The $127K Hidden SaaS Bill: What Your IT Team Doesn’t Know Is Costing You

Originally published in 2025, when SaaSVista focused on shadow SaaS discovery. Edited and republished in October 2026.

Ask a finance lead what the company spends on software and you’ll get a confident number. There are contracts. There are invoices. There’s a budget line with an owner’s name on it.

Now ask a different question. How much software does the company pay for that never touched that budget line?

That one usually gets a pause.

I’ve spent 30 years in IT security and infrastructure, and that pause is the whole story. The number on the budget line is real. It’s just not the whole bill.

---

Where the $127K Comes From

Let me be upfront about the headline. The $127K is an illustration. It isn’t a measurement, it isn’t a survey result, and it isn’t a customer. It’s a scenario I built to show how the arithmetic works.

Picture a 380-person company. Finance believes it spends about $400,000 a year on software, because that’s what the contracts and invoices add up to.

Now suppose roughly another third sits where finance doesn’t look for software. Expense reports. Corporate cards. Departmental budgets coded as “marketing services” or “office supplies.”

Here’s the math:

• Known software spend: $400,000 a year
• Untracked spend at about 32 percent of that: $127,000 a year
• Actual total: $527,000 a year

Spread across 380 people, $127,000 works out to about $334 per person per year. That’s roughly $28 a month each.

That last line is why I find the scenario believable. Nobody has to do anything reckless. One design tool here, one note-taker there, a team plan for a whiteboard app that four people use. $28 a month per head doesn’t feel like a problem to anyone. It only looks like one when you add it up.

Your number will be different. It might be much smaller. The point is that you probably don’t know what it is, and “we don’t know” is a hard answer to give an auditor or a board.

---

How We Got Here

Software buying changed. Governance mostly didn’t.

Buying software got easy

Enterprise software used to be ugly, expensive, and impossible to buy without a sales call and a purchase order. That friction was annoying, and it was also a control. IT knew about every tool because IT had to install it.

Today a marketing manager can sign up for a design tool before the morning standup. There’s nothing to install and no one to ask. The same ease that makes these tools good also routes them around every checkpoint you have.

Everyone has a card

Purchasing power spread out. Departments carry their own cards. Individual employees expense subscriptions. Some tools get reimbursed, some get buried in a team budget, some ride along on a manager’s card for years.

Each of those is a separate paper trail. None of them rolls up to the place where someone tracks software.

The trial that never ended

“Start free, upgrade later” is how most SaaS gets sold now. People sign up with good intentions. Then one of these happens:

• The trial converts to paid and nobody cancels it
• The person who signed up leaves, and the subscription keeps billing
• Someone upgrades to a team plan to add two colleagues
• A second team signs up for the same product without knowing the first one exists

No single one of these is a scandal. Together they’re how a company ends up paying for the same category of tool several times over.

---

The Costs That Don’t Show Up as Dollars

The wasted spend is the part that gets a CFO’s attention. In my experience it’s the smallest part of the problem.

Security

You can’t protect an application you don’t know about. Tools adopted outside IT rarely sit behind single sign-on, so they miss your MFA policy and your offboarding process. When someone leaves, their company account gets disabled. Their login to the tool they signed up for with a password stays live.

Then there’s the data. Customer lists in a personal file-sharing account. Financials in a spreadsheet tool nobody vetted. API keys pasted into a developer utility. And OAuth grants, where an employee clicks “Allow” and hands a third-party app standing access to mail, calendar, or files.

Compliance

GDPR, CCPA, SOX, HIPAA. Pick the one that applies to you. They all assume you know where regulated data lives and who can reach it.

An unknown tool breaks that assumption quietly. There’s no signed data processing agreement. There’s no audit trail you can produce. Retention policies don’t apply to a system that isn’t on your list. You find out when a customer’s security questionnaire asks for your subprocessor list and the honest answer is longer than the one you have.

Productivity

Duplicate tools cost time as well as money. Two teams run projects in two different trackers and can’t see each other’s work. New hires have to learn which tool is the real one. IT gets tickets for products it never approved and can’t administer.

---

The Discovery Playbook

You don’t need to buy anything to get a first answer. You need a few weeks, read access to systems you already own, and a spreadsheet.

Start by assuming you’re wrong

Whatever list of applications IT maintains, treat it as a floor. I’m not criticizing anyone’s work. It’s just how the buying works now. Most of the tools on the missing list were adopted by reasonable people trying to do their jobs.

Follow the sign-ins

Your identity provider is the richest source you have. Okta, Microsoft Entra ID, Google Workspace, whichever one you run. Look for:

• OAuth grants to third-party apps, and the scopes each one holds
• “Sign in with Google” or “Sign in with Microsoft” activity for apps IT never set up
• SAML apps that someone configured and nobody documented
• Clusters of new sign-ins inside one department, which usually means a team just adopted something

Pay attention to scopes. An app that can read all mail is a different conversation than one that only sees a name and an email address.

Follow the money

Finance data catches what the identity provider misses, especially tools people log into with a separate password.

• Expense reports with recurring software charges
• Corporate card statements, sorted by merchant
• Accounts payable records for vendors nobody in IT recognizes
• Reimbursements that repeat every month for the same amount

Search descriptions for words like “subscription,” “monthly,” “annual,” “license,” and “seats.” Recurring charges of the same amount are the giveaway.

Check the network

Network and endpoint data fills in what’s left. DNS logs show which SaaS domains your people reach. Endpoint management shows installed desktop clients and browser extensions. Mobile device management does the same for phones.

This source is noisier than the other two. Use it to confirm and fill gaps, not as your starting point.

Build one list

Merge everything into a single inventory. For each application, capture the owner, the cost, the number of active users, whether it’s behind SSO, and what kind of data it holds.

Then sort it two ways. Once by cost, to find duplicates and unused seats. Once by data sensitivity, to find the risks. The two lists won’t have the same top ten, and you need both.

---

Your 30-Day Plan

Week 1: Find it

Pull the OAuth grants and sign-in logs from your identity provider. Ask finance for twelve months of card and expense data. Merge them into one inventory. Don’t fix anything yet. Just count.

Week 2: Take the easy wins

Cancel subscriptions with no active users. Where two teams pay for the same product separately, combine them onto one contract. Reclaim seats assigned to people who’ve left. Set calendar reminders for auto-renewals coming up in the next quarter.

Week 3: Reduce the risk

Go down the sensitivity list. Put the important tools behind SSO. Revoke OAuth grants with broad scopes that nobody can justify. For every tool holding customer or regulated data, write down what’s in it and who owns it.

Week 4: Make it stick

A one-time cleanup decays in months. Set up a lightweight way to request a new tool, and make it fast, because a slow process is how you got here. Publish a short list of approved options for the common categories. Review new OAuth grants on a schedule. Give department heads their own team’s list and ask them to own it.

---

The Bottom Line

Shadow SaaS isn’t a story about careless employees. It’s what happens when buying gets easy and visibility doesn’t keep up. People solve the problem in front of them with the tool that’s one click away.

The fix isn’t to lock everything down. It’s to know what you have, decide what matters, and make the approved path faster than the workaround.

And if this pattern sounds familiar, it should. The same thing is happening with AI right now. Teams adopt models, SDKs, and AI features the same way they adopted SaaS tools, one reasonable decision at a time, and the inventory lags behind. The first question is the same one too. What are we running, and where does our data go?

See how SaaSVista approaches AI governance today →