SaaS sprawl: the five-step audit method

The thesis of this article fits in one sentence: you cannot rationalize what you cannot see, so the inventory comes before any decision to cut — and five steps are enough to build it. If your portfolio is already mapped, measured and assigned owners, this article will teach you nothing.

The average organization in Zylo's sample uses 305 applications, with $55.7M in annual spend (2026 index, commissioned by Zylo). In the mid-market, the average portfolio grew from 116 to 164 applications in one year, +41% (2026 State of SaaS, commissioned by BetterCloud). In November 2024, Gartner forecast $299.1B in worldwide SaaS end-user spending for 2025 (+19.2%).

The trajectory matters more than the level: between 2021 and 2023, the average portfolio measured by Zylo had shrunk from 323 to 269 applications. Then AI restarted the inflation: 11% growth in one year, 27 "AI" applications per organization (BetterCloud, 2026), and 78% of IT leaders hit by unexpected charges tied to AI or consumption-based pricing (Zylo, 2026). An audit is not a one-off spring cleaning: it is a cycle.

A matter of hygiene: almost every SaaS sprawl statistic comes from vendors selling the solution to the problem they measure. Zylo and BetterCloud sell SaaS management platforms; Okta sells an identity platform. Their data remains the broadest available (40 million licenses on Zylo's side) but skews toward large enterprises. A 50-person company does not run 305 applications; the mechanism, though, is identical: decentralized purchasing, dormant licenses, functional duplicates. And shadow IT is not a moral failing.

"Shadow IT is rarely the result of malicious intent." — UK NCSC, "Shadow IT" guidance, July 2023.

The real causes, per the NCSC: request processes that are too slow, approved tools that fall short. An honest inventory therefore reveals as many underserved needs as subscriptions to cancel: reallocate before removing.

Each family has a measurable blind spot — the argument for combining them rather than picking one.

Okta counts 101 applications per customer — only those integrated with its SSO — while Zylo, starting from spend, counts 305. The difference is not a measurement error: it is the size of a single method's blind spot.

Order matters: finance first, technology second, decisions last. Start by extracting twelve months of invoices, card statements and expense reports — the one source every leadership team already has. Then cross-check against the consoles already in place: SSO, OAuth grants, gateway logs. Every gap between the two lists is a discovery.

Then comes usage measurement — that is where the money sleeps: 54% of licenses actually used on average (Zylo, 2026), and every point below 100% is leverage at the next renewal. Next, qualify each application — named business owner, data processed, redundancies — then decide: reallocate, renegotiate, terminate. Finally, install a quarterly review, because the portfolio grows back. This discipline of inventory before decision sits at the heart of how we build; the same reflex structures our audit services.

What doing nothing costs — The average organization in Zylo's sample (skewed toward large enterprises) leaves $19.8M in unused licenses per year; $3.8M for organizations with 1 to 500 employees. Keep the ratio: 54% utilization means nearly one subscription dollar in two dormant. Add the risk: 18% of organizations experienced an incident tied to a former employee who kept access; only 25% automate offboarding (BetterCloud, 2026).

Article 12 of the FADP requires a record of processing activities: purposes, categories of data and recipients, security measures, destination countries where applicable. Every SaaS application that touches personal data belongs in it.

Paragraph 5 exempts companies with fewer than 250 employees, on condition of a limited risk to the data subjects' personality rights (Article 24 of the Data Protection Ordinance). Yet demonstrating limited risk requires knowing which applications process which data: the exemption rests on the inventory. A well-run audit therefore feeds that record directly: two obligations, one project, in the spirit of our method.

The figures cited come from samples skewed toward large enterprises: your amounts will be smaller, though not necessarily your ratios. The method assumes some technical centralization; without SSO or an administered collaboration suite, steps 2 and 3 shrink to billing and interviews — less precise, but enough for a first pass. Network traffic raises a genuine question of proportionality of monitoring, to be addressed before deployment. Finally, below roughly twenty applications, a spreadsheet and one meeting will do.