving a strong Information Security Management System (ISMS). Achieving ISO 27001 certification demonstrates Beamy's dedication to protecting customers’ sensitive information and providing our clients with the utmost confidence in the security of their data.

Beamy's ISO 27001 certification further solidifies our position as a trusted partner for large enterprises seeking to streamline SaaS governance processes while mitigating security risks and ensuring regulatory compliance.

Beamy also complies with the ICPA's SOC 2 criteria, having completed the SOC 2 Type II report in 2023.

Developed by the American Institute of Certified Public Accountants (AICPA), the SOC 2 standard outlines the measures companies should adopt to ensure the security of customer data during handling, processing, or storage.

The SOC 2 Type II attestation report shows Beamy's engagement in protecting our client’s data.

To request a copy of our certification or report, please get in touch with us

Beamy is committed to security excellence: Certified ISO 27001 & SOC 2 Type II Report completed

In recent years, the risks associated with IT incidents, such as cyber-attacks and data breaches, have increased in both frequency and severity, driven primarily by the rapid expansion of software as a service (SaaS).

This has notably broadened the risk exposure surface, especially for big corporations.

In response to these escalating threats, governments across the EU have had to introduce strict regulations. The aim is to mitigate cyber risks, protect personal data, and ensure business continuity.

In December 2022, the European Parliament adopted 

 to streamline and strengthen digital operational frameworks across EU member states.

Far from being just another regulation, DORA serves as a comprehensive consolidation of all existing standards (EBA, ACPR, NIS2, etc.). It requires financial entities to better manage their outsourcing activities and evaluate the security risks of new IT solutions thoroughly.

Simultaneously, IT teams are confronted with a complex challenge: balancing the security and compliance of the Information System (IS) with the need for autonomy and innovation needs of the Business Units (BUs). The goal is to create a strong and clear IT governance framework that addresses these risks.

DORA is a European regulation adopted on December 14, 2022, set to come into effect on January 17, 2025. It aims to fortify the financial sector's operational resilience against the growing threats of digitalisation and cybercrime. This regulation is binding for all financial institutions within the EU, striving to standardise and consolidate the existing national regulations through a detailed, comprehensive framework on ICT risk management and the security of networks and IS across the EU.

DORA compels European financial entities to adopt proactive measures against challenges brought by digitalisation, automation, SaaS, generative AI, and more. The intention is to transition from an IT risk management approach to a broader strategy focused on digital resilience.

For DORA, “financial entities” are credit institutions, payment and e-money institutions, investment firms, capital management companies, insurance/reinsurance companies, and others. The list of the entities concerned can be found 

To comply with DORA's directives, financial institutions and their third-party partners are required to implement and document a set of measures concerning their Information Systems and the technologies used.

This article focuses on DORA’s Chapter 5: managing ICT third-party risk. 

Identifying and supervising ICT service providers is crucial because they will face more direct oversight by European authorities.

Consequently, financial entities are required to maintain a comprehensive registry of all third-party providers, including those considered non-risky, to readily report them to regulators when needed.

This registry should also be industrialised through sustainable internal processes, including:

This central chapter of risk management related to third-party providers makes it mandatory for financial institutions 

to record, classify, and declare all suppliers

. As third-party services, SaaS providers are specifically targeted and must be monitored and referenced company-wide.

The DORA regulation intensifies the pressure on financial entities; every solution used must be catalogued, understood, and reported. It is crucial to take action now and develop a compliance plan for DORA by 2025. This represents a particularly pressing challenge for financial entities, especially since many lack a complete overview of their IT environments, notably with SaaS applications, a point underscored by the ACPR's focus on "inadequate management of Shadow IT.”

The ACPR Highlights “Persistent Gaps in Shadow IT Management.”

The ACPR's 2022 report on the security management of IS within France's insurance sector observed that insurers' identification of undeclared tools has not improved since the 2019 study.

Hence, insurers must urgently implement measures to align with the DORA regulation’s requirements.

Tackling Shadow IT is no longer an option but a necessity for IT teams, especially financial entities. The IT department must implement a more flexible and agile policy to catalogue all applications used across the organisation.

To stay compliant, it's essential to create and maintain a well-structured, organised, and continuous list of all suppliers. 

Additionally, it is crucial to actively manage the introduction of new tools to prevent the emergence of unauthorised shadow solutions. Consequently, establishing a robust governance framework emerges as a top priority for CIOs. This framework enables business units to continue using their preferred tools while ensuring the security of the Information System (IS) and compliance with the regulations in place.

Navigating DORA Regulations for Financial Entities

Expecting the IT department to oversee every technological initiative and address every business need is impractical and impedes an organisation’s progress. Eradicating Shadow IT is not a viable solution. This is where the distinction between Business-Led IT and Shadow IT becomes apparent.

This article is the last one in the series focused on navigating the SaaS Revolution. It highlights the necessity for large organisations to prioritise SaaS management from 2023 to 2027. To access the full content, click 

Like Shadow IT, Business-led IT is technology, software, or SaaS acquired and used by employees outside the purview of IT or security departments. However, Business-Led IT is known by CIOs and is usually implemented with a clear commitment. It is more of a partnership between the IT department and the business users, developed, supported, and endorsed by the CIO.

The democratisation of IT within a company represents a transformation process that impacts all facets of business and IT operations. It offers significant opportunities for growth and empowerment for both employees and IT teams, subject to effective management and security measures.

IT teams typically establish robust frameworks to address associated risks and exert high-level governance. It also requires redefining the relationships with the different stakeholders in the business and diversifying the IT’s role in managing IT by recognising the realities and benefits of business-led IT projects.

To move to a business and value-led approach to IT, CIOs need to address four problems:

The role of SMPs: between autonomy and risk management

A SaaS Management Platform (SMP) plays a central role in addressing these 4 challenges and helping CIOs shift to a modern approach to managing their SaaS landscape. The SMP acts as a centralised hub with a comprehensive set of functionalities, providing all stakeholders with clear visibility. This facilitates risk management and promotes greater autonomy and collaboration between teams.

The benefits offered by SMPs extend to an enhanced ability to monitor and govern SaaS applications while guiding Business Units. They provide a holistic solution to the proliferation of SaaS applications, enabling organisations to efficiently discover, manage, automate, optimise, govern, protect, and enable them.

Moreover, SMPs can also establish an ‘App Center’ to minimise the use of unauthorised SaaS, while sharing approved applications across all relevant stakeholders. Automation reduces the burden on IT teams while fostering collaboration between teams across various stages of the SaaS lifecycle. Restoring collaboration paves the way for greater innovation and performance.

As the SaaS landscape continues to grow significantly and impact more and more business operations, trying to fight Shadow IT will prove counterproductive.

Instead, CIOs need to provide appropriate advice and support to enable business-led IT. CIOs will increasingly play a leading role in shaping the organisation’s roadmap. To do this, they must act as facilitators and trusted business partners, ensuring that the organisation adapts its operational framework effectively.

This represents a significant opportunity for CIOs to harness value from IT by actively guiding and supporting business units in the process of reducing risk and optimising their digital initiatives.

To accomplish this transformation efficiently, the adoption of SMP will become imperative. It will support CIOs and IT managers in maximising their investments in SaaS, all while ensuring business unit agility, security, and compliance.

Managing the SaaS Revolution: From Shadow IT to Business-Led IT

The introduction of Software-as-a-Service (SaaS) in the late '90s marked the beginning of a paradigm shift. Since then, SaaS applications have proliferated exponentially, and in the process, Shadow IT has thrived unnoticed by IT teams, who often looked the other way. 

This article is the first in a series focused on navigating the SaaS Revolution. It highlights the necessity for large organisations to prioritise SaaS management from 2023 to 2027. To access the full content, click 

The urgent need to act for large organisations

Software-as-a-Service (SaaS) has profoundly changed the IT ecosystem. It is reshaping the way large organisations digitalise, reflecting societal changes driven by the new tech-savvy generations, rapid technological advances and trends towards remote working. 

The adoption of SaaS by employees shows no signs of slowing down. It is ‘inevitable’. 

As of 2023, global SaaS spending is projected to hit $197 billion, an 18% increase from 2022 (

 predicts that companies will quintuple their SaaS apps and increase budgets ninefold in the next decade. 

By 2031, 80% of business apps will be SaaS-based, up from 13% in 2021.

The reason for SaaS's popularity (and the spread of Shadow IT) lies in its decentralised nature. Employees leverage user-friendly and often free applications to address their daily challenges independently. This enables them to do their jobs better, stimulating innovation, productivity, and efficiency. However, they often bypass IT departments when choosing applications. Statistics reveal that by 2027, 75% of employees will acquire, modify, and create technology outside IT’s visibility (

While SaaS growth and IT democratisation hold immense potential, the lack of governance has led to uncontrolled challenges because of Shadow IT. By failing to grasp the extent of their SaaS sprawl promptly, companies lose valuable time in proactively addressing the forthcoming surge in SaaS usage. It has become urgent for organisations to assess the risk associated with their use and implement appropriate security measures. 

IT departments are often only aware of a third of the SaaS applications in use (Gartner Market Guide, 2022), which raises considerable risks and challenges within their organisation. Gartner has revealed that by 2027, those that fail to achieve centralised visibility and manage SaaS life cycles will overspend on SaaS by at least 25% and be 5 times more exposed to cyber risks or data loss.

The risks associated with using SaaS applications can take various forms, such as security concerns, compliance concerns, financial implications, or operational and efficiency challenges.

Shadow IT poses severe security threats as these unapproved applications operate beyond organisational security measures, making them targets for cyberattacks and data breaches. Randori’s State of Attack Surface Management 2022 report reveals that nearly 70% of organisations have been compromised by shadow IT in the past year because of a lack of visibility over their IT assets by the IT department. Additionally, IBM’s 2022 findings show that 45% of companies suffered cloud-based data breaches, costing an average of $4.35 million.

Shadow IT exposes organisations to compliance risks since these applications often evade scrutiny. Regulations like GDPR and industry standards like HIPAA and DORA necessitate meticulous compliance, especially for large enterprises subject to rigorous oversight.

 issued orders for four financial institutions to pay $260 million for the use of non-approved methods of communication (WhatsApp, Signal…) to engage in business-related communications, in violation of firm policy.

Apart from compliance fines and data breach costs, unknown applications can lead to overspending on unused IT resources. According to 

, companies will overspend $750 million on unused IT software features this year alone. This complicates IT budget management, particularly in larger enterprises where 

 of the IT budget goes to unknown applications. The result is an underestimation of the technical budget, which hampers the overall negotiation of enterprise-wide contracts, mainly because of certain abusive conditions imposed by SaaS providers (price increases, unclear renewal conditions, etc.).

Shadow IT can impact the IS and bring unexpected challenges for IT teams due to its total lack of planning and good IT practices. This forces the technical team to provide unanticipated support, including setting up workflow configurations, identifying risks, managing data, and so on. All tasks that could have been avoided with prior consultation. This results in diverting end-users and IT teams from their core tasks and frustration and tensions between teams: BUs blame IT for not providing the necessary tools and visibility, while IT points fingers at the business for failing to adhere to established guidelines and protocols.

IT departments must address those risks and educate BUs more effectively as they operate in an increasingly complex and regulated environment, particularly in the European market, due to stricter regulations.

Trying to fight Shadow IT will prove counterproductive. Instead, CIOs need to provide appropriate advice and support to enable business-led IT. 

Managing the SaaS Revolution & the rise of Shadow IT

Managing the SaaS ecosystem has become a strategic challenge for large organisations, driven by the urgency of digitalisation, the rapid growth of SaaS applications (+18% in 2023), and the increasing autonomy of business departments in their technology choices. These trends create new opportunities and numerous challenges and risks for IT departments.

To effectively handle SaaS applications and address Shadow IT (applications used by employees without the knowledge of the IT teams), enterprises are implementing tools to help secure and govern their IT ecosystem.

To deal with the growing cyber threats, large organisations are increasingly deploying a Cloud Access Security Broker (CASB) to strengthen the security of their Cloud environment. It directs the connectivity of all applications through a proxy server or APIs for extensive control and monitoring of Cloud applications. This tool, acting as a guardrail, is also used by IT teams to detect Shadow IT.

CASBs offer many benefits and give organisations visibility, control, and compliance, strengthening their protection against cyberattacks and data breaches.

Despite their crucial role in identifying Shadow Cloud (unauthorised use of Cloud services), CASBs struggle to accurately detect SaaS applications, given the rapid spread of these solutions. Representing a significant portion of Shadow IT, SaaS apps are a major challenge for IT teams. Overwhelmed by the volume and complexity of all the data collected by CASBs —often polluted with applications used for personal purposes (such as Amazon and Facebook...)—IT staff have difficulties filtering out the noise. Gartner points out the limitations of CASBs for "managing, automating and optimizing SaaS applications".

These limitations are compounded by a fundamental problem: the lack of actionable data. CASBs' analysis capabilities tend to suffer from a deficit of actionable insight. They generally lack personalised dashboards or an in-depth understanding of usage trends, which are crucial for proactively anticipating and dealing with cyber threats.

the effective solution for governing SaaS

CASBs have developed rapidly alongside SaaS management platforms (SMPs). Although the detection of Shadow IT is a common functionality shared by both tools, CASBs and SMPs adopt distinct approaches to discovering and managing Shadow IT. CASBs focus primarily on securing Cloud applications and detecting “Shadow Cloud”. SMPs such as Beamy, on the other hand, prioritise an approach based on the governance of SaaS applications, highlighting a comprehensive understanding and ongoing monitoring of SaaS usage.

They show a distinct observability focus using different input data sources and knowledge bases. CASBs delve into more specific security data like incidents, non-compliance with security policies, and the security of application services.

SMPs concentrate on a more detailed and specific investigation of SaaS applications and uncover “Shadow SaaS". These platforms examine data such as session duration, usage level (low/medium/high), login frequency, the differentiation between professional and personal login, and engagement duration. This emphasis on SaaS apps allows IT teams to better understand the specific uses and needs of business departments. It facilitates closer collaboration between IT teams, end-users, and other SaaS governance stakeholders (security, legal, finance, etc.).

Next-generation SaaS Management platforms, such as Beamy, include a number of essential features for effective management and governance of the SaaS ecosystem.

However, they do not substitute the advanced security capabilities offered by CASBs. Therefore, rather than opting for one over the other, large enterprises would benefit from adopting a combined approach, leveraging the complementarity of these two tools.

Together, the CASB and SMP establish a solid framework for a secure and optimised SaaS landscape within the organisation. The CASB protects and ensures the application of security policies while enabling precise identification of security vulnerabilities. SMPs, on the other hand, focus on monitoring and analysing the use of SaaS applications (session time, connection frequency, usage retention, length of engagement, pro/perso connection). This enables robust governance to be put in place, encouraging greater collaboration with all stakeholders through collaborative and customisable workflows.

SMP vs CASB: complementary duo or redundant tool against shadow IT?

Beamy has been recognised as a representative SMP vendor on the latest Gartner® 

Market Guide for SaaS Management Platforms™️

Hype Cycles™️ for Cloud Computing & I&O Digital Workplace Transformation

This article equips IT leaders of large organisations with invaluable insights from the Gartner® reports to effectively manage and govern the adoption of SaaS applications securely using an SMP (SaaS Management Platform).

As organisations continue to embrace cloud-based approaches, the adoption of SaaS applications continues to surge, leading to both tremendous benefits and challenges. 

SaaS remains the largest cloud market segment, with projected end-user spending totalling $197 billion in 2023. Concurrently, employee experience (DEX) will become the primary focus of digital workplace investments. The monitoring and governance of SaaS applications implemented by employees will become a top priority for IT leaders in the coming years. This is why SMPs are featured at the ‘peak of inflated expectations’ in both 2023 Hype Cycle reports. Consequently, leveraging the centralised management capabilities offered by SMPs becomes a crucial approach for discovering, managing, automating, optimising, governing, and enabling the SaaS applications used by employees.

Why SMP is still at the top of Gartner’s hype? 

3 takeaways from Gartner Market Guide™ & Hype Cycles™

How SMPs can help organisations tackle the underestimated growth of SaaS 

SaaS adoption is growing at an astounding rate, with annual spending increasing by 15-20%. On average, organisations spend approximately $1,040 per employee annually. The decentralised nature of SaaS poses a significant problem: IT departments are often only aware of a third of the SaaS applications used within their organisation. This is because employees do not inform them when an application is being implemented and used. This leads to unmanaged costs, unaddressed security vulnerabilities, unprotected identities and data, and a lack of visibility and service management processes. Managing configuration, cost, and usage for a few to hundred SaaS applications using various sources and tools is “intenable”. By using a SaaS Management Platform (SMP) organisations have a unique and central platform helping detect unknown apps while monitoring and governing SaaS used by employees.

SMPs differ from other tools in that they encompass a comprehensive set of capabilities 

The benefits of SMPs are diverse. They not only provide IT leaders with complete visibility into their SaaS landscape for effective management but also empower business units in their application choices, ultimately maximising ROI by increasing adoption rates and optimizing licensing. Through the introduction of an ‘application store,’ unauthorised SaaS is minimised, allowing approved applications to be shared between employees. Automation reduces the workload on IT teams while enhancing and strengthening collaboration among the teams involved in various stages of the SaaS life cycle.

Some prerequisites for effective SaaS lifecycle management 

A decentralised SaaS portfolio raises challenges for IT governance teams. A SaaS Management Platform offers comprehensive visibility to all stakeholders by maintaining a centralised inventory of applications throughout their lifecycle. Gartner recommends fostering strong collaboration between IT, procurement, finance, security, and business teams to oversee all phases of the SaaS lifecycle and enhance the return on investment from these applications

As a result, governance teams gain the ability to monitor and manage all applications within the organisation. SMP tools facilitate the dissemination of IT guidelines and best practices to business teams, ensuring clarity regarding which SaaS applications are authorised, unauthorised, tolerated or banned. Additionally, other stakeholders, including procurement and legal teams, contribute by providing crucial information (contracts, compliance, etc.) to effectively assist employees in choosing solutions. This approach reduces the risks associated with the uncontrolled implementation of applications by Business Units, avoiding budget overruns, noncompliance risks, and security vulnerabilities to maximise the return on investment.

The rapid growth of SaaS adoption brings the challenge of managing an increasingly complex array of applications. SaaS Management Platforms (SMPs) offer a comprehensive solution, enabling organisations to discover, manage, automate, optimise, govern, protect, and enable SaaS applications efficiently. Given the dynamic nature of the SaaS landscape and its impact on business functions, the adoption of SMPs will become unavoidable, helping organisations make the most of their SaaS investments while ensuring security and compliance

SaaS Management Platform Gartner recommended solution for effectively managing the SaaS ecosystem

Managing the SaaS landscape has become a strategic challenge for large organisations. The rapid growth of SaaS applications, combined with the greater autonomy of Business Units in their choice of technologies, has led to new challenges and risks for the IT department.

However, to manage SaaS applications effectively and address Shadow IT (applications deployed by employees without the knowledge of the IT team), companies must transition from a reactive discovery approach to proactive monitoring of their IT ecosystem.

Static SaaS application discovery audits, whether manual or automated, may initially seem appealing. They list all applications used by employees, providing relatively detailed data. However, in large organisations where the number of applications grows each month, "one-off" detections spread over 3 to 12 months do not adequately support sustainable SaaS management.

Continuous Detection for Proactive SaaS Governance

Implementing continuous detection of SaaS applications and usage is key to achieving proactive and sustainable application management within large organisations. This process goes beyond identifying applications and risks; it encompasses in-depth understanding and strategic decision-making based on continuous analysis. 

The three pillars of this continuous monitoring offer a robust framework for effective management of the SaaS landscape.

Continuous detection of the SaaS portfolio and usage is not just a matter of keeping an up-to-date list of applications. It is instead a strategic approach to anticipate, understand, and respond to the dynamic evolutions of the technological landscape. This proactive approach endorses informed decision-making and smooth collaboration between IT and business departments. It establishes the foundations for robust SaaS governance within the organisation. It optimises investments, fosters digitalisation, and guarantees security and compliance in an ever-evolving SaaS environment.

From Shadow IT Audits to Proactive SaaS Governance

In today's dynamic workplace, understanding and managing the ever-evolving landscape of Software as a Service (SaaS) applications has become a crucial challenge for IT teams and organisations. 

Beamy’s Web Browser Extension (WBE) emerges as a game-changer, reshaping how large companies detect and monitor their SaaS ecosystem.

After years of managing SaaS detection across various sectors within large companies, Beamy has encountered the limitations inherent in traditional methods. These conventional approaches to identifying Shadow IT suffer from shortcomings in accuracy and coverage. These challenges are notably intensified in large organisations due to the substantial number of users, diverse application landscapes, and myriad of user behaviours. 

: Traditionally, Shadow IT detection has relied on tools such as Cloud Access Security Brokers (CASBs) and analysis of navigation / proxy logs. However, these present a myriad of challenges. 

: An alternative method employs Single Sign-On (SSO) to uncover Shadow IT by relying on login data. While SSO is an effective approach for monitoring SaaS usage and managing access to known applications, its effectiveness is hindered by limited coverage. This is particularly prevalent as many SaaS applications do not integrate SSO as part of their basic plans. It leads to significant detection gaps, notably with Shadow IT applications often inappropriately utilised under basic free plans.

Financial data analysis tools provide another way of detecting Shadow IT. While financial data can provide valuable insights regarding costs and which cost centres are liable, it usually lacks information on how these applications are used. Additionally, financial data fails to identify applications purchased outside the usual procurement process, such as direct purchases by employees and free applications in use. 

With the explosion of SaaS adoption, the limitations of existing detection mechanisms have become even more problematic. This underlines the pressing need for innovative solutions capable of accurately and comprehensively detecting and monitoring the ever-expanding SaaS landscape.

Beamy's Web Browser Extension (WBE) disrupts this conventional approach by introducing a revolutionary method to detect and manage SaaS usage. WBE's groundbreaking technology transcends the limitations of traditional tools:

: Operating within the browser environment, WBE's direct navigation data analysis enables accurate SaaS app detection, drastically reducing false positives and the need for extensive manual intervention.

Distinguishing Professional and Personal Usage

: Using login cues, WBE identifies the distinction between personal and professional email domains, ensuring a nuanced understanding and eliminating irrelevant non-work-related applications.

 The WBE's approach doesn't rely solely on SSO logins, ensuring comprehensive coverage across all SaaS apps, regardless of their login capabilities. Unlike tools analysing financial data, the WBE provides a comprehensive view that includes applications purchased outside usual processes or available for free. Identifying these apps, which are often inadequately covered by the legal department, ensures their inclusion within an organisation's contractual framework.

The Beamy WBE offers a range of additional advantages beyond its accurate detection capabilities:

: The WBE ensures data security through local in-browser processing, stringent encryption protocols during data transmission and storage, and a transparent, auditable codebase.

: the WBE minimises data collection, pseudonymizes and aggregates user data, and ensures compliance with EU data privacy regulations.

: Facilitating effortless deployment at scale across diverse IT environments through standard management tools like Mobile Device Management (MDM), Remote Monitoring and Management (RMM), Group Policy Object (GPO), or Google Workspace.

: The WBE serves as the cornerstone of Beamy's SaaS Monitoring offering. Beyond its primary function of detecting SaaS apps and Shadow IT, the WBE provides comprehensive insights on user demographics by department and country, detailed metrics regarding app adoption and engagement. These granular insights empower IT leaders and teams to gain a comprehensive understanding of their SaaS landscape over time.

Beamy’s Web Browser Extension represents a significant leap in SaaS management, offering comprehensive insights, unparalleled security, and effortless deployment. Its transformative capabilities redefine how organisations detect, monitor, and govern their SaaS ecosystem, offering accurate data, comprehensive coverage, and an unprecedented level of understanding.

Redefining Shadow IT Discovery

Given the frenetic growth of New Tech (SaaS, AI, low code…), continuous monitoring of the IT ecosystem is crucial. Yet, keeping track of how many applications are used has become challenging due to market evolution and changing business needs. This concern now spans across various departments (security, purchasing, business, etc.) and has gained significant more and more attention from the Executive Committee.

This is an Executive Summary of the Alliancy's Editorial: '

For years, technology and SaaS were exclusively managed by the IT department, which had a firm grasp on the IT ecosystem composed of dozens of applications. However, in recent times, the number of applications has surged from dozens to hundreds, and this figure continues to grow at a frenetic pace. This challenge is no longer confined to IT; it has become a cross-functional and strategic concern within organisations, involving a wider range of departments (security, purchasing, business, etc.) and drawing greater attention from the Executive Committee.

This shift is primarily due to the rapid evolution of the SaaS market, reinforced by a general move towards the digitalisation of Business Units and organisations. These trends are shaping the future of enterprise IT, especially with the introduction of new technologies like AI and low code. In 2022, Gartner projected that 40% of global IT spending would be absorbed by some form of shadow IT. According to Cisco, the average ratio in the largest companies between the number of applications fully controlled by the IT department and all of them, including shadow IT, was a disturbing “one to fifteen”.

Tackling Shadow IT/AI is no longer optional. It is a necessity! Continuous monitoring of the IT ecosystem has become paramount. However, it is increasingly challenging for IT departments to maintain a comprehensive view of the usage of these applications, thereby mitigating risks and establishing robust governance. Traditional static audit methods have demonstrated their limitations in a constantly changing environment, especially in the face of the ‘SaaS Wall’.

It is essential for CIOs to understand that one-shot audits are not the answer to having a comprehensive view of SaaS applications. The market is evolving constantly, as well as the habits and needs of the Business Units (BUs).

Moreover, one-shot audits have a paralysing effect. The IT department suddenly discovers a ‘Wall of SaaS’ composed of 400 SaaS where it thought it had 40… This, of course, brings tensions onto the IT/BUs relationship, but also, no one knows where to start to take back control and start managing this new ecosystem effectively.

To get around this problem, organisations should take 2 steps:

: continuous and dynamic detection is the key where IT is informed when a new solution is detected, when a SaaS is going from ten users to a hundred or when it leaves a business unit in a particular country to go to other parts of the organisation.

2. Set a dedicated team - a SaaS Community:

 creating a full-time SaaS Manager position will help define and drive forward SaaS Governance programs. The SaaS Manager will be in charge to establish the scope and a team around SaaS Management. 

Want to know more about the SaaS manager role and how to set a SaaS community, click 

CASB & SaaS Management Platforms: complementary roles in SaaS Management

CASB tools and SaaS Management Platforms are frequently compared due to their complementary capabilities. CASB primarily focus on the thorough analysis of data exchange volumes, often coupled with a DLP (Data Loss Prevention) system. This approach allows it to pinpoint high-risk applications and potential data leaks in the cloud, making it particularly valuable for security-sensitive scenarios.

On the other hand, SaaS Management Platforms adopt a different perspective, emphasising governance and collaboration with business users. Their primary objective is to dynamically catalogue all available solutions, gaining an in-depth understanding of their evolution. This empowers IT teams to assess the criticality of their usage and, more importantly, guide business users towards the ‘application blueprint’: applications and their designated uses, all in alignment with the philosophy and goals defined by the company.

In essence, CASB and SaaS Management Platforms play complementary roles in SaaS Management. CASB stands as a crucial guardian of security, meticulously scrutinising data exchanges to safeguard against risks. Meanwhile, SaaS Management Platforms serve more as a vital governance tool to amplify the digital transformation in collaboration with all stakeholders involved (IT to Security, Purchasing, etc), ensuring that the adoption and evolution of SaaS solutions align with the company’s strategic vision and objectives. Together, they form a robust framework for a secure and optimised SaaS landscape within the organisation.

Why the CIO is best placed to lead this technological governance

The Chief Information Officer (CIO) plays a pivotal role in raising awareness among the members of the Executive Committee of the evolution of the IT ecosystem, its uses and the needs of the business users. Simultaneously, she/he has the crucial responsibility of ensuring the resilience and security of Information Systems (IS). In this context, the IT department fulfills its mandate of overseeing and regulating the IT infrastructure while actively responding to the technological aspirations of business users in close partnership with key stakeholders such as the CISO, CTO and CFO.

The CIO emerges as the pivotal architect in orchestrating this decentralisation of technology. He/she champions a sustainable and secure approach, working hand-in-hand with governance stakeholders to steer the organisation towards a future technological landscape. This approach ensures not only the seamless functioning of IT operations but also fosters innovation and responsiveness to the evolving needs of business users.

To achieve this, CIOs can rely on the SaaS Management maturity matrix as a starting point towards the establishment of solid governance and the implementation of a SaaS Center of Excellence. It is a step-by-step approach highlighting the people, processes and tools needed at each stage of the maturity. 

The first step is to set up a continuous management system, which will then enable the successive implementation of a cost and contract knowledge system, followed by multi-party governance of the tools in conjunction with the business lines, to facilitate, for example, the addition of a new tool or the renewal of an application already in place. The most mature companies then aim to set up a form of ‘App Center’, a veritable digital catalogue of tools available to more autonomous business units. You can use our 

 to determine your current level of SaaS management, understand what you need to do to get to the next level, and the typical value and outcomes SaaS Governance will deliver.

It is becoming increasingly important to manage SaaS effectively and tackle Shadow IT risks. Yet these matters are, still, too often underestimated. As companies increasingly pivot towards digitalisation, it has become a critical strategic concern for maintaining competitiveness. This is why SaaS Management should be on the 

’s agenda. Consequently, achieving comprehensive and continuous visibility of the SaaS landscape and effectively managing associated risks has become imperative.

Although, these challenges cross multiple functions and involve various departments within the company, CIOs remain central to driving this digital transformation and overseeing the democratisation of technology. A SaaS Management Platform can play a pivotal role, providing the means to monitor the ecosystem and implement a strong governance framework. Navigating the potential hurdles of SaaS adoption will be a significant undertaking, making the choice of the right SMP, a strategic decision.

Why should New Tech be at the top of the Comex agenda?

This article, inspired by Perrine Huveateau's Medium post, "

Shadow-IT: The monster lurking in your business

", is a stark reminder of the risks associated with Shadow IT.

As CISOs continue to grapple with the enduring risks posed by Shadow IT, the emergence of AI generative technology and new stringent regulations have added urgency to the need for IT departments to prioritise the monitoring and governance of SaaS applications.

Shadow IT is not a recent issue. However, IT departments are generally only aware of 

a third of the SaaS applications in use, as highlighted in the Gartner Market Guide 2022.

 This lack of knowledge poses significant risks and challenges within an organisation. Gartner's projections indicate that those who fail to establish centralised visibility and effectively manage SaaS lifecycles could face at least a 25% overspend on SaaS by 2027, as well as a five-fold increase in exposure to cyber risks and potential data loss.

The risks stemming from using SaaS applications vary from security and compliance concerns to financial implications, as well as operational and efficiency challenges.

Legal Notices