Which apps are underused?
Which contracts are coming up for renewal?
Who owns this app?
Did this offboarding workflow finish?
What changed in our SaaS stack last week?

That work takes time because the context lives in different places.

Torii’s hosted Model Context Protocol (MCP) server gives AI assistants a secure way to access your Torii data directly. Connect tools like Claude, ChatGPT, Cursor, and other MCP-compatible clients to Torii, and your assistant can query apps, users, contracts, workflows, audit logs, transactions, and more.

The best part: Torii MCP uses your existing Torii account permissions. Your assistant can only access the data and actions available to you.

How it Works

MCP is an open standard that lets AI tools connect to external [systems](/blog/hierarchical-way-to-connect-core-systems-and-saas-tools) through a shared interface. Instead of building one-off integrations for every AI tool, MCP gives compatible assistants a common way to talk to systems like Torii.

For Torii users, that means SaaS insights that once required the UI, manual reporting, or custom API work can now be surfaced directly in the AI tools your team already uses.

With Torii MCP, your assistant can help you access information like:

• User details
• Contract details
• Audit log history
• Application details
• Workflow activity
• Transactions
• SaaS costs
• Renewal data
• App ownership
• And more

Depending on your permissions, your assistant may also be able to take supported actions in Torii, such as searching apps, matching app records, creating contracts, updating users, or running workflows.

Hosted MCP, No Local Setup Required

Torii’s MCP server is now hosted, so you can connect your AI assistant directly to Torii without installing packages, running a local server, or managing API keys.

Connect your MCP-compatible client to Torii’s hosted MCP server:

https://api.toriihq.com/mcp

From there, sign in with your Torii account and approve the connection. Torii uses OAuth and your existing Torii role permissions, so your assistant only gets the access you already have inside Torii.

Torii’s hosted MCP server can work with AI clients that support remote MCP servers with OAuth, including tools like Claude, ChatGPT, Claude Code, Cursor, Windsurf, Zed, Cline, Continue, and custom apps built with official MCP SDKs.

Torii MCP in Action

Below, see how a few prompts reveal offboarding status, ownership gaps, and replacement recommendations in seconds.

With just a few prompts in Claude, the user learns that:

• Six employees are currently in an offboarding workflow, and only one — Melba Donnelly — has not been deleted yet.
• Melba is still the app owner for Box.
• Claude can pull a list of active Box users, analyze usage, and suggest four candidates to take over ownership.

That is a simple example, but it shows the larger value: IT teams can move from question to answer without manually checking multiple screens, exporting data, or building a report first.

What You Can Ask

Once connected, your AI assistant can help answer questions like:

• Which apps have more than 100 users?
• Which contracts are renewing in the next 60 days?
• Which apps have the most unused licenses?
• Who owns this app?
• Which users have access to this app?
• What workflows ran in the last seven days?
• Which apps were added last month?
• What changed in our SaaS stack this week?

You can also use Torii MCP to dig deeper. For example, you might ask your assistant to find apps with high spend and low usage, identify contracts that need attention, or review recent workflow activity before a meeting.

Why It Matters

AI is only useful when it has the right context.

For SaaS management, that context lives in Torii: your apps, users, contracts, costs, workflows, ownership data, and audit history. Torii MCP brings that context into the AI tools your team already uses, so you can ask better questions and get faster answers.

That helps IT, procurement, finance, security, and operations teams:

• Reduce manual reporting
• Find SaaS risks faster
• Spot cost-saving opportunities
• Understand ownership and access
• Review workflow activity
• Prepare for renewals
• Make decisions with fresher data

Instead of asking your team to jump between systems, Torii MCP lets them start with a question and move straight toward the answer.

How to Get Started

Ready to connect your AI assistant to Torii?

Use Torii’s hosted MCP server:

https://api.toriihq.com/mcp

For step-by-step setup instructions, see the support guide: Connecting AI Assistants to Torii with MCP.

Want to learn more about the standard behind it? Read the Model Context Protocol specifications.

Torii MCP helps your team bring live SaaS context into the AI tools they already use, so they can move faster, reduce manual work, and manage software with more confidence.

Prefer a Local MCP Setup?

Torii’s hosted MCP server is the recommended setup for most users because it does not require local installation, API key management, or running your own server.

For teams that prefer a local setup, Torii also offers a local MCP server package that can run on your machine and connect to Torii through your API key.

Install the package:

npm install @toriihq/torii-mcp

You’ll need:

• A Torii API key
• Node.js
• Yarn package manager

A local setup may be useful if your team wants more control over how the MCP server runs, needs to test MCP behavior in a development environment, or is connecting through a client that does not support hosted remote MCP servers yet.

For most users, we recommend starting with the hosted MCP server:

https://api.toriihq.com/mcp

For local setup instructions, visit Torii’s npm repository or contact your Torii Customer Support Representative.

In January 2023, Grammarly appeared in just 17% of customer environments. By January 2026, it had jumped to 47%. The growth wasn't steady — it came in three distinct waves, each driven by something specific Grammarly did.

Here's what the data looks like, and what was happening at Grammarly each time the line jumped.

Spike 1 (Feb–Mar 2024): Grammarly stopped being a spell-checker

On March 26, 2024, Grammarly launched Strategic Suggestions — AI-powered recommendations that went beyond fixing grammar to advising on audience, tone, and persuasion. The same week, it shipped App Actions, letting users trigger tasks in tools like Asana and Google Calendar from within Grammarly. For the first time, the product could make a real case to IT and procurement as a productivity platform, not a writing add-on.

Fast Company added fuel. Its 2024 Most Innovative Companies list (published March 19) named Grammarly in the AI category and cited some striking ROI numbers: one healthcare customer reported 28x ROI, and Grammarly claimed average savings of $5,000 per employee per year. That kind of coverage circulates in the procurement channels where enterprise software decisions get made.

Spike 2 (Dec 2024–Jan 2025): A new CEO, a new company

On December 17, 2024, Grammarly announced it was acquiring Coda — a collaborative workspace product competing with Notion and Google Docs — and that Coda's co-founder Shishir Mehrotra would become Grammarly's new CEO. The message was explicit: Grammarly was no longer a writing tool; it was building an AI productivity suite for enterprise teams.

That announcement closed a pipeline that had been building since October. Two months earlier, Grammarly had landed on the AWS Marketplace, giving companies with existing AWS commitments a way to apply cloud credits toward Grammarly Business — a procurement shortcut that removes significant friction. In the same October window, Grammarly launched Billing Groups, ServiceNow integration, and group-level security controls: the exact features IT admins need before they can deploy something organization-wide.

The jump from 30% in December to 38% in January reflects deals that probably started in Q4, enabled by the AWS listing and admin tooling, then accelerated by the Coda news.

Spike 3 (Sep–Oct 2025): The Superhuman rebrand

On July 1, 2025, Grammarly acquired Superhuman — the AI email client valued at roughly $825 million. Three months later, on October 29, Grammarly rebranded the entire company as "Superhuman" and launched the Superhuman Suite: four unified products (Grammarly writing, Coda workspace, Superhuman email, and a new AI agent platform called Superhuman Go). The rebrand landed across TechCrunch, Fast Company, Built In, and others simultaneously.

Usage in our dataset went from 35% in August to 41% in September and 46% in October. September also brought a Forbes Cloud 100 placement at #11 — the kind of analyst recognition that validates a platform to IT procurement teams evaluating AI investments. A $1 billion non-dilutive funding round announced in May, earmarked for sales and marketing scale, almost certainly put more reps in front of enterprise buyers during this window.

What this means for IT teams managing SaaS

Each of these spikes followed the same pattern: Grammarly expanded what the product does, and enterprise adoption followed. That creates a specific challenge for IT.

In 2023, most companies probably had Grammarly as an employee-purchased tool — a $12/month browser extension people expensed without telling IT. By 2026, the product has become a full AI productivity suite with admin controls, data governance features, and enterprise licensing that IT should be part of evaluating and managing.

If you're not tracking which tools are gaining momentum in your organization, you'll find out about the enterprise version of Grammarly (or Superhuman, now) after someone in marketing has already signed a contract. The best position is to see the adoption curve before the renewal conversation happens.

Torii surfaces that kind of usage data automatically — which apps employees are using, which ones are growing, and which ones have grown to the point where IT needs a seat at the table. Book a demo to see how it works.

Related reading:

• How to Detect OAuth Risks in Google Workspace and Who\u2019s Behind Them in 2026
• What is a Log Analysis?
• What is Spend Analysis?

Two years ago, 87% of active Torii customers had Salesforce in their stack. Today that sits at 60%. HubSpot moved in the opposite direction, climbing from 23% to 35% over the same stretch. The ratio between the two dropped from 3.8x to 1.7x — a meaningful shift in 24 months that has less to do with Salesforce losing accounts and more to do with where new companies are starting when they come to market.

Source: Torii customer [data](/blog/data-localization). Penetration = share of active Torii customers using each platform that month.

The numbers: where things stand today

In February 2026, Salesforce was active at 60% of companies in Torii's customer base, compared to 35% for HubSpot. Those percentages don't tell the full story on their own, because the base itself has been growing fast.

Torii's active customer base nearly doubled between early 2024 and early 2026. The companies joining the platform more recently are less likely to have Salesforce as their primary CRM than earlier cohorts were. New entrants are choosing HubSpot at a noticeably higher rate, and that dynamic is what's pulling the penetration gap closed. It's not Salesforce churn — it's new business going elsewhere.

HubSpot's rise: penetration, not just headcount

HubSpot's penetration among Torii customers went from 23% in February 2024 to 32% a year later, then 35% by February 2026. The growth is real, and there are specific product moves that explain it.

In December 2023, HubSpot completed its acquisition of Clearbit for roughly $150 million, adding firmographic and technographic data across 20+ million companies. That data was folded into the platform as Breeze Intelligence at INBOUND 2024 in September 2024, giving HubSpot a data enrichment capability that previously required enterprise-tier tools. HubSpot's full-year 2024 revenue grew 21% year-over-year to $2.63 billion, roughly double Salesforce's 11% growth rate over the same period.

The customer count followed a similar trajectory, closing 2024 with 247,939 total customers, up 21% from the year prior. Those customers still skew smaller than Salesforce's enterprise book of business, but the mid-market overlap is growing, and both companies know it. Salesforce noticed the shift early enough to respond: in February 2024, it launched Marketing Cloud Growth Edition, a product explicitly targeting companies with fewer than 200 employees — the segment where HubSpot has historically been strongest.

Salesforce's response — and where it's holding

Salesforce is not losing existing customers — but it is losing new ones. Torii's customer base more than doubled over this period, and Salesforce only captured about a third of those new accounts. That's what a starting point of 87% penetration looks like when the market grows faster than you do: the absolute count goes up, but your share of new business tells the real story.

The penetration drop from 87% to 60% is a function of base growth, not platform loss. Salesforce's per-customer revenue remains far higher than HubSpot's, and its enterprise positioning stayed intact through this period. Alongside Marketing Cloud Growth Edition, Salesforce launched Agentforce in late 2024, its AI agent platform aimed at automating complex workflows for large organizations. The 2024 Gartner Magic Quadrant for Sales Force Automation still rated Salesforce's AI stack as more mature than HubSpot's for enterprise use cases.

What Salesforce is actually losing is not its existing accounts. It's new business at the margin, where companies that might have defaulted to Salesforce five years ago are now starting with HubSpot first and finding less reason to switch later.

What SaaS managers should watch

Both platforms follow a consistent seasonal pattern across the full two-year window: usage dips in July and December, with peaks in October and February. This tracks broader business cycles rather than anything CRM-specific. For SaaS and IT teams, that seasonality is useful. The dip months are the right time to pull utilization reports, compare licensed users against active ones, and flag contracts up for renewal in Q4.

The bigger operational question for SaaS managers is dual-CRM environments. As HubSpot moves upmarket and both platforms expand their feature overlap, the risk of running Salesforce and HubSpot in parallel grows significantly. Sales teams on one platform, marketing on another, no shared source of truth on customer data. Torii data shows a meaningful share of customers actively using both tools simultaneously, which creates redundancy in spend, fragmentation across go-to-market teams, and a governance headache around user access and license assignments.

The CRM question used to be simple: Salesforce for organizations that needed scale, HubSpot for teams that wanted speed. That distinction is blurring. Managing the overlap well, whether that means consolidating to one platform or governing two deliberately, has become a real SaaS management task that doesn't get any easier as both platforms grow.

If your organization runs both platforms, a quarterly license review timed to the July or December usage dips can surface real savings before renewals land. See how Torii helps teams manage multi-CRM environments.

The Torii CLI is an OpenAPI-driven command line interface that lets you explore the Torii API, inspect schemas, and run API calls directly from your terminal. Every command is auto-generated from the live OpenAPI spec, so it stays in sync with the latest API capabilities without manual updates.

If you're writing automation scripts, building data pipelines, or connecting Torii to AI agents, this is your starting point.

Why a CLI?

Point-and-click interfaces work for exploring. But when you need to pull license data into a report, trigger a workflow from a script, or pipe SaaS usage stats into another tool, a CLI is faster and more composable. Every response comes back as structured JSON, so it works out of the box with jq, shell scripts, and automation frameworks.

The Torii CLI is built for:

• Automation scripts — schedule recurring data pulls or trigger actions on a cron
• Data extraction pipelines — export application, user, and contract data for analysis
• AI and agent integrations — feed Torii data into LLMs, Claude Code, or custom agents
• Interactive exploration — browse available endpoints and test calls before writing code

Getting Started

Install globally via npm, or run it directly with npx if you just want to try it out.

# Install globally
npm install -g torii-cli

# Or run without installing
npx torii-cli discovery

Before running commands, set your API key as an environment variable:

export TORII_API_KEY="your-api-key"

That's it. You're ready to query your Torii instance from the command line.

How It Works

The CLI dynamically fetches the OpenAPI specification from the Torii API. This means you don't need to memorize endpoints or check documentation every time the API changes. Run the discovery command to see every available operation:

# List all available API operations
torii-cli discovery

This returns a JSON list of every endpoint, generated directly from the spec. From there, you can run any operation. For example, to pull your top 10 applications:

# List your first 10 applications
torii-cli apps list --size 10

All responses are structured JSON, which makes it easy to pipe into other tools or parse in scripts.

Pairing Torii CLI with AI Agents

One of the most practical uses for the Torii CLI is connecting your SaaS data to AI-powered tools. Because the CLI returns structured JSON and supports the same operations as the API, it works well as a data source for LLMs and coding agents.

Here's what that looks like in practice. Below, a user asks Claude Code how many people in their company are using ChatGPT, Gemini, and Claude. Claude queries the Torii API to pull real usage data and return an answer in seconds.

Instead of logging into a dashboard, filtering by app category, and exporting a spreadsheet, the user gets an answer through a natural language prompt. The CLI (and the broader Torii API) makes this kind of integration straightforward.

This pattern applies to more than just usage questions. You can build agents that flag expiring contracts, identify orphaned accounts, surface license optimization opportunities, or generate compliance reports, all powered by the same API the CLI uses.

What You Can Do With It

The CLI gives you access to the same data and actions available through the Torii platform. A few examples:

• Pull application inventory — list all discovered apps, filter by category, and export for audits
• Query user data — check who has access to what, identify inactive accounts, and track usage
• Monitor contracts and spend — surface renewal dates, license counts, and cost data
• Feed data into CI/CD or reporting tools — pipe JSON output into dashboards, Slack alerts, or ticketing systems
• Build custom automations — combine CLI calls with cron jobs, shell scripts, or orchestration tools

Get Started

The Torii CLI is available now on npm. Install it, set your API key, and start querying your SaaS data from the terminal.

For full documentation, visit the Torii Developer Docs.

Already a Torii customer? Reach out to your Customer Success representative to get your API key and start building.

Book a demo to see how Torii helps teams manage SaaS with automation, visibility, and developer-friendly tools.

Then you have shadow AI usage and tool overlap, leading to cost optimization questions like, "We use Google Workspace, which has Gemini built in. Why also pay for ChatGPT?" or "Why are we paying so much for Cursor when we could just use Claude Code instead?"

The good news: it's possible to track AI costs in 2026 down to the cent, as well as easily identify overlapping AI tools. This guide breaks down how to track AI costs in 2026: what to measure, how to do it manually, and how platforms like Torii give you a real-time view across your entire AI stack.

Why is AI Spending Harder to Control Than SaaS?

Traditional SaaS follows a predictable model: pay $X per month, or per seat per month. In either model, predicting costs is easy (it'll be the same cost unless you add more people). AI tools have upended this with their focus on 'token-based' pricing and generally opaque insights into usage.

Usage-based pricing is of course not new. Tools like Stripe (commission %), Twilio (PAYG usage), and Hubspot (cost per marketing contact) have used them for years. Not to mention Google Cloud and AWS's cloud compute costs. But these are much more predictable than AI token pricing, and the norm for SaaS is still monthly/yearly pre-set commitments.

Meanwhile, AI tool usage is...confusing? Odd? Misleading? Just take a look at this API pricing breakdown from OpenAI.

Understanding costs here is a nightmare. What model are you using? Are we caching or not? Is this batch, flex, or standard? How do I track how many tokens any given message contains? At least with standard request-based PAYG pricing you know that 1 request = 1 request to pay for.

On top of that, you have shadow AI. Employees are signing up for their favorite new AI tools, even though they may overlap significantly with tools your company already pays for. Then, of course, people may be signing up for ChatGPT themselves when a team plan would be much more economical.

The costs can compound quickly. A 100-person engineering team could be running Cursor, GitHub Copilot, and Claude Code simultaneously, each doing roughly the same thing. At standard pricing, that's anywhere from $70,000 to $130,000 per year in coding AI alone.

This differs from traditional SaaS because normally it's easy to identify overlaps. If you're working with Box.com, it may feel weird to also work in Dropbox for some projects, since they are effectively the same tool. Gemini and MidJourney, on the other hand, may not feel that way. Yet, with the speed of AI innovation, the difference between AI tools is shrinking. Maybe you paid for Gemini Nano Banana because it was the best image generator, then switched to MidJourney the next month because it seemed better, and so on - until you just decide to keep paying for both. (Or, you were using MidJourney not knowing Gemini was also a great image generator).

How Do I Track AI Costs Manually?

The manual approach to AI cost tracking is where most companies begin. For small companies, it's relatively simple: you log into each tool's billing dashboard separately (the OpenAI usage page, the Copilot admin console, Cursor Teams billing), pull the numbers, and paste them into a spreadsheet. Then you cross-reference expense reports to catch anything employees bought on their own.

This approach works passably when you have two or three tools and one person keeping the spreadsheet current. It doesn't hold up as your AI stack grows.

The core limitation with manual tracking comes down to visibility lag between spending and awareness. Each billing dashboard gives you a static snapshot from a single vendor. You have no cross-tool view of what an individual employee is spending across their whole AI stack. You can't see that one developer has active subscriptions to Cursor, Claude Pro, and ChatGPT running at the same time.

A second blind spot with manual tracking is that it tells you nothing about license utilization. A billing dashboard shows what you're paying, not what's being used. You can have 50 Copilot seats and only 20 active users, and the invoice looks the same regardless. Finding that waste requires comparing the bill against actual login data, which most AI tool billing dashboards don't surface.

How Can I Track Costs with Torii?

Torii is an AI Management Platform that replaces the per-tool billing dashboard approach with a single consolidated view. Torii's AI Apps Spend dashboard pulls all your AI tool costs into one place: total spend by tool, last 30 days vs. last 12 months, user counts, and license utilization.

That last column is where the real value shows up. If Lovable is sitting at 38% license utilization, that means 62% of the seats you're paying for aren't actively used. That's not easily visible within Lovable alone. In Torii, it surfaces right next to the cost number so you can act on it immediately.

Additionally, the spend-over-time chart surfaces growth trends that a manual spreadsheet would never flag in time. Cursor spend jumping from roughly $1,400 per month to over $5,400 in two months is a signal worth investigating: is the team growing, or are a handful of power users burning through credits on a premium model? Seeing the trend is the first step to asking the right question.

How Do I Cut My AI Costs?

Seeing your AI spend is the starting point, not the finish line. Once you have a consolidated view, four actions consistently move the number down.

Reclaim idle seats. For AI tools with seat-based pricing, any AI license that hasn't been accessed in 90 days is waste. License reclamation at this threshold can cut AI tool costs by 20-35% in organizations that haven't been actively managing it. Set a policy, automate the reclaim, and redirect those seat costs elsewhere.

Identify tool overlap. Once you can see every AI tool in use, consolidation decisions become obvious. If multiple teams are each paying for a coding assistant, pick one standard. If you have three separate LLM subscriptions doing similar work, consolidate. A tool like Torii can help surface those duplicate tools easily.

Rightsize tiers. Actual usage data removes the guesswork from tier and contract decisions. If 60% of your Copilot users are only accessing basic features, downgrade those seats. Annual contracts save 10-20% over monthly billing for tools you're committed to keeping long-term.

Set ongoing guardrails. Treat AI spend like cloud compute: allocated per team, monitored monthly, with budget alerts at 80% of the limit. Require new AI tool requests to pass a lightweight approval that checks for overlap with existing tools. The goal isn't to slow down adoption. It's to stop paying for the same capability twice.

Monitor outliers. If a certain tool or user is causing costs to climb, why is that? Perhaps there is wayward automation running, or an expensive model is being used when a more cost-efficient one would suffice. Review and set guidelines on model and token usage.

AI tool adoption isn't slowing down, and neither is the spending that comes with it. Enterprise AI-native app spend grew 108% year-over-year in 2025, and with more tools hitting the market every month, the overlap problem will only compound. The companies that stay ahead of it are the ones that treat AI spend the same way they treat cloud compute: tracked by team, reviewed regularly, and tied to actual outcomes.

The path forward isn't complicated. Know what you have, know what's being used, and build a repeatable process to act on that data. Whether you start with a manual audit or a platform like Torii that consolidates everything into one view, the goal is the same: visibility that lets you make decisions before you get surprised by a five-figure invoice.

See how Torii tracks your AI spend across every tool. Book a demo.

Related reading:

• What Is a Toxic Combination in SaaS in 2026?

Executive Summary

Identity Governance & Administration (IGA) is no longer a back-office task. It is a board-level responsibility. Identity is now central to enterprise risk, regulatory compliance, and shareholder value.

The pressure is mounting from every direction:

• Breach reality: Ransomware features in 44% of breaches, the human element is present in nearly 60%, and third-party exposure has doubled to 30%.
• Financial impact: The average breach costs $4.4M, while most organizations hit by AI-related incidents lacked basic access controls.
• Regulatory heat: Boards face direct accountability under DORA (resilience and third-party oversight), NIS2 (expanded obligations with active enforcement), and the SEC cyber rule (4-day disclosure of material incidents).
• Business reality: Enterprises now run an average of 1,850 SaaS apps. Machine identities outnumber humans 82:1, and AI systems are emerging as new “users” with access needs of their own.

The good news is that IGA delivers results quickly. 

This blueprint gives boards, executives, and audit committees the tools to turn identity governance into a measurable, board-sanctioned program. Specifically, it will:

• Outline clear accountability: Show exactly who should own which responsibilities—from board and committee oversight, to executive sponsorship, to daily operations through an IGA council.
• Provide a reference architecture: A vendor-agnostic model of the essential layers of IGA (sources, control plane, Zero Trust, PAM, ITDR, AI guardrails, reporting) that boards can use to judge maturity.
• Define a board-ready KPI framework: A concise set of metrics and targets mapped directly to regulatory requirements, so progress can be tracked quarter by quarter.
• Map controls to standards: Demonstrate how IGA outcomes align with NIST CSF 2.0, DORA, NIS2, and SEC rules—simplifying reporting and audit prep.
• Deliver a 180-day SaaS sprawl plan: A phased approach to bring shadow IT, vendors, and machine identities under governance, with quick wins in the first 30 days.
• Show the ROI case: Translate governance outcomes into financial language—license reclamation, audit efficiency, and avoided breach losses—so CFOs and boards can clearly see value.

The takeaway is simple: IGA is the control plane for digital risk. It enables boards to prove compliance, reduce exposure, and demonstrate financial value—turning identity from a hidden liability into a governed asset.

IGA is a Board-Level Concern

For years, identity was treated as a back-office function. It was something that IT, SecOps, and vendor management dealt with. But today, that era is over.

Identity is a board-level concern because it directly impacts enterprise risk, regulatory compliance, and shareholder value. 

The facts are clear: stolen or misused credentials are still the easiest way for attackers to get in to the organization. 

According to  Verizon’s DBIR 2025 reports:

• Ransomware was involved in 44% of breaches
• The human element was present in ~60%
• Third-party involvement doubled year over year to 30%

 IBM’s 2025 study pins the average cost of a breach at $4.4M.

Additionally, they highlight a massive AI oversight gap. Among the orgs reporting an AI-realted security incident, 97% lacked proper AI access controls.

As financial impacts grow, regulatory leashes tighten.

In Europe, DORA now requires boards of financial institutions to prove resilience across their ICT and vendor ecosystems. NIS2 is expanding the obligations across industries, and the commission is already escalating against 23 lagging states. In the US, the SEC cyber  disclosure rule now forces boards to disclose material incidents within four business days.

Each of these rgulations asks the same question of the board: Can you prove, right now, that you know who (or what) has access to what?

Along with the financial and  regulatory risk, there is the business reality. 

Organizations use:

• More applications than ever, with enterprises often leveraging over 1,800 apps
• Machine identities, outnumbering human identities 82 to 1 
• More AI solutions than ever before

The takeaway is simple: IGA is the control system for digital risk, the foundation of zero trust, and the evidence trail that boards need for regulators and investors. Without it, companies risk breaches, regulatory fines, missed disclosures, and loss of market trust. However, there is also an opportunity. With an IGA architecture in place, boards gain measurable resilience, faster audits, and the ability to show ROI in just a few quarters.

In this piece, we’ll build out a reference architecture for your IGA Blueprint. This guide is vendor agnostic, instead it outlines the key building blocks and the relationships between them.

Reference Architecture: The Core Layers of IGA 

If IGA is indeed a board-level concern, the next logical step is to show the board what a good outcome looks like. That is the purpose of a reference architecture, it is a blueprint of the essential layers that every enterprise needs in place to govern identity effectively.

These layers are non-negotiable building blocks of modern identity governance. Different organizations might use different language to describe some of the business functions included, but the processes and outcomes should be similar. Each layer addresses real-world weaknesses that attackers exp[loit and regulators scrutinize. Together, they form the control plane that allows boards and executives to both reduce risk and prove compliance.

The Core Layers of IGA

• Identity Sources & Context: The “source of truth” for who people are, who vendors are, and what machines or AI agents exist. Without authoritative sources, everything else falls apart.
  
• IGA as the Control Plane: Where governance actually happens: automating joiner/mover/leaver processes, approving or denying access requests, enforcing segregation-of-duties rules, and running certifications. This is the heartbeat of the architecture.
  
• Zero Trust Enforcement: Access is never granted by default. Instead, users must prove themselves continuously via SSO, MFA, device posture, and least-privilege rules, every time they connect.
  
• ITDR (Identity Threat Detection & Response): Because policies aren’t enough, ITDR provides the ability to detect stolen tokens, anomalous logins, or suspicious privilege escalation and shut it down fast.
  
• Privileged Access Management (PAM): Admin accounts are the master keys to the kingdom. PAM ensures they’re controlled, time-boxed, monitored, and rotated whether human or machine.
  
• Third-Party & Supplier Access: Many of today’s breaches start with a vendor. Extending IGA controls to suppliers ensures that partners play by the same rules and that offboarding happens the moment a contract ends.
  
• AI Identity & Data Guardrails: As AI systems become active participants in workflows, they must be governed as identities too. Who can they access? What can they see? How are their API keys rotated?
  
• Evidence & Reporting: You need proof. Audit trails, attestation reports, and clear metrics that map directly to DORA, NIS2, and SEC requirements. This is what lets the board sleep at night.

We’ve laid out the core layers of the reference architecture, these building blocks make up an enterprise-grade identity governance program. But layers on a diagram won’t move the board. Now it’s time to establish KPIs and targets that you can measure against.

Board-Ready KPIs and Targets (90-Day to 3-Quarter Trajectory)

What directors, audit committees, and CFOs need is a scoreboard: a small set of measurable outcomes that prove whether the architecture is working and whether the investment is paying off. 

In this section, we’ll lock down KPIs and targets so you can see and prove your progress.

Think of these as your CEO/CFO-safe metrics. They’re clear, auditable, and can be tied directly to regulatory requirements or financial returns. They also have the advantage of being time-bound: progress can be demonstrated in as little as three quarters. 

We’ll break these KPIs into five groups.

Identity Hygiene & Lifecycle

• Orphaned accounts (both human and non-human): Accounts without owners are a breach waiting to happen.
  • Target: Reduce known orphaned accounts by 80% in 2 quarters.
  • Tip: Reconcile IdP/IGA directories against HRIS and the vendor master/NHI registry. Prioritize by: app criticality, privilege level, data sensitivity, and last login.
• Time-to-deprovision (JML): When someone leaves, or a vendor contract ends, access should disappear immediately.
  • Target: ≤ 4 hours for SaaS; ≤ 24 hours for infrastructure.
  • Tip: Start the clock at the HR “termination effective” timestamp; stop it when tokens/sessions are revoked. Automate HRIS → IGA → SSO/SCIM, add a one-click “kill switch,” and run monthly mystery-user tests.
• % apps under SSO + SCIM-based lifecycle: Coverage is control; if it’s not behind SSO and SCIM, it’s hard to govern.
  • Target: 80% coverage; prioritize the top 50 apps by risk/use.
  • Tip: Build an app register (criticality, user count, SSO/SCIM support, owner). Migrate in waves (top 25, next 25, long tail). Require SSO/SCIM in new-app intake and vendor contracts.
• Service/NHI with owner + rotation policy: Bots and keys are identities too; unowned secrets become permanent backdoors.
  • Target: 95% have an accountable owner; secrets MTTR ≤ 7 days (vs. DBIR’s 94-day median).
  • Tip: Discover NHIs via cloud IAM, CI/CD, and secrets scanners. Require Owner and Purpose fields for any token/key. Enforce TTLs and auto-rotation; break builds on expired/unknown secrets. Weekly reports: “NHIs without owner” and “secrets >7 days after exposure.”

Governance & Assurance

• % access under review: Certifications keep real-world access aligned with policy.
  • Target: ≥ 95% on schedule (quarterly for critical apps; semiannual for the rest).
  • Tip: Scope by risk tier. Show delta-only changes to reviewers. Auto-revoke non-responses after X days with advance reminders; escalate misses to the app owner’s VP.
• SoD violations (opened vs. closed) + age: Toxic combinations enable fraud; the point is how fast you burn down the backlog.
  • Target: ≥ 85% closed within 30 days.
  • Tip: Seed SoD rules from Finance (P2P/O2C/GL) and Cloud Ops (deploy vs. approve). Triage by monetary/material risk and privilege level. Track oldest open and repeat offenders; require compensating controls or removal.
• Exception debt (temporary access): “Temporary” tends to become permanent unless engineered to expire.
  • Target: ≥ 98% auto-expire on time.
  • Tip: Default expiry (e.g., 7 days) for all exceptions; disallow no-end-date grants. Monthly leadership report: exceptions >30 days. Treat break-glass the same, time-boxed, recorded, reviewed.

Risk & Detection

• Privileged accounts with phishing-resistant MFA: Admins hold the master keys; weak MFA isn’t acceptable.
  • Target: 100% coverage.
  • Tip: Inventory privileged roles (cloud/domain admins, root, CI/CD, finance superusers). Enforce WebAuthn/FIDO2 or platform authenticators; block SMS/voice for these roles. Maintain a short, dated exceptions list with remediation owners.
• High-risk identity alerts MTTR (ITDR): Time-to-contain drives breach impact; automation wins.
  • Target: ≤ 1 hour to containment.
  • Tip: Pre-define “high risk” (token theft, impossible travel + privilege, lateral movement to crown-jewel apps). Auto-contain (kill sessions, revoke tokens, force reset). Measure start (alert create) and stop (containment evidence). Run a monthly game day.
• Third-party/vendor identities governed: Vendors are part of your attack surface, and often the easiest path in.
  • Target: ≥ 90% via IGA/SSO/PAM; inactive vendor access = 0.
  • Tip: Integrate vendor master with IGA. Make IdP-only onboarding a contract term. Require named vendor managers who attest access quarterly. Auto-disable on contract end or 30 days of inactivity.

Regulatory Readiness

• DORA/NIS2 control attestations: You can’t comply without evidence; mapping controls avoids audit surprises.
  • Target: Controls mapped and evidenced across third-party risk, incident playbooks, and continuity.
  • Tip: Build a control-mapping matrix: Reg requirement → Control owner → Evidence source → Test cadence. Store proofs in an “evidence locker” with timestamps. Do quarterly mini-audits instead of annual scrambles.
• SEC 8-K readiness (4 business days): If identity failure triggers a material incident, the clock starts immediately.
  • Target: Able to determine materiality and draft disclosure within 4 business days; tabletop tested.
  • Tip: Define a materiality rubric, escalation tree (CISO–GC–CFO–IR), and pre-approved templates. Time the tabletop from detection → decision → draft and stage identity evidence (logs, revokes, certifications).

ROI & Efficiency

• License reclamation via deprovisioning: Every orphaned seat is wasted spend; deprovisioning helps fund IGA.
  • Target: Report gross savings/quarter; make the number visible to Finance.
  • Tip: Focus on the top 10 apps by spend. Link revokes to seat removal (not just disabling). Publish a monthly “savings realized” report and forecast next-quarter savings from today’s pipeline.
• Access request cycle time: Faster access improves productivity, without increasing risk when guardrails are solid.
  • Target: Reduce median hours; show productivity regained.
  • Tip: Offer pre-approved catalog roles for low-risk access with auto-approval. Route only sensitive requests to multi-step approvals. Instrument median by app and owner; spotlight bottlenecks.
• Audit prep time: Continuous evidence shrinks effort and findings.
  • Target: Fewer hours vs. last cycle; fewer exceptions/findings.
  • Tip: Move to continuous evidence collection. Keep “audit-ready packs” per control (policy, config, sample, attestation). Give auditors read-only access to standard exports; track hours saved YoY.

This a comprehensive list of KPIs and Targets moving forward. The best way to operationalize this quickly is to pick the right denominators (i.e. top 50 apps by risk/spend + all privileged/NHI + all vendors), set a weekly burn-down goal for backlog KPIs (i.e. orphaned, SoD, exceptions), and automate timestamps for time-to-deprovision, mean time to respond/recover, and reviews (access certifications). 

A lot of organizations estimate numbers, but they aren’t measuring them. But, regulators and auditors don’t want your gut feel, they want system logs. Ensure that you are always measuring and making progress on those numbers. 

Operating Model & Governance

A blueprint and a set of KPIs is only half the job. The other half is making sure the right people own the right parts of the system. This is where your operating model is critical. 

Think of it as an accountability map:

• Who sets the rules
• Who enforces the rules
• Who provides the oversight

The Board and Committees

The board and its audit/risk committee own the highest level of responsibility. They don’t manage the day-to-day minutia, but they do keep track of progress on a longer time horizon. 

Board and Audit/Risk Committee Responsibilities:

• Set the organization’s risk appetite for identity and access.
• Review KPI dashboards quarterly just as they do for financials
• Oversee compliance with regulatory regimes such as the SEC cyber disclosure, DORA, and NIS2

Their job is to ask tough questions in response to what they see. As KPIs start to roll in and conversations with regulators proceed, the board must keep focus on what matters.

“How many orphaned accounts remain?”

“Are we within SLA for vendor offboarding?”

“Can we prove it if regulators call?”

Often, the most importan thing they can do at this level is say “Prove it to me before I have to prove it to someone else.”

The Executive Triad (CISO, CIO, CFO)

The executive triad consists of the CISO (accountable), CIO (co-owner), and CFO (controls). Together, these three roles create the charter, policy, and funding for identity governance. 

• CISO: Ultimately responsible for IGA control effectiveness and for reporting the results to the board
• CIO: Shares ownership, particularly around integration with infrastructure and the application portfolio
• CFO: Responsible for cost controls, ROI measurement, and financial compliance

The IGA Council

Now we are at the level of daily execution. Your IGA council is a cross-functional team. A group that meets regularly (bi-weekly or monthly) to keep everyone in lockstep throughout the organmization. The IGA council should include representatives from: 

• Security
• IT/Identity Operations
• HR
• Procurement
• Legal
• Application Owners

The council is responsible for the practical elements like the Segregation of Duties catalog, the Joiner/Mover/Leaver SLAs, and Vendor Access Policies. Their work ensures that there is allingment across functions so no single team carries the full burder or stalls the entire initiative. 

In Summary: 

• Board: Approves the risk appetite and receives regular attestations.
• CISO: Accountable for IGA controls being effective and reported.
• IT Ops/Identity Team: Responsible for lifecycle automation, connectors, SCIM integration, and operational execution.
• App Owners: Approve or deny access, maintain SoD policies, and attest to who should have access.
• Procurement/Vendor Management: Ensure contracts include identity requirements and that offboarding happens automatically when agreements end.

Controls Blueprint: Tying IGA to Frameworks and Regulations

Now that we’ve established the architecture and operating model, the next question a board or regulator will ask is, “How do these controls line up with recognized frameworks or laws?”

To answer that, we will now map your IGA program to relevant frameworks and regulations. This step is important because it shows that your initiative is anchored to external standards, it’s not simply a homegrown series of ideas. 

NIST Cybersecurity Framework 2.0 

NIST CSF 2.0 is one of the most known and respected playbooks for cybersecurity governance in the U.S. and abroad. From the framework, there are two areas especially relevant to identity.

• PR.AA (Identity Mgmt, Authn & Access Control): From page 19 of the CSF 2.0, this section expects that organizations will manage identity lifecycles, enforce MFA, apply least privilege, vault and rotate credentials, prevent toxic access combinations, and conduct periodic access certifications. In other words, this is the day-to-day work of IGA. These are tasks for which the IGA council should focus to achieve. 
• GV (Govern):  The “Govern” function is new in CSF 2.0 and makes identity governance explicitly a board responsibility. It expects boards to set risk appetite, assign roles and responsibilities, manage supply-chain identity exposure, and track metrics for continuous improvement. This is the board’s call for direct accountability.

DORA (Digital Operational Resilience Act)

Effective in Europe’s financial sector since January 2025, DORA requires companies to prove they can withstand ICT and third-party disruptions. For identity, that means demonstrating:

• Strong vendor access controls
• Rapid revocation of third-party accounts
• Tested incident playbooks and continuity plans

NIS2 Directive

NIS2 expands obligations well beyond finance, making identity and least privilege first-class controls across industries like healthcare, energy, and digital services. Boards need to show they’ve assessed supply-chain risks and put governance in place for all third-party and privileged access.

SEC Cyber Disclosure Rule

In the U.S., public companies must disclose material cyber incidents within four business days. This raises identity governance from a “back office” activity to a board reporting requirement. If an identity or access failure leads to a breach, the board must be able to demonstrate:

• They had visibility into identity risks
• They had tested playbooks for escalation and disclosure
• They can provide evidence of access governance at the time of the incident

Why This Matters

By explicitly mapping your IGA controls to NIST CSF and overlaying DORA, NIS2, and SEC requirements, you create a single story for auditors, regulators, and the board. Instead of a patchwork of policies, you can show:

• This control aligns with NIST.
• This same control satisfies DORA/NIS2/SEC requirements.
• Here’s the evidence (audit logs, certifications, revocations).

This reduces redundancy, simplifies reporting, and ensures the board can answer the toughest regulatory question: “Can you prove who had access, when, and why?”

Build the SoD/Access Policy Backbone

Once the architecture and governance model are in place, the next priority is to codify access rules; what combinations are allowed, what must be blocked, and how often they’re checked. This is your Segregation of Duties (SoD) and access policy backbone.

The SoD/Access Policy Backbone is a structured set of rules and guardrails that define who can do what across critical applications. It ensures no one person (or account) has too much unchecked power. 

Think of it like any other task. You want a separation of duties to ensure accountability and accuracy. You want different people creating a vendor and approving payments, or pushing code and approving its release. 

Core Components

The backbone of any effective identity governance program is built on a small set of practical components. These define where to focus, what rules to enforce, how exceptions are handled, and how often access is checked. Keeping this simple but structured makes it easier for teams to execute and for boards to oversee.

This backbone turns abstract “least privilege” into tangible, enforceable rules. It gives the board confidence that fraud opportunities are minimized, regulators evidence that toxic combinations are managed, and business leaders assurance that emergency access is possible without leaving permanent backdoors.

SaaS Sprawl Taming Plan (Fast Wins That Scale)

SaaS sprawl is no longer measured in the dozens or even the hundreds. Torii’s research shows enterprise organizations run an average of ~1,850 apps, far higher than the ~100–275 apps reported by Okta. For boards and executives, this is more than just a cost problem, it’s a governance and compliance challenge. 

Every new app brings new identities, new entitlements, and new opportunities for oversight failures.

The good news: taming SaaS sprawl doesn’t require boiling the ocean. A phased, 180-day plan delivers fast wins, scales to enterprise portfolios, and works for mid-market companies with leaner teams.

Phase 1 (0–30 days): Get Control of the Obvious

• SSO coverage for top 25 apps. Bring your most-used, highest-risk apps under single sign-on, and enable SCIM where available.
• Stop shadow IT invites. Put a hard stop on direct app invitations; enforce identity-provider onboarding only.
• Automate deprovisioning. Tie HR terminations and vendor contract ends directly to automated revokes. This closes the biggest “back door” first.

Who owns it: IT Ops/Identity team executes; App Owners and HR ensure onboarding/offboarding events are properly triggered.

Phase 2 (30–90 days): Address Hidden Risks

• Service account census. Inventory all non-human accounts, assign owners, and rotate high-risk secrets.
• Certify access for top-risk apps. Run your first round of certifications on the most critical applications. Purge orphaned accounts and close aging SoD violations.
• Normalize exception handling. Ensure temporary access is time-boxed, logged, and auto-expiring.

Who owns it: IGA Council oversees; App Owners validate; Internal Audit monitors exception debt.

Phase 3 (90–180 days): Scale and Mature

• Expand coverage. Push SSO/SCIM to cover ~80% of the portfolio, not just the top 25 apps.
• App-level SoD. Implement segregation-of-duties policies directly in SaaS apps that support it.
• Vendor portals. Bring supplier-facing access into the same IGA, SSO, and PAM flows as employees.
• Test response. Add ITDR detections across IdP/IGA/PAM, then run a red-team tabletop focused on identity misuse (we’ll cover more on IDTR in the next section).
• Refresh KPIs. Update the board-level KPI dashboard, set new targets, and establish next-year benchmarks based on progress.

Who owns it: CIO sponsors; CISO validates ITDR readiness; Board reviews new KPI trends.

Why This Matters

For enterprises, the scale (1,850 apps on average) makes SaaS governance a board-visible risk. For mid-market firms, fast growth means sprawl sneaks up faster than expected. This plan delivers:

• Quick wins in the first month (orphaned accounts gone, SSO on critical apps).
• Risk reduction in the first quarter (service accounts, certifications, vendor offboarding).
• Mature governance by six months (broad coverage, tested detection, refreshed KPIs).
  

ITDR Complements IGA (How They Work Together)

Even the best access policies can’t stop every attack. That’s why Identity Threat Detection & Response (ITDR) has become a critical partner to IGA. The two are designed to work hand-in-hand:

• IGA prevents issues by ensuring the right people have the right access at the right time.
• ITDR detects and responds when accounts, tokens, or policies are misused despite those guardrails.

Together, they close the loop: prevention on the front end, detection and containment on the back end.

Playbook Intersections (Examples)

• Suspicious impossible travel
  If a login shows up in two countries within minutes, ITDR auto-challenges the session. If it’s confirmed malicious, IGA policy revokes access while ITDR invalidates sessions and rotates tokens.
• Privilege escalation outside policy
  When a user suddenly gains admin rights outside approved channels, PAM cuts the session, IGA generates an exception ticket, and ITDR alerts the SOC while storing evidence for audit.
• Leaked secret detected
  If a secret (API key, token, password) shows up in a repo or monitoring feed, ITDR raises a high-severity alert. Then IGA/PAM rotate and re-issue credentials, forcing the owner to attest, targeting a mean-time-to-remediation of ≤ 7 days, compared to the DBIR’s 94-day median.
  

Why This Matters

For boards and executives, the key takeaway is that IGA and ITDR aren’t competing tools frameworks, they’re complementary layers of defense. IGA minimizes the number of doors into the enterprise; ITDR ensures that when a door is picked, the alarm rings and the lock is changed immediately.

This combination is what allows organizations to not only reduce breach likelihood but also meet audit and regulatory expectations for continuous monitoring and rapid response.

Executive ROI Model (Make Finance Love This)

Identity governance only resonates at the board level if it’s framed in terms of financial outcomes. For directors and CFOs, the question is simple: “What’s the return on this investment?” The answer comes in two parts:
1. Hard savings you can measure today
2. Risk-adjusted benefits that protect against tomorrow’s losses.

Hard Savings

• License reclamation through timely deprovisioning. Every orphaned seat costs money. By reclaiming SaaS licenses when users leave, you save directly: number of seats × monthly license cost × reclaimed seats. Finance teams see this as bottom-line savings.
• Audit prep reduction. Automated evidence collection and continuous certifications cut the hours spent on audit prep. Multiply saved hours by blended staff rates, then add in the reduced fines and fewer exceptions. That’s efficiency in dollars.
• Fewer privilege tickets. With cataloged roles and auto-approval guardrails, IT spends less time on access requests. The savings come in both reduced ticket volume and faster productivity for end users.
  

Risk-Adjusted Benefits

• Expected Loss Avoided. The formula: (Reduction in breach likelihood) × ($4.4M global average cost, per IBM). Regionalize where possible. Even modest improvements in likelihood reduction translate into millions of dollars in avoided loss.
• Ransomware containment and non-payment posture. Verizon’s 2025 DBIR shows that most organizations now decline to pay ransom. That makes response speed critical. Containing identity-driven ransomware quickly avoids secondary costs: PR damage, legal fees, downtime, and lost customer trust.
  

Time-to-Value

Boards don’t want ROI that takes years to materialize. Identity governance delivers visible results in 2–3 quarters if you focus on the right KPIs:

• Orphaned accounts down
• Time-to-deprovision reduced
• SSO/SCIM coverage up
• SoD backlog reduced

Each of these can be tracked quarter by quarter, giving executives clear evidence that the program is paying off.

Why Finance Should Care

• Direct savings (licenses, audit prep) show up in the P&L quickly.
• Risk-adjusted benefits protect against catastrophic losses that could wipe out annual earnings.
• Faster time-to-value means this isn’t a long-term “trust us” program, it’s measurable progress within the board’s reporting cycle.
  

Conclusion: From IT Project to Boardroom Priority

Identity Governance & Administration can no longer be treated as a back-office IT exercise. The data is clear: identity failures drive the majority of breaches, regulators on both sides of the Atlantic are raising the bar, and SaaS portfolios have exploded into the thousands of apps. What once felt like a technical detail is now a board-level governance issue, with financial, regulatory, and reputational consequences.

The blueprint we’ve laid out shows how to take control. It starts with a reference architecture that unifies prevention and detection. It moves through board-ready KPIs that let directors measure progress the same way they measure financials. It establishes a governance model with clear accountability, ties directly to NIST CSF 2.0 and regulatory overlays, and translates into fast wins against SaaS sprawl. Finally, it delivers a finance-ready ROI story that connects identity governance to both hard savings and avoided losses.

For boards, the next step isn’t whether to invest in IGA, it’s how quickly to elevate it into the governance agenda. For executives, the challenge is execution: embedding identity controls into everyday operations, measuring results quarter by quarter, and keeping oversight tight as the business grows.

The takeaway is simple: identity is the new control plane for digital business risk. Treating it as such not only reduces breach likelihood, but also positions the organization to meet regulatory demands, satisfy auditors, and protect shareholder value.

Appendix

Glossary of Critical Terms for the Enterprise IGA Blueprint

Access Certification (Access Review)

A periodic attestation by managers/owners to confirm users still need their current access; removals and exceptions are recorded as audit evidence.

Access Request Catalog (Catalog Roles)

A menu of pre-approved role bundles that users can request; low-risk items auto-approve within guardrails to reduce ticket load.

ABAC (Attribute-Based Access Control)

Authorization based on user/app/resource attributes (e.g., department, device posture), often layered with RBAC.

AD / Active Directory (incl. Entra ID)

Microsoft’s directory platforms that store identities, groups, and policies and act as core identity stores for many enterprises.

AI Identity & Data Guardrails

Policies that treat AI systems/agents as identities—governing what data they can access, which plugins/APIs they can use, and how their secrets are managed.

API Key / Token

A credential used by software and services (non-human identities) to authenticate to systems; must be issued, rotated, and revoked like user passwords.

App Owner

The accountable person for an application’s access policies, approvals, SoD rules, and certifications.

Audit Evidence / Evidence Locker

Time-stamped artifacts (logs, exports, screenshots, tickets, attestations) stored systematically to prove controls are operating.

Audit-Ready Pack

A pre-assembled set of policy, configuration, samples, and evidence for a specific control, prepared for auditors/regulators.

Auto-Revoke (Non-Response)

A rule that removes access if a reviewer does not complete a certification by the deadline.

Blast Radius (Business Impact)

The potential harm if a system or identity is compromised (financial, regulatory, operational); used to prioritize “top 50” critical apps.

Break-Glass (Emergency Access)

A tightly time-boxed, logged, and monitored elevation path used in emergencies; must auto-expire and be reviewed afterward.

CMDB (Configuration Management Database)

A repository of infrastructure/services metadata that helps discover machines, service accounts, and ownership.

Compensating Control

An alternate control that reduces risk when a preferred control (e.g., removing a SoD violation) is temporarily infeasible.

Credential Vaulting / Secret Vault

Secure storage for passwords, keys, and certificates, typically managed by PAM; supports rotation and access auditing.

CSF (NIST Cybersecurity Framework) 2.0

A widely used framework; this guide maps IGA to PR.AA (Identity/Access outcomes) and GV (Govern).

Deprovisioning (Termination Revocation)

Automated removal of accounts/entitlements when people leave or vendors/contracts end; measured as TTD.

Device Posture

Security state of a device (OS version, disk encryption, EDR present) used in Zero Trust access decisions.

Disclosure (SEC 8-K Item 1.05)

U.S. requirement to disclose material cyber incidents within four business days of determining materiality.

DORA (Digital Operational Resilience Act)

EU regulation for financial entities focusing on ICT/third-party resilience; requires strong vendor access governance and tested response.

Entitlement / Permission

A discrete right in an application (e.g., “Billing Admin,” “Export Data”) that should be role- or policy-managed.

Exception / Exception Debt

Temporary access granted outside standard policy; becomes “debt” if not time-boxed and auto-expired.

Expected Loss Avoided (ELA)

Risk ROI metric: (Reduction in breach likelihood) × (Average breach cost); used to quantify the financial impact of IGA.

FIDO2 / WebAuthn (Phishing-Resistant MFA)

Modern authentication standards using hardware or platform authenticators resistant to credential-phishing attacks.

Form 8-K (Material Cyber Incident)

The SEC filing used to disclose material cyber events; requires timely, evidence-backed decisioning on materiality.

Govern (NIST CSF 2.0 GV)

Framework function assigning board-level accountability for risk appetite, roles/responsibilities, supply-chain oversight, and metrics.

HRIS (Human Resources Information System)

The source of truth for workforce lifecycle events (hire, transfer, termination) that trigger provisioning/deprovisioning.

IAM (Identity & Access Management)

Operational systems that authenticate and authorize users (IdP, directories, SSO, MFA); IGA governs policy on top of IAM.

IGA (Identity Governance & Administration)

The policy/control plane that governs who gets what access, why, when, and for how long, with auditability (JML, requests, approvals, SoD, certifications).

IGA Council

Cross-functional working group (Security, IT, HR, Procurement, Legal, App Owners) that runs the program: SoD library, JML SLAs, vendor policy.

IdP (Identity Provider)

The service that authenticates users and issues assertions/tokens for SSO (e.g., Okta, Entra ID, Ping).

Impossible Travel

A detection signal where successive logins from distant locations cannot be legitimate given the elapsed time.

ITDR (Identity Threat Detection & Response)

Detection/response focused on identity systems and usage (token theft, anomalous privilege, lateral movement), with automated containment.

JEA / JIT (Just-Enough / Just-In-Time)

Least-privilege patterns that grant only the specific rights needed, and only for the time needed—often enforced through PAM.

JML (Joiner / Mover / Leaver)

Lifecycle processes that create, modify, and remove access based on HR or vendor events; must be automated and auditable.

KPI (Key Performance Indicator)

An outcome metric used to manage performance (e.g., orphaned accounts ↓80%, TTD ≤4h/24h).

KRI (Key Risk Indicator)

A forward-looking signal of risk (e.g., % privileged accounts without phishing-resistant MFA).

Least Privilege

Granting only the minimum access necessary to perform a task; cornerstone of Zero Trust and SoD.

Machine Identity (Non-Human Identity, NHI)

Service accounts, workloads, bots, CI/CD and API credentials that require ownership, rotation, and certification.

Materiality (Cyber Incidents)

A determination of whether an incident is important to investors; triggers SEC disclosure timelines.

MFA (Multi-Factor Authentication)

Authentication that requires two or more factors; phishing-resistant MFA (FIDO2/WebAuthn) is preferred for privileged access.

MTTR (Mean Time to Respond/Recover)

Average time from alert to containment/recovery for identity incidents; measured from system logs.

NIS2 (EU Directive)

EU directive expanding cyber obligations and enforcement across sectors; includes supply-chain and access governance expectations.

NIST CSF 2.0 PR.AA

Outcomes category covering identity management, authentication, access control, SoD, credential rotation, certifications.

OAuth 2.0 / OIDC (OpenID Connect)

Standards for delegated authorization and federated authentication, commonly used for modern SSO.

Offboarding (Vendor / Workforce)

The process of revoking all access and reclaiming licenses at contract end or termination; must be automated and evidenced.

Orphaned Account

An account without an active owner (often after turnover or vendor churn); a high-risk hygiene defect and core KPI.

PAM (Privileged Access Management)

Controls for high-risk/admin access: session brokering/recording, JIT elevation, vaulting and rotation for human and machine credentials.

PBAC (Policy-Based Access Control)

Authorization using policies that evaluate context (risk, device, location) at decision time.

Phishing-Resistant MFA

MFA that resists credential phishing and man-in-the-middle attacks (e.g., FIDO2/WebAuthn, platform passkeys).

Privilege Escalation (Outside Policy)

A user or service gaining higher privileges through unsanctioned paths; should trigger PAM cut-off and ITDR alert.

Provisioning / Reconciliation

Provisioning: creating accounts/entitlements from IGA to apps. Reconciliation: pulling actual app entitlements back to detect drift.

RBAC (Role-Based Access Control)

Authorization based on roles that bundle entitlements by job function; often combined with ABAC.

RACI (Responsible, Accountable, Consulted, Informed)

A responsibility model clarifying who owns what across board, executives, council, and operations.

Risk Appetite (Identity)

The level of identity/access risk the board is willing to accept, used to set targets and thresholds.

ROI (Return on Investment)

Financial returns from IGA: hard savings (licenses, audit hours) and risk-adjusted benefits (Expected Loss Avoided).

SCIM (System for Cross-domain Identity Management)

Open standard that automates account provisioning/deprovisioning across SaaS applications.

SaaS Sprawl

Rapid growth of applications and identities (often >1,800 in enterprises) that strains governance, offboarding, and SoD control.

SAML (Security Assertion Markup Language)

A federation standard used for SSO, especially with legacy or enterprise apps.

SEC Cyber Disclosure Rule

U.S. rule requiring timely disclosure of material cyber incidents and governance reporting; pushes identity oversight to the board.

Secret / Secret Rotation

Any credential (password, token, key) used by humans or services; rotation is the scheduled or event-driven replacement of that secret.

Secrets MTTR

Time from detection of leaked/compromised secrets to rotation/reissue; target ≤7 days.

Service Account

A non-human account used by applications or automation; must have a named owner, purpose, and rotation policy.

Shadow IT

Systems acquired or used outside official IT/IGA processes (e.g., direct SaaS invites); increases risk and audit scope.

SoD (Segregation of Duties)

Policies preventing toxic combinations of access (e.g., create vendor + approve payment) to reduce fraud/error.

SoD Library

A documented set of toxic-combo rules across finance, engineering, cloud ops, and data domains, seeded by audits and incidents.

SSO (Single Sign-On)

One identity to access many apps via federation (SAML/OIDC); enables centralized policy and telemetry.

Supplier / Third-Party Access

Governed access for non-employees (vendors, partners, contractors) that must follow the same IGA/PAM rules and automated offboarding.

Tabletop Exercise (Identity/Disclosure)

A rehearsal of incident detection, materiality decisioning, and disclosure—validates playbooks and timing (e.g., SEC 4-day rule).

Target Coverage (e.g., SSO/SCIM ≥80%)

A measurable adoption goal that prioritizes the highest-risk or highest-use apps first, then scales to the long tail.

Threat Telemetry (Identity)

Signals from IdP, IGA, PAM, and SIEM used by ITDR to detect anomalies (impossible travel, token theft, privilege surge).

Time-to-Deprovision (TTD)

Elapsed time from HR/vendor termination event to last access revoked; measured from system timestamps.

Time-to-Value (TTV)

Window (often 2–3 quarters) to show KPI improvements (e.g., orphans ↓, TTD ↓, SSO/SCIM ↑, SoD backlog ↓).

Token Invalidation / Session Kill

Automated response that terminates active sessions and revokes tokens after suspected compromise.

Top 50 Critical Apps

The prioritized application set (by blast radius and data sensitivity) used for initial control rollout, certifications, and SSO/SCIM onboarding.

Vendor Master

System of record for suppliers/contractors used to trigger onboarding/offboarding and to scope third-party certifications.

WebAuthn / Passkeys

Standards enabling passwordless or phishing-resistant authentication using device-bound or roaming authenticators.

Zero Trust (ZTA)

“Never trust, always verify” architecture: continuous, context-aware access decisions (identity, device, risk) with no implicit network trust.

Resources & Further Reading

Breach & Threat Landscape

• Verizon 2025 Data Breach Investigations Report (DBIR) — Executive summary (PDF)
  https://www.verizon.com/business/resources/reports/2025-dbir-executive-summary.pdf
  Key stats on ransomware prevalence, human element, 3rd-party involvement, and leaked secrets remediation timelines.
• Verizon 2025 DBIR (full hub)
  https://www.verizon.com/business/resources/reports/dbir/
  Landing page with links to the full report, snapshots, and visuals.
• DBIR Highlights Infographic (PDF)
  https://www.verizon.com/business/resources/reports/2025-dbir-executive-summary-infographic.pdf
  Quick scan of the year’s key trends.
• IBM Cost of a Data Breach 2025 (Main Report Page)
  https://www.ibm.com/reports/data-breach
  Summarizes global average breach cost ($4.44M) and AI oversight gaps (97% lacked AI access controls; 63% lacked AI governance policies).
• IBM Press Release (AI-specific findings)
  https://newsroom.ibm.com/2025-07-16-IBM-Report-Cybersecurity-AI
  Highlights AI-related security risks from the 2025 study.

Frameworks & Standards

• NIST Cybersecurity Framework 2.0 (Full Document)
  https://www.nist.gov/cyberframework
  Authoritative reference for governance and identity outcomes.
• NIST CSF 2.0 — PR.AA (Identity Mgmt, Authentication & Access Control)
  https://csf.tools/reference/nist-cybersecurity-framework/v2-0/pr/aa/
  Category page to map IGA controls.
• NIST CSF 2.0 — Govern (GV) Function
  https://csf.tools/reference/nist-cybersecurity-framework/v2-0/gv/
  Board-level governance expectations and outcomes.
• NIST CSF 2.0 FAQs
  https://www.nist.gov/cyberframework/faqs
  Helpful clarifications for board/Audit & Risk discussions.

Regulations & Oversight

• DORA (Digital Operational Resilience Act) — EIOPA Overview
  https://www.eiopa.europa.eu/digital-operational-resilience-act-dora_en
  What’s in scope and what boards must evidence; in force since Jan 17, 2025.
• NIS2 — European Commission Press Release
  https://digital-strategy.ec.europa.eu/en/news/commission-calls-23-member-states-fully-transpose-nis2-directive
  EC opened infringement procedures against 23 Member States for missed transposition.
• SEC Cybersecurity Disclosure Final Rule (Release No. 33-11216)
  https://www.sec.gov/files/rules/final/2023/33-11216.pdf
  The source of the 4-business-day incident disclosure requirement (Item 1.05).
• SEC Fact Sheet — Public Company Cybersecurity Disclosures
  https://www.sec.gov/files/33-11216-fact-sheet.pdf
  Plain-English summary for directors and GC/IR.

Identity Threat Detection & Response (ITDR)

• Microsoft: Identity Threat Detection & Response (Overview)
  https://www.microsoft.com/en-us/security/business/solutions/identity-threat-detection-response
  High-level overview of ITDR.
• Microsoft Learn — Defender for Identity: ITDR Dashboard
  https://learn.microsoft.com/en-us/defender-for-identity/ops-guide/ops-guide-daily
  How teams operationalize detections and MTTR.
• Microsoft Learn — What is Defender for Identity?
  https://learn.microsoft.com/en-us/defender-for-identity/what-is
  Productized ITDR capabilities and scope.

SaaS Sprawl & App Portfolios

• Okta: Businesses at Work 2025
  https://www.okta.com/reports/businesses-at-work/
  App usage trends and average app counts by org size.
• Zylo: 2025 SaaS Management Index
  https://zylo.com/resources/guides/saas-management-index-2025/
  Portfolio size, category growth, and license utilization benchmarks.
• Torii Research (2025) (internal)
  Enterprise portfolios average ~1,850 apps. Contact Torii for methodology and briefing deck.

Machine / Non-Human Identities

CyberArk 2025 Identity Security Landscape
https://www.cyberark.com/resources/analyst-research/2025-identity-security-landscape
Source of the “machine identities outnumber humans 82:1” statistic.

The best moments at Oktane rarely happen on a slide. They occur in the in-between: the coffee line, a quick chat on the expo floor, a dinner table where notes turn into next steps.

If you’re heading to Las Vegas, plan as deliberately for your conversations as you do for your sessions. Who do you want to meet? What problems are you trying to solve? A bit of intention turns “nice to meet you” into “let’s ship this.”

To help, we put together a simple guide that maps the most useful meetups and mixers around the conference. Use it to stack your evenings with high-signal chats, compare notes with peers, and come home with contacts and commitments you’ll actually use.

And while you're at Oktane, be sure to swing by Torii at Booth S8 for a quick demo and a real conversation about cutting SaaS waste, tightening access, and cleaning up renewals. We’ll be there with practical ideas (and yes, daily Star Wars LEGO raffles).

See you at Oktane 👋

Related reading:

• 30% of Licenses Are Idle—Here’’s How to Fix It

Identity, application, and access sprawl all stem from the same problem: we can only control what we can see. It’s a familiar challenge, and it’s why we founded Torii in 2017.

Visibility built on purchase orders and official onboarding overlooked shadow apps, emerging AI tools, and the actual ways people work. That’s why Torii was built differently from other platforms. Rather than relying solely on the SSO to tell the story, we sifted through the shadow apps at the edges of a company’s ecosystem—the tools that dominated usage while remaining invisible to IT, procurement, and SecOps.

And it worked.

We uncovered orphaned accounts, role creep, and idle licenses that had been completely hidden from SecOps.

We know this because our discovery numbers revealed that most tools were drastically underestimating the reality. Per Okta in 2024: “The average number of apps deployed by organizations… we’re seeing a jump to 93 this year. Large companies with ≥ 2000 employees lead the way, with an impressive average of 231 apps each.” - source

By contrast, our SaaS Benchmarks Annual Report found an average of 668 apps (7x Okta’s estimate), with large organizations (2,000–5,000 employees) averaging 1,474 apps.

This discrepancy isn’t an accident; it’s a testament to the importance of discovery based on usage, not just sanctioned approvals.

That’s long been the limitation of IGA vendors: they start with policies and approvals, but policies can only govern what’s visible. Torii began with discovery because we knew blind spots were the greatest risk. Years later, that focus has proven correct: in a SaaS-driven world, governance built on visibility and automation is the only way to keep pace with the rapid rate of change.

The Next Acceleration

Today, identity management is more complex than ever. AI agents are multiplying machine identities (non-human identities, or NHIs) at an alarming rate. Service accounts, API keys, and bots now outnumber humans 80:1. And if you can’t spot them, you can’t govern them — and you can’t offboard them. In this world, visibility isn’t “nice to have.” It’s step zero.

I’ve spoken with countless security leaders who feel the pain of the legacy IGA dilemma. One CISO put it bluntly:

“I always have to rerun my quarterly reviews. Every time. We keep finding apps the IGA never knew existed. I can’t delegate sign-off when I don’t trust the inventory list, so my team babysits the process, and onboarding time suffers. We don’t need more forms. We need a higher standard of discovery.”

At Torii, we’re dedicating our discovery engine to enhancing visibility and control across identity, governance, and access.

The Future State of Identity

The next wave of identity governance won’t be built on forms, approvals, or quarterly attestations. It will be built on:

• Automatic data ingestion
• Real-time shadow IT discovery
• Cross-system automation
• Predictive and prescriptive analytics

In this world, every identity—human and machine—must be visible the moment it comes into existence. Governance must be continuous and cross-platform, and machine identities must be treated with the same rigor as human ones.

Legacy IGA platforms are still playing catch-up. They provide permissions and insights based on SSO logs, rather than predicting actions and preventing threats in the face of continuously sprawling identities.

Wholistic Visibility, Automated Control

At the end of the day, visibility without control is useless, and control without visibility is blind. The future isn’t about adding another dashboard or checkbox. It’s about uniting both halves of the equation: seeing everything and acting with confidence.

The rise of AI and non-human identities has made this shift unavoidable. You can’t govern what you can’t see, and you can’t prove what you can’t automate. That’s why we’re building the first platform where discovery and governance live side by side.

That’s what we’ve built at Torii — and what we’ll continue to build — because your team deserves a tool that can keep up with your organization, no matter what the future holds.

If you make decisions about software—whether you’re in IT, finance, procurement, ops, or security—you don’t need more hype. You need a clear read on what people actually use inside real companies. That’s why we built Torii Research.

Check out toriiresearch.com

Starting today, we publish monthly, live rankings of workplace apps based on anonymized usage across hundreds of organizations.

No surveys. No vendor spin. Just signals you can trust.

Why Torii Research?

Buying software today is noisy. Vendors promote. Surveys lag. Opinions conflict. Meanwhile, your stack changes week to week, and “shadow” tools appear before anyone files a ticket.

Torii Research cuts through the noise. We show adoption patterns as they happen, so teams can:

• Spot apps that are spreading fast (and decide whether to lean in or rein them in).
• Compare categories month over month to see what’s rising or slowing.
• Prep renewals and evaluations with evidence, not guesswork.

What we publish each month

Under the App Adoption Index umbrella, you’ll find four reports:

• Adoption Index Report: This monthly report ranks the top 20 applications every month as measured by the number of orgs adopting the application. Each app is compared against a 12-month rolling average, so you see who’s truly outperforming the trend—not just having a one-off spike.

• Viral App Radar Report: This is an annual report that shows the fastest-growing apps inside companies. We combine the number of organizations that have the app, its growth rate within each organization, and a shadow-IT factor into a single score. Details live on the Methodology page.

• AI Breakout Report: The AI tools gaining real traction now. Expect churn here—new entrants appear often as teams try fresh models, agents, and workflows.

• Shadow IT Index Report: Which tools are most often discovered outside sanctioned SSO/procurement flows. We normalize for well-known staples (e.g., AWS, Slack) so the ranking highlights true outliers, not detection quirks.

Aggregated, Anonymized, and Real-World

Anonymized by design. Our analyses use de-identified, aggregated data only. No customer, account, user, or organization is ever identified or linkable in what we analyze or publish.

No account association—ever. Nothing in the Index ties usage back to any specific customer environment. We publish aggregate ranks, counts, and percentages, not customer- or user-level records.

Real usage, not surveys. Signals come from anonymized workplace activity across hundreds of stacks, giving a clearer read than opinions or vendor claims.

Rolling context. Where possible, we benchmark results against a 12-month rolling average to separate durable trends from one-off spikes.

Read the details: Methodology & FAQ.

Who this helps

• IT & Security: See what’s entering the stack before it becomes risk.
• Finance & Procurement: Prioritize renewals and negotiations with adoption facts.
• Ops & Team Leads: Understand what your people actually use to get work done.

What to look for this month

We’re kicking off with a broad view across categories—adoption, virality, shadow IT, and AI. If you’re tracking AI specifically, watch the AI Breakout Report for fresh entrants and fast movers; new names can show up quickly as teams experiment and operationalize workflows.

What’s next

We publish new rankings the first week of every month. Each drop includes highlights, charts, and links back to the full dataset and methodology.

• Explore the live Index: toriiresearch.com
• Get the monthly drop in your inbox: Subscribe on the site
• Press or research partner? Contact John Baker (john.baker@toriihq.com) to talk about early embargo access.

Torii Research exists for one reason: to make SaaS decisions clearer with real usage not opinions. Let’s measure what matters.

Related reading:

• Introducing the Torii CLI

Torii was born from a problem. Software was shifting to the cloud, and companies were not ready for the transition. The growth of SaaS meant that employees were adding new apps at record speed without the approval of procurement. These unsanctioned apps (shadow IT) were adding tasks to already overworked IT teams. Onboarding, offboarding, spend management, and more, these legacy processes broke down under the weight of SaaS “busywork.” That’s why Torii was born. To address the problem at the heart of everything—unmanaged applications. 

I experienced the headaches firsthand. My background in leadership and entrepreneurship meant that I was always testing new apps and dealing with the consequences, especially with a lean team. The systemic issues were painful, and manual management was impossible. That was when I realized that the only way out of the mess was through a unifying technology, one software designed to allow IT to see, manage, and automate all the software in their ecosystem. That was when I resolved to build Torii.

Why “SaaS Management” mattered

In 2016, my co-founders, Tal and Uri, and I spent weeks discussing the symptoms of managing SaaS. 

• Wasted money
• Security risks
• Broken operations
• Bad employee experience

The issue was that different teams within an organization had different priorities, and we had to decide if we would focus on a subset of issues or stick to our original vision of “one software to manage all software.” We weren’t the only team working on this either. Many vendors, some which are still around, were also trying to tackle the problem of SaaS Management by addressing specific symptoms. 

A Slack exchange between me and my co-founders about how to pitch the idea of Torii to investors. This was when we started to identify SaaS Management as the “north star” of the solution. 

After hundreds of conversations with IT leaders, founders, and technologists—we doubled down on SaaS Management. That decision felt risky at the time. We were focusing on unmanaged apps, a problem that many organizations weren’t aware of instead of the more obvious symptoms of spend and security. 

I thought about it like this. If I were a doctor and someone came into my office complaining of a series of symptoms that all sprung up at the same time—what would be my duty? I could prescribe a host of medicines to address each individual symptom or I could do the hard work of finding the underlying source of the symptoms. In our mind, this was the only way to proceed. But, this meant that we had to build our platform on a foundation of accurate data and robust automation and in order for that to work, we needed to focus on organizations with a large number of cloud apps. 

From nice to have to necessity

In 2020, everything turned upside down. The pandemic struck, putting us on lockdown, and challenging companies to rethink what the workplace was. As knowledge workers stayed home, companies started adding more and more SaaS apps to their ecosystem and overnight, cloud apps went from “nice to have” to a necessity. As SaaS became the new default form of software, the management of those apps became necessary as well. Companies pushed legacy processes around budgets, procurement, and security to the side as they focused on survival at any cost. Even today, we are still dealing with the consequences of that era, organizations are still rationalizing their apps, license seats, and contracts. 

As these changes rippled through the modern workplace, I&O leaders began to look for insight and guidance about the implementation of a SaaS Management Platform. 

SaaS Management today

In August of 2025, Gartner® published its Magic Quadrant™️ for SaaS Management Platforms which recognized Torii as a Leader. The report encourages I&O leaders to manage SaaS apps to mitigate common [problems](/blog/saas-management-for-todays-enterprise). From the report: 

“SaaS management platforms empower organizations to address the compounding challenges of SaaS application usage across the business that lead to overspend, elevated risk, lack of visibility and contract sprawl. This inaugural Magic Quadrant helps I&O leaders identify suitable vendors.”

The average organization has over 600 apps in its organization, most of which are shadow IT. Without a way to centrally manage SaaS, problems will get worse, not better. According to the Report: 

• "Through 2027, organizations that fail to centrally manage SaaS life cycles will remain five
  times more susceptible to a cyberincident or data loss, due to incomplete visibility into
  SaaS usage and configuration."
• "Through 2027, organizations that fail to attain centralized visibility and coordinate SaaS
  life cycles will overspend on SaaS by at least 25%, due to unused entitlements and
  unnecessary, overlapping tools."
• "Through 2028, over 70% of organizations will centralize SaaS application management
  using a SaaS management platform (SMP), an increase from less than 30% in 2025."

Next Steps: Adopt an SMP that is right for you

The journey of building a SaaS Management Platform like Torii has been both challenging and rewarding. It started as a solution to a hidden problem. But today, Torii is a crucial component of modern IT infrastructure. We believe the recognition of Torii as a Leader in the Gartner Magic [Quadrant for SaaS Management](/blog/torii-named-a-leader-in-first-ever-gartner-magic-quadrant-for-saas-management-platforms) Platforms validates our decision eight years ago to address the root cause of issues like overspend, security risks, and lack of visibility—unmanaged SaaS applications.

But for you, the most crucial step is the next one. 

SaaS Management is no longer optional. The best time to manage your cloud apps was years ago, but the second best time is now. If you’re ready to take the next step and learn about the SMPs available, you can get a complimentary copy of the Gartner Magic Quadrant. It’s full of excellent analysis and unbiased evaluation of vendors in the space.

Gartner, Magic Quadrant for SaaS Management Platforms, Tom Cipolla, et al, 30 July 2025. GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, and MAGIC QUADRANT is a registered trademark of Gartner, Inc. and/or its affiliates and are used herein with permission. All rights reserved.
Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from Torii.

Related reading:

• Busting The 4 Big Myths About IT Management
• What is IT Management?