7 min read<\/p>\n
On average, a mid-sized company uses 275 SaaS applications. Large enterprises deploy over 2,000. The problem? One-third of those apps are unknown to the IT department – and 70 percent of software spending is now controlled by business units. SaaS sprawl isn\u2019t an IT hygiene issue – it\u2019s a governance failure that belongs squarely on the strategic agenda.<\/strong><\/p>\n The Zylo SaaS Management Index 2025<\/a> paints a sobering picture: The average enterprise runs 275 SaaS applications. According to the Torii SaaS Benchmark Report 2026<\/a>, large enterprises average 2,191. And every month, an average of eight new apps join the stack – often without IT\u2019s knowledge or approval.<\/p>\n What is SaaS sprawl?<\/strong> SaaS sprawl describes the uncontrolled proliferation of cloud-based software across an organization. Business units procure tools independently – without central tracking, security vetting, compliance review, or redundancy analysis. The result: overlapping functionality, dormant licenses, and critical blind spots in IT governance.<\/p>\n Per Zylo, more than one-third of all corporate applications constitute shadow IT. Sixty-seven percent of IT leaders cite uncontrolled procurement by business units as their top SaaS challenge. This isn\u2019t a matter of IT discipline – it\u2019s a structural governance deficit rooted at the C-suite.<\/p>\n The pattern repeats itself: A business unit needs a new tool. Formal procurement takes weeks; a corporate credit card works instantly. Within a quarter, 30 employees use the app, upload customer data, and integrate it into core workflows. IT learns about it – if at all – during the next budget audit.<\/p>\n The power shift in software procurement is complete. Business units now own 70 percent of SaaS spending. IT controls only 26 percent. The remainder falls under Shared Services and Procurement. That shift isn\u2019t inherently problematic – business units understand their needs best. It becomes<\/em> problematic without centralized visibility.<\/p>\n Sources: Zylo SaaS Management Index 2025, Flexera State of the Cloud 2025<\/p>\n The consequence? Between 51 and 53 percent of all SaaS licenses go unused within 30 days of purchase (Zylo, 2025). Meanwhile, spending on AI-native SaaS applications has surged 108 percent year-on-year. Companies are spending more on software they can\u2019t see, don\u2019t fully use, and can\u2019t centrally manage.<\/p>\n For the CFO, that means one-quarter of cloud spend delivers no measurable return. For the CIO, it means the attack surface expands with every unauthorized app. For the executive leadership team, it means both issues fall squarely under their<\/em> accountability.<\/p>\n The rise of generative AI tools has pushed the shadow-IT problem into a new dimension. A Bitkom study from October 2025<\/a> (n = 604 companies with \u226520 employees) reveals: In 8 percent of companies, private AI tools are widely used at work – double the share from 2024. Another 17 percent report isolated cases. And 17 percent simply don\u2019t know – but suspect it\u2019s happening.<\/p>\n Meanwhile, only 26 percent of companies officially provide access to generative AI tools. The gap between demand and official supply is filled by shadow IT. ChatGPT, Google Gemini, Claude – the tools are one browser tab away. Employees upload customer data, draft contracts, and internal strategy documents into external AI services – without IT\u2019s awareness. Each action represents a potential data leak.<\/p>\n Uri Haramati, co-founder of SaaS management provider Torii, sums up the dynamic: \u201cAI didn\u2019t invent shadow IT – but it massively accelerated its speed and scale\u201d (CIO Dive, March 2026). What once involved isolated marketing or project management tools now involves AI assistants processing corporate data – without IT knowing which data flows where.<\/p>\n The regulatory landscape shifted fundamentally in 2025 and 2026. With the implementation of the EU AI Act<\/a> and the enforcement of DORA and NIS2<\/a>, executive leadership bears personal liability for their organization\u2019s cybersecurity governance – including explicitly the software supply chain.<\/p>\n Specifically: NIS2 obliges governing bodies to approve and oversee cybersecurity risk management measures. Gross negligence triggers personal fines and even temporary professional bans. A board member who doesn\u2019t know which 275 SaaS applications run in their company – and which have access to sensitive data – has a problem no CIO can solve for them.<\/p>\n DORA further tightens requirements for financial institutions: Every ICT third-party provider must be registered, assessed, and continuously monitored. A SaaS tool used by the compliance department for contract management falls under this mandate just as much as the core ERP platform. Without a complete SaaS inventory, DORA compliance is impossible.<\/p>\n \n“Companies should avoid AI wild growth and proactively prevent shadow AI. To do so, they must establish clear rules for AI usage and provide employees with approved AI technologies.” What Wintergerst demands for AI applies equally to SaaS overall: If you don\u2019t equip your employees with approved, secure tools, don\u2019t be surprised when they build their own. Responsibility lies not with the IT department – it rests with the C-suite, which owns the governance architecture.<\/p>\n SaaS governance is not an IT initiative the CIO can execute alone. It requires decisions at the board level:<\/p>\n 1. Establish transparency:<\/strong> Without full visibility, there is no governance. The board must commission a comprehensive SaaS inventory – one that captures all<\/em> applications, including those no one ordered. Tools like Zylo, Torii, or Productiv automate discovery. The \u201cCapacity Tax\u201d – the share of IT capacity consumed by administration rather than innovation – typically sits between 25 and 40 percent. That metric persuades the CFO.<\/p>\n 2. Define procurement rules:<\/strong> The board must decide who may buy software – and under what conditions. This doesn\u2019t mean centralizing every approval. It means setting clear thresholds: At what spend level does central review kick in? Which data categories require mandatory security assessment? Which compliance standards are non-negotiable?<\/p>\n 3. Provide official AI access:<\/strong> That 26-percent gap in official AI provisioning is an open invitation to shadow IT. Offering employees pre-vetted, privacy-compliant AI tools reduces the incentive to seek alternatives. This isn\u2019t a technology decision – it\u2019s a risk management decision.<\/p>\n 4. Clarify accountability:<\/strong> Who at the C-level holds ultimate responsibility for SaaS governance? Experience shows: Without a clearly designated owner, every initiative stalls. A cross-functional SaaS Board – with representatives from IT, Finance, and major business units – creates the necessary accountability.<\/p>\n A counterargument is valid: Overly rigid governance stifles innovation. Business units that wait months for IT approvals will<\/em> find workarounds. The solution isn\u2019t control – it\u2019s steering<\/em>: a governance framework that enables rapid procurement while guaranteeing visibility and compliance.<\/p>\n SaaS sprawl is the silent erosion of IT governance. 275 apps. 70 percent business spend. 27 percent waste. And a board held personally liable for everything it doesn\u2019t know. NIS2 changed the rules: Ignorance is no longer a shield against liability. The first step isn\u2019t a technology project – it\u2019s a board resolution: Which software runs in this company? Who ordered it? And who owns it?<\/em> Anyone unable to answer that question faces a strategic problem.<\/p>\n According to Flexera State of the Cloud 2025, companies waste an average of 27 percent of their cloud spend. On a \u20ac5 million SaaS budget, that\u2019s \u20ac1.35 million annually lost to unused licenses, redundant tools, and unmanaged subscriptions. Indirect costs – including security incidents and compliance violations – add significantly to that figure.<\/p>\n<\/details>\n Traditional shadow IT mainly involved local software installations and private hardware. SaaS sprawl is harder to detect because cloud applications require no local installation. A marketing team can book a project management tool via corporate credit card – without IT ever learning about it. Scaling is instantaneous, costs grow automatically, and data resides in a cloud infrastructure no one has audited.<\/p>\n<\/details>\n NIS2 obliges governing bodies to approve and oversee cybersecurity risk management – including the software supply chain. Uncontrolled SaaS applications with access to corporate data represent a compliance risk. In cases of gross negligence, executives face personal liability, fines of up to \u20ac10 million or 2 percent of global annual turnover, and temporary professional bans.<\/p>\n<\/details>\n SaaS management platforms like Zylo, Torii, or Productiv can generate an initial inventory within two to four weeks. They analyze Single Sign-On logs, financial transactions, and network traffic to automatically identify active applications. Building a full SaaS governance framework typically takes three to six months.<\/p>\n<\/details>\n Both. The CIO owns technical governance: security assessments, data protection compliance, and system integration. The CFO owns financial governance: spend transparency, license optimization, and budget control. In practice, a joint SaaS Board – comprising IT, Finance, and key business unit representatives – works best. But the strategic decision on the governance framework itself belongs on the executive agenda.<\/p>\n<\/details>\n Header Image Source: Pexels \/ Kampus Production (px:8171188)<\/p>\n Image source: AI-generated (November 2026)<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" 7 min read On average, a mid-sized company uses 275 SaaS applications. Large enterprises deploy over 2,000. The problem? One-third of those apps are unknown to the IT department – and 70 percent of software spending is now controlled by business units. SaaS sprawl isn\u2019t an IT hygiene issue – it\u2019s a governance failure that […]<\/p>\n","protected":false},"author":114,"featured_media":36326,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"saas sprawl","_yoast_wpseo_title":"SaaS Sprawl: Control costs and simplify your IT stack","_yoast_wpseo_metadesc":"SaaS sprawl: Discover how invisible apps drain 30% of IT budgets\u2014learn to reclaim control and cut costs today.","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"featured_post_sortierung":0,"featured_post":0,"pre_headline":"","bildquelle":"","teasertext":"","language":"de","_evm_slot_owner":"","_evm_translation_lang":"","_wp_old_slug":[],"footnotes":""},"categories":[694,673],"tags":[],"class_list":["post-14988","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-new-work-leadership","category-reboot-germany","entry"],"wpml_language":"en","wpml_translation_of":14673,"yoast_head":"\nTL;DR<\/h2>\n
\n
The Invisible Explosion: 275 Apps – and IT Doesn\u2019t Know One-Third of Them<\/h2>\n
70 Percent of Spending Bypasses IT Entirely<\/h2>\n
AI Accelerates the Wild Growth<\/h2>\n
NIS2 and DORA Make SaaS Governance Mandatory<\/h2>\n
\nDr. Ralf Wintergerst, President of Bitkom (Bitkom Press Release, October 2025)<\/cite>\n<\/p><\/blockquote>\nWhat the Board Must Decide – Now<\/h2>\n
Conclusion<\/h2>\n
Frequently Asked Questions<\/h2>\n
What does SaaS sprawl cost an average company?<\/strong><\/summary>\n
How does SaaS sprawl differ from traditional shadow IT?<\/strong><\/summary>\n
What role does NIS2 play in SaaS governance?<\/strong><\/summary>\n
How quickly can a SaaS inventory be built?<\/strong><\/summary>\n
Should the CIO or the CFO own SaaS governance?<\/strong><\/summary>\n
Editor\u2019s Reading Recommendations<\/h2>\n
\n
More from the MBF Media Network<\/h2>\n
\n