How Cybersecurity Budgets Are Getting Eaten by SaaS Sprawl

Martin Snyder
3 days ago
4 min read

If your security spend keeps growing while risk doesn’t budge, you’re probably financing the wrong thing: SaaS sprawl. There are simply more apps, more tokens, and more shadow tenants than your catalog admits. Waldo Security gives you the truth map first—we discover every SaaS app, tenant, account, and OAuth grant in minutes, flag SSO/MFA bypasses and risky consents, and export audit-ready evidence. Start with Instant SaaS Discovery, then keep monthly proof flowing with the SaaS Compliance Overview.

Executive snapshot (why budgets feel out of control)

Apps exploded. The average company now uses ~101 apps, crossing the triple-digit line for the first time. More apps = more controls, logs, and auditors to satisfy. (Okta)
Incidents still start with credentials. In the 2025 Verizon DBIR, ~88% of Basic Web App attacks involved stolen creds, so any app outside enforced SSO/MFA becomes a budget sink—through prevention, monitoring, and response. (Verizon)
GenAI multiplied identities. The average org uses 9.6 genAI apps—often with personal accounts or browser plug-ins—expanding discovery and compliance workload. (Netskope)
The money math favors speed. IBM pegs the global average breach cost at ~$4.44M; faster identification/containment reduces that number, which requires live SaaS visibility—not spreadsheets. (Baker Donelson)

Where the money actually leaks (5 budget drains)

Duplicate licenses & shadow tenants Pilots become production, but in a second tenant with local passwords. Finance pays twice; security validates twice. (Okta’s 100+ app reality makes this routine.) (Okta)
SIEM ingestion for noise You pay to ingest logs from suites you can see, while the riskiest activity lives in services that never touch your IdP. CISA’s Cloud Security TRA says the order is inventory → least privilege → logging; skipping step one means paying for partial telemetry. (CISA)
End-user OAuth = supportable backdoors One click with offline_access mints refresh tokens that outlive password resets; IR chases ghosts and audits fail evidence tests. Microsoft Entra lets you restrict consent to verified publishers and selected permissions so high-privilege scopes require admin approval. (Microsoft Learn)
Audit scramble costs Point-in-time screenshots consume engineering and GRC hours every quarter. Auditors increasingly expect continuous evidence streams—again, impossible without SaaS-layer discovery and logging (TRA). (CISA)
Breach tail risk When a password-only path or durable token persists, the “savings” from skipping SSO is dwarfed by response + downtime + legal + customer churn. IBM’s cost curve is unforgiving. (Baker Donelson)

A quick calculator (sanity-check your budget)

Unknown services: Count domains with traffic but no IdP sign-ins → estimate duplicate licensing + tool overlap. (Most orgs uncover double-digit domains on day one.)
Identity gaps: # of password logins to SSO-catalog apps × (mean breach likelihood for credential theft) → sets your immediate risk reserve. (DBIR pattern.) (Verizon)
OAuth exposure: # of grants with offline_access + write/tenant-wide scopes × revocation labor + potential data sync scope → sets your IR and compliance contingency. (Microsoft Learn)
Audit time tax: Hours spent assembling screenshots × blended hourly rate → compare to automated, monthly evidence exports (TRA-aligned). (CISA)

Budget-saving plan (30 days, not quarters)

Week 1 — See reality (inventory first) Correlate IdP sign-ins + suite/audit logs + DNS/proxy + expense into one deduped list of apps, tenants, accounts, and OAuth grants. Tag owner, SSO/MFA, admin count, scopes, and data sensitivity. (TRA’s first principle.) (CISA)

Week 2 — Shut the costliest doors

Enforce SSO/MFA on the top-impact apps; alert on password logins to “SSO-only” apps (DBIR’s biggest driver). (Verizon)
Lock consent in Entra: only verified publishers and selected permissions; route write/tenant-wide scopes for admin approval. Revoke idle offline_access grants. (Microsoft Learn)
Fence Google third-party access with App access control at the scope level. (Google Help)

Week 3 — Reclaim and rationalize Merge duplicate tenants; move shadow apps under enterprise SSO or deprecate them; reduce admin sprawl and world-readable links; bind genAI usage to enterprise identities (Netskope trend). (Netskope)

Week 4 — Automate the receipts Stream SaaS logs to SIEM; schedule a monthly evidence pack: SSO/MFA coverage, admin changes, OAuth diffs, offboarding timestamps, public-link exceptions. This is how you cut IR time and audit labor while improving outcomes (IBM). (Baker Donelson)

KPIs that translate to dollars

Unknown → Known: % of traffic/spend tied to inventoried apps (target +10 points this quarter).
SSO reality: Password logins to SSO-catalog apps (trend ↓); % of high-risk apps enforcing SSO/MFA. (Verizon)
OAuth health: Count of grants with offline_access + write/tenant-wide scopes (trend ↓). (Microsoft Learn)
Audit hours saved: Time from “evidence requested” to packet delivered (monthly export vs. screenshot marathons).
Containment speed: Median hours from detection → revocation/enforcement (a breach-cost driver per IBM). (Baker Donelson)

The punchline

Security teams aren’t overspending—they’re misdirecting spend toward a partial map. SaaS sprawl quietly taxes your SIEM, your IR team, and your audits. The budget win is a sequence, not a purchase: see everything, enforce least privilege (at the SaaS layer), and keep live evidence.

If you want the fast, no-glue path: get your real estate in minutes with Instant SaaS Discovery, then ship proof and shave audit hours with SaaS Compliance Overview.