What a SaaS management platform has to do in 2026, how the market divides, and the six criteria to score your shortlist against — including where Shadow AI detection now sits as a first-class requirement rather than a tag.
SaaS sprawl is a permanent operational condition, not a phase. The average enterprise portfolio now runs 305 SaaS applications, a growing share of them procured outside formal IT. An increasing number now ship embedded AI features. The result is a visibility gap that costs money and an unmeasured compliance risk.
The software category that promised to solve this in 2020 has moved on. The standard for what a SaaS management platform must deliver in 2026 is meaningfully higher.
If you own SaaS spend or IT operations, you need a defined standard to evaluate the market against. This guide sets out what a modern platform has to do, how the market divides, and a concrete checklist for your shortlist.
Key takeaways
A SaaS management platform discovers, monitors, optimises and governs the SaaS applications used across an organisation.
It does four jobs:
The job has changed. The same platform now has to identify AI-enabled applications, surface unsanctioned AI use, and produce the audit data that broader AI governance programmes depend on.
A tool that solves one or two of these is a point tool, not a platform.
Identify applications employees use that IT did not procure. Single-source discovery leaves dangerous gaps: browser-only misses SSO-integrated applications, identity-only misses everything outside the SSO perimeter. Effective discovery combines browser activity, identity provider logs and vendor APIs.
AI tools and AI-enabled SaaS carry distinct data and compliance risks, and they are the fastest-growing source of shadow SaaS. Across enterprise portfolios, use of applications in the AI category grew 181% year on year, and AI-native application spend at large enterprises grew 393%. Your platform needs to treat generative AI as its own category, not as a tag somebody remembered to apply.
Identify dormant users, duplicate applications and tier downgrade opportunities. This is where the financial case lives: 46% of SaaS licences go unused, meaning the average organisation uses just 54% of what it pays for.
Track application ownership, automate joiner-mover-leaver workflows, and run access reviews. As SaaS becomes the dominant application surface, the platform becomes part of your security and compliance stack rather than a finance tool.
These four map to a simple operational sequence: visibility, then optimisation, then management, then governance. A platform strong on discovery but weak on governance hands you data you cannot act on.
Vendors such as Zylo, Productiv, Torii and BetterCloud focus strictly on SaaS. Their strengths vary across discovery and operations, but their scope stops at SaaS rather than covering the wider set of IT assets.
Platforms such as CerteroX, Flexera One and ServiceNow include SaaS management alongside ITAM, SAM and cloud cost. The advantage is unified data across several domains, which removes the reconciliation tax between them. You still have to validate the depth of the SaaS-specific feature set rather than assume it.
Identity providers, expense management tools and SSO-centric discovery products surface part of the picture. They work well as inputs into a SaaS management programme. They fail as replacements for one.
Six criteria. Score every vendor against all of them.
You need three discovery layers: an endpoint or browser signal for direct application use, identity connectors (Entra ID, Okta) for SSO-integrated applications, and vendor APIs for the major platforms. A browser-only tool misses SSO applications. An identity-only tool misses everything outside the SSO perimeter. Ask which of the three a vendor actually operates, and how the signals are reconciled when they disagree.
Discovery without recognition yields a meaningless list of URLs. You need a maintained catalogue. Ask how many applications are in it, how often it updates, and specifically how generative AI is classified — a hardcoded list of AI vendors goes stale within a quarter.
Look for a dedicated view, not a filter. You want AI tool discovery with user attribution, a way to rank exposure by how much of the organisation is using each tool, and an audit trail you can hand to a governance programme working to the EU AI Act or ISO/IEC 42001. Ask the vendor exactly which of that they produce, and which is a report you would have to build.
The optimisation story has to be quantified. You need utilisation reporting, inactive user identification, automated reclamation, and overlap detection between applications that do the same job. Ask what happens after the report: does the platform act, or does it hand you a list?
A platform islanded from the rest of your stack cannot deliver lifecycle governance. It must connect to ITSM, identity (Entra ID, Okta), HR for joiner-mover-leaver workflows, and finance for the renewal calendar.
Ask vendors to define concrete milestones. When will you see the first usable inventory? The first reclamation report? Time-bound milestones written into the plan are the only reliable measure.
CerteroX SaaS Management runs the four pillars: visibility through multi-source discovery, optimisation through usage analytics and reclamation, management through workflow and ownership, and governance through access and AI policy.
Discovery runs on three converging signals — a browser extension detecting SaaS domains, time-on-app and per-user attribution; identity provider sync from Entra ID and Okta including MFA enrolment; and connector sync pulling authoritative user and licence lists directly from the vendor. There are 47 connectors shipping today. Recognition runs against a catalogue of more than 35,000 applications.
Shadow AI is built in, and it is not a static list. AI tools are classified from application feature tags in the catalogue, so the detection set grows on its own as the catalogue does. The Shadow AI Dashboard ranks adoption risk across three tiers by the share of your organisation using each tool, because ten people on a public model is a different problem from a thousand. Each tool carries a status — managed, blocked or ignored.
Optimisation covers unused licence detection at 30 or more days of zero usage, App Rationalization that detects overlapping applications and ranks them by recoverable saving, upcoming renewals with days-to-renewal alongside utilisation rate, and cost per licensed user set against cost per active user. Actions are first-class: reclaim, reassign, downgrade tier, archive, remind or dismiss. An Optimization Score from 0 to 100 tracks utilisation, response and adherence over time, and realised savings are reported by fiscal quarter rather than asserted once.
Governance is where most platforms thin out. Here it covers an offboarding checklist per user showing every licence they hold and whether revocation is pending, in progress or complete — with the monthly cost of whatever is still open. OAuth grants to consented third-party applications are discovered and scored 0 to 100 on data sensitivity, scope, consent and dormancy, and can be revoked in one click or automatically as a workflow action. Risk assessment covers data sensitivity, compliance and business criticality. There is a six-tier role model including a dedicated Auditor role, per-application budgets with warning and critical thresholds, and an audit log covering every provisioning and deprovisioning step.
Automation runs on a workflow engine with eight triggers, eleven conditions and thirteen actions on one canvas, including provisioning and deprovisioning across Entra, Okta, Google and Microsoft 365. Deprovisioning respects what each vendor actually supports rather than pretending they are interchangeable: HubSpot has no suspend API, so there is a soft mode that strips roles and a hard mode that deletes; Box transfers file ownership before deactivating; ServiceNow locks the account and strips every role and group membership.
Because it is part of CerteroX, it shares one data model with your ITAM, SAM and cloud cost data. The ownership model — application, business, technical and data owner — is built in rather than maintained in a spreadsheet alongside.
ITAM manages hardware and licensed software, typically focused on the data centre and the endpoint. SaaS management handles cloud-delivered applications, subscriptions and access. They overlap on identity and licensing. Effective programmes run them together, on shared data.
Yes. Identity providers only surface SSO-integrated SaaS. They miss applications used outside SSO and those signed up for on personal accounts. A real platform combines identity, browser and vendor API signals into one picture.
Shadow AI is a subset of shadow SaaS with a different risk profile — data exposure through prompts, and obligations under emerging AI regulation. That is why a discrete AI category, rather than a tag, is a requirement rather than a nice-to-have.
That depends on the number of applications, the identity sources in play and how much of the environment is outside SSO. Browser and identity connector deployment produces a baseline inventory quickly; catalogue enrichment, reclamation workflows and ITSM or HR integration follow. Ask for a timeline scoped against your application count and identity sources rather than a generic figure.
Scope your problem. Score vendors against the six criteria, and make each of them answer for it live. Talk to us or book a demo.
Other posts covering the same ground.
Most AI spend is not arriving as new invoices. It is arriving inside software you already own, priced per token, owned by nobody. Six commercialisation patterns, why per-seat governance cannot see them, and what to do instead.
Shadow AI moves faster than Shadow IT and carries a wider blast radius. What it is, why the old playbooks do not cover it, and the discovery standard you need before any policy can hold.
Most AI use inside large organisations never reaches IT. Here is why it happens, what it actually risks, and how to get control of it without banning the tools your teams have already found useful.
Everything argued above is checkable. Name the publisher, the billing account or the platform you would argue with, and the session is built around it — the reasoning attached, not a summary slide.
No gated download at the end of it.