topicsthe apps3 numbers3 guides

SaaS spend waste

Unused licenses are unwatched accounts with a price tag. How waste and risk share a root cause, and how one inventory fixes both.

in one lineSaaS spend waste is recurring cost with no return: unused licenses, abandoned subscriptions, and overlapping tools nobody tracks.

the numbers

all the numbers →

1what it is

SaaS spend waste refers to recurring costs in an organization's SaaS environment that are not delivering value: licenses that are not being used, subscriptions for tools that have been replaced or abandoned, and overlapping tools that serve the same function across different teams.

It is a byproduct of SaaS sprawl. When application adoption is distributed and not tracked centrally, spend accumulates in the same way access does: additions are easy, removals require effort that nobody prioritizes, and the full picture is never visible in one place.

The financial dimension and the security dimension of this problem are inseparable. An unused license is also an account that may still be active, with credentials that belong to someone, connected to data the organization cares about. Tracking spend leads to finding access gaps, and vice versa.

2why it accumulates

SaaS costs accumulate in specific patterns.

Subscriptions are renewed by default. Most SaaS tools renew automatically unless someone actively cancels them. If the person who originally purchased the tool has left, changed roles, or simply stopped paying attention to the renewal, the subscription continues. The cost appears on a department card or in an expense report, where it may go unreviewed.

License counts outpace usage. Organizations often purchase license blocks based on projected headcount or anticipated adoption. If adoption is lower than projected, or if turnover reduces actual users, the purchased license count stays above the active user count. The difference is paid for and not used.

Duplicate tools grow from independent buying. Marketing, sales, HR, and operations each have their own tool preferences and their own budgets. It is common for two teams to independently adopt tools that perform the same function, because neither was aware of what the other had. Both subscriptions run in parallel.

Freemium tools convert without review. Tools adopted on free plans sometimes convert to paid plans automatically at a threshold (storage, users, feature access). The conversion may not be noticed until it appears on a reconciliation review.

3what it costs you

Direct financial waste. The cost of licenses that are paid for but not used. In environments where SaaS spend is not tracked centrally, the cumulative amount can be significant. The exact proportion varies by organization and how actively procurement has been managed, but in any environment where buying has been distributed across teams, the gap between purchased and used licenses is typically present.

Security posture cost. Unused licenses typically correspond to accounts that are provisioned but not actively used. These accounts may still have valid credentials. They are rarely reviewed. They represent access that was never needed or that has been abandoned rather than properly offboarded. Accounts that nobody uses are accounts that nobody is watching.

Vendor relationship complexity. Multiple vendors providing similar or overlapping functions means multiple contracts, multiple DPAs, multiple renewal cycles to track, and multiple vendor security assessments to maintain. The administrative overhead grows with each redundant tool.

Data dispersion. The same category of data, customer records, employee information, internal documents, stored across tools from different vendors, with different security standards and different data residency terms. Consolidation reduces this surface area.

what it looks like when it goes wrong

Three ways this tends to go, each one taken from a real case.

your company
the gap nobody seesUnused licences cost money and keep access open.a connected app with standing access
  1. howA chat tool's key into your CRM is stolen from the vendor.
    what leavessupport tickets, including passwords pasted into themwho ends up with itan extortion group working through hundreds of companies
    it happenedSalesloft / Drift, 2025
  2. howIntegration keys to your code host are stolen from the integration vendor.
    what leavesyour private code and the secrets inside itwho ends up with itattackers looking for the next door
    it happenedGitHub OAuth tokens, 2022
  3. howAn analytics vendor is breached and the keys it holds to your systems are copied.
    what leavesconnections straight into your datawho ends up with itwhoever holds the vendor's keys
    it happenedSisense, 2024

4what works

The picture assembles from the money side first: SaaS charges pulled from department cards, central procurement systems, and expense reports into one list with vendor, cost, renewal date, and the owning person or team. Spend records catch tools that no directory ever sees, which is what makes finance data the natural starting inventory even for a security-motivated review.

The waste shows up in the gap between purchased and used. Each application's admin console shows actual active users and, where the platform provides it, usage data; comparing license counts against logins within the past 30 to 90 days puts a number on the difference. The same comparison serves the security review without extra work, since a paid license with no recent login is simultaneously a reclamation candidate and an account nobody is watching.

Functional mapping surfaces the second waste category. Where two tools serve the same primary function for different teams, the question worth settling is whether anyone chose that overlap deliberately. The renewal calendar then does the heavy lifting: right-sizing conversations land at renewal, when the vendor expects negotiation and no migration is forced, and subscriptions with no active usage in the past quarter move to cancellation.

The structural fix is a named owner per subscription, responsible at each renewal for confirming the tool is still needed and the license count still fits. Auto-renewal is the default that creates the waste, and a named owner at the renewal moment is the smallest process change that reverses it. Everything else in a spend review is cleanup; the ownership rule is what prevents the next one.

on the record

← all topics

your turn

what you can do about it

  1. this week

    Pull the licence report of your largest SaaS tool and find accounts with no recent login.

    Remove them: it saves money and closes access.

  2. go deeper

  3. if you're not sure where to start

    Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.

    open the checklist →

the letter · every two weeks

one access gap in your inbox, with the fix.

Every issue takes one way access creeps in, shows a real incident where it went wrong, and ends with one thing to check that week. Written for the people who run the tools, without a security team behind them.

  • 1one mechanism, explained plainly
  • 2one real incident, taken apart
  • 3one step you can take on Monday

get the next issue

One email every two weeks. Your address stays here and is never passed to vendors. One click to unsubscribe. Privacy.