Get a personalized demo

Built for cybersecurity and security software teams, from public regulatory sources and our own anonymised discovery data. How this works

Cybersecurity & security software

You secure everyone else.
Start with your own stack.

Torii discovers every SaaS and AI application your teams sign up for, including the ones bought on a card or running a free tier. For a company that sells trust, shadow IT and unmanaged AI are the gap you can least afford. Torii finds 878 apps on average, 58% of them shadow IT.*

See what's actually running

Read-only. Two weeks. No endpoint agent.

*Torii internal discovery data, January to December 2025. Methodology.

app.torii.com / ai / dashboard
AI spend overview Last 30 days · all teams · all models 30d TOTAL SPEND $148,402 ▲ 18% vs prev TOKENS · 30D 412M ▲ 24% vs prev ACTIVE USERS 1,284 ▼ 3% inactive seats Spend by model USD · weekly Claude Gemini Codex 60k 40k 20k 0 +$8.4k spike W1W2 W3W4 W5W6 W7W8 Top users M. Chen $4.1k L. Park $3.2k A. Singh $2.8k D. Ruiz $2.1k By team 12 Eng · 48% Sales · 27% Mktg · 15% Other · 10%
$148,402
30-day AI spend
1,284 users
attributed to a model
+$8.4k spike
in Codex · Eng team

Security and infrastructure companies running Torii

[NEED: customer quote]
[NEED: quote author] [NEED: quote author name] [NEED: quote author title & company]

Where your money actually goes

Three places, and only one of them shows up in your spend report.

Licenses nobody used

You pay for entitlements collecting dust. Too many licenses go untouched, but without usage data, that waste stays hidden.

Source: Torii 2026 SaaS Benchmark, annual report

AI nobody budgeted

AI consumption cost is the expense you never saw coming. Now you're scrambling to build a plan without data.

Source: Torii 2026 SaaS Benchmark, year-over-year AI spend

Seats nobody offboarded

Every departure should close every account. It rarely does. You keep paying for the seats, and the access stays open behind them.

2.5% of licence seats are still assigned to people who have left the company

Source: Torii 2026 SaaS Benchmark, annual report

Don’t overlook the cost of compliance.

Your customers audit you before they buy.
The evidence starts with one list.

[NEED: framework 1 + clause]

[NEED: effective / applies-since date]

[NEED: verbatim requirement, quoting the source, tied to the app/vendor inventory]

Primary source →

[NEED: framework 2 + clause]

[NEED: effective / applies-since date]

[NEED: verbatim requirement, quoting the source, tied to the app/vendor inventory]

Primary source →

[NEED: framework 3 + clause]

[NEED: effective / applies-since date]

[NEED: verbatim requirement, quoting the source, tied to the app/vendor inventory]

Primary source →

What they all actually ask for

Shared by all of them: a complete, current list of every third-party application and service in use, and what regulated or customer data each one touches.

[NEED: one line per framework above naming the extra fields it requires, e.g. owner, data classification, access list, subprocessor disclosure — from your compliance team]

None of these start with a policy. They all start with a list, and the list is the part nobody has.

Torii produces and maintains that list. It does not write your attestation or fill your audit workbook. It gives you the inventory those artefacts are built from, with an owner and a data classification per application, and keeps it current in the months between audits.

Torii’s discovery finds what others miss

[NEED]apps [NEED: average apps per company for security/software companies, with its delta vs the 878 all-industry average, from Torii data.]
[NEED]shadow IT [NEED: shadow-IT rate for the vertical, with its delta vs the 58% all-industry average, from Torii data.]
26of the top 50 of the most widely adopted shadow applications are pure-play AI tools.
403days median time an unauthorised AI tool runs before anyone detects it. Cloud Security Alliance, 2026.

From Torii’s 2026 SaaS Benchmark, based on discovery between January and December 2025. We count applications found through browser activity, OAuth grants and direct sign-ups — not only those visible in spend or SSO — which is why these figures run higher than licence-based benchmarks.

Start with discovery, not policy

  1. Two weeks

    Read-only discovery across browser activity, OAuth grants and direct sign-ups. No agent on endpoints, no policy change, no announcement to staff.

  2. One week

    You get the inventory with an owner and a data classification per application, plus the overlap map. This is the artefact your auditors and your customers' security reviews both draw from.

  3. Then decide

    Sanction, consolidate or retire — with the register as the input to that decision rather than the output of a survey.

Why not start from SSO or your CASB?
Both give a clean view of what was federated. They miss direct sign-ups with a corporate email and OAuth grants against personal accounts — which is where most AI tools enter.
Why not start from spend?
A finance-led view is the fastest to assemble and structurally undercounts: free tiers, freemium AI tools and anything expensed rather than invoiced.
Why not just run the annual survey again?
Because it is stale the day it closes — and because unauthorised AI tools stay active for a median of 403 days before anyone detects them (Cloud Security Alliance, aggregating vendor telemetry).

You’re in control of the process

Here’s what we promise.

Start a free pilot project

We’ll get you up and running with a pilot project so you can verify results before signing a contract.

Stop the pilot at any point

Two weeks, read-only, no endpoint agent, no change to user-facing systems. Nothing to unwind if you walk away.

Exit terms in writing, up front

Data deletion certified on termination, the same standard your own customers hold you to in a vendor security review.

What we typically find at your size

FY26 model
Employees
57,000 Enterprise
Estimated seat spend $56M
Apps we typically discover 3,575

Estimated annual recovery

$11M–$16M ≈24%

Licence waste we would expect to surface in the first two weeks of discovery.

+3,560

15 you would name. The other 3,560 is where most of the recovery hides.

See the detail The three biggest lines, plus the AI spend

Likely candidates in your stack

AI spend — not counted in the figure above

$2.5M across 3 vendors, with no single total

This is not waste and we’re not proposing you cut it. It’s the spend most likely to be running across several vendors at once, on consumption pricing, with no single owner and no single total.

How the number is built
  1. Headcount × a typical attach rate per application — the share of people who actually hold a paid seat.
  2. Costed at published list price, then discounted on a curve that steepens with company size.
  3. Grossed up for the long tail — the applications behind the +N pill — which is a bigger share of spend the larger you get.
  4. Cloud and AI are excluded from the recovery figure. You can’t reclaim a seat that was never a seat.
  5. A recovery rate per application — higher where a tool overlaps something you already own, lower where licensing is per-worker.
Find your actual number in two weeks

A model, not a measurement. Built from published list pricing and typical attach rates, August 2026. Application names and logos are likely candidates in an estate of this size — not claims about any vendor, and no vendor endorsement is implied. Real discovery differs in both directions.

Book a 30-minute discovery review

Pick your company size and drop your work email — we’ll match you with the right rep and send times that work.

Rachel Castan Rachel Castan Account Executive

Here’s what’s next

  1. You pick a time that works for you.

  2. You have a 30-minute call with Rachel — get every question answered, see if it’s a good fit, and if so, map out a plan together.

  3. Initiate a pilot project on your terms.

You get an inventory extract afterwards — whether or not you continue.

Book a 30-minute review