Why SaaS Is Not the End of SAM

In recent years Software Asset Management (SAM) has undoubtedly proven its worth within the IT sector. Organizations who have invested in such solutions have been able to actively, and effectively, manage their entire software landscape – and yet, the rise of SaaS has altered the environment entirely.

Gartner analysts predict that the total SaaS market will grow from $205 billion in 2023 to $243 billion by 2024, with more and more businesses transitioning to SaaS applications every day. And, of course, this isn’t surprising, with an estimated 11,000 SaaS companies operating worldwide!

So, with this general shift in focus, it’s natural that many will question the importance of SAM as we move forward. At Certero, we understand that this evolution will not mark the end of SAM or lessen its overall importance within the tech industry. Rather, businesses will need to reconsider what they know about SAM as well as SaaS applications and identify how the two will support one another in our ever-advancing environment. Luckily, we’re on hand to help them do just that.

First things first, we must understand how SAM works differently on-premises and in the Cloud as the two are not interchangeable.

 SaaS applications can be purchased in a couple of clicks and don’t require IT to set up infrastructure. As a result of this, they can often be set up and purchased without IT’s knowledge and may even be simply expensed on credit cards. This creates a new challenge for IT in that they will have poorer visibility of their IT applications. To combat this, IT teams will need strong policies and governance to ensure that all SaaS application procurement goes through the same stringent procurement processes that take place when traditional technical and security measures are considered. The first challenge is therefore visibility; how do I ensure that I have a full view of all the SaaS applications in my IT estate? Because if you don’t have this information, your business could face significant security and cost risks.

In the SaaS realm, SAM is less concerned about preparing for compliance audits – as can often be the case in the on-premises scenario – and instead focuses on utilization. The question is; am I utilizing my licenses?

This isn’t too difficult to wrap our heads around as with SaaS applications, your organization will not purchase ownership of any software. Instead, you’ll be paying for user licenses of the product in the Cloud; so compliance needn’t be a primary concern for SAM managers as the risk of being found under-licensed is eliminated by default.

 However, this does not mean that a business’ concern about cost and risk goes away; in fact, far from it. The reality with SaaS is that the ease with which licenses can be consumed means that SaaS platforms are prone to routine over-licensing and over-spending on licenses that are not fully utilized. Furthermore, the ongoing challenge of managing a typical volume license agreement covering thousands of users or devices would now need to be actively managed – down to each individual user, by name.

Whilst traditional, on-premises software would likely require routine maintenance this is not the case for SaaS applications as the burden of maintenance is placed on the SaaS provider. But this doesn’t mean that security can simply be forgotten about. Due diligence should be taken when procuring SaaS applications and integrating them with any other systems. If your business data is being shared between these systems then you should ensure that it is protected and ask the right questions, such as; where is my data stored? How does the data flow? Is the data encrypted?

If these questions aren’t addressed and IT departments will procure these solutions without following policy, your organization could be setting themselves up for a potential data breach. Additionally, you should keep a centralized log of all of your SaaS applications. This way, should an application be compromised, you can immediately check your records and see whether it is used within your organization. If it is, you can swiftly begin remediation.

Of course, knowing who has access to your organization’s SaaS applications is also of paramount importance. Within the on-premises world, software will have been installed on the user’s corporate laptop or device. So, when they leave the business they will lose access to these applications.

In the SaaS world, access is granted through each of the SaaS portals. So, without proper management, any individual can log in and access the application if their license has not been manually removed. Therefore, having visibility over your SaaS applications and accurate information on its users is vital. For instance, if a member of your marketing team leaves, would your business be equipped to identify every SaaS application they have access to? And, would you be able to remove their access before any company data is compromised?

By opting for a SAM solution that provides this visibility in a centralized data source, your organization will be able to view SaaS applications that are in use across the organization – regardless of which department purchased the subscription and who they are assigned to. As such, you’ll be able to identify application access information as individuals leave the business and protect your corporate data.