The vendor knew before IT did: What SaaS usage really looks like in 2026

TL;DR

• The visibility gap now sits between IT, employees, and vendors. Vendors running product-led growth motions often have better adoption data than the customer’s own IT systems. 

• Shadow AI has become a distinct category. More than half of employees use AI tools outside IT’s view, creating governance and compliance exposure. 

• Continuous, automated discovery across SaaS, on-prem, and cloud is the baseline for regaining control. Periodic audits can’t keep pace with how software enters organizations today. 

• Adoption signals are strategic intelligence. Organizations that detect usage early can govern, negotiate, and optimize before the vendor initiates the conversation.

The new reality of SaaS usage

Most organizations believe they have a decent grip on their software estate. They track contracts, review invoices, monitor renewals, and maintain approved application lists. On paper, that should create visibility. In practice, it often doesn’t. 

One of the most revealing moments in our recent discussions around the Q1 2026 SaaS Report was a simple but uncomfortable example: an organization believed it had roughly 1,500 users of a given application. Then the vendor reached out and asked whether they wanted to address the thousands of additional accounts from the same organization that were already registered with company email addresses. 

That’s the new reality of SaaS. The way software enters organizations has fundamentally changed. Employees don’t wait for procurement cycles. They sign up, start using, and only surface the tool to IT when they need a budget or an integration. By that point, the vendor already knows more about adoption inside the organization than IT does. 

This article breaks down why that visibility gap is widening, what the data shows, and what IT and SAM leaders should do about it. 

The old procurement model is disappearing

For decades, software acquisition followed a predictable sequence: identify a need, evaluate vendors, negotiate a contract, deploy. IT controlled the pipeline. Procurement controlled the spend. Every application had an owner before it had a user. 

That sequence has reversed.  

Today, 58% of B2B SaaS companies operate some form of product-led growth motion¹. Users sign up with a corporate email, start working, and the tool spreads through teams before anyone in IT or procurement is aware it exists. AI coding assistants, design tools, collaboration platforms, browser extensions… these categories don’t wait for an RFP. 

Gartner predicts that by 2027, 75% of employees will acquire, modify, or create technology outside IT’s oversight². That’s up from 41% in 2022.  

The implication for SAM and IT governance is obvious: by the time a tool appears in a procurement request, it’s already embedded in workflows, integrated with corporate data, and generating usage patterns the vendor tracks closely. Discovery that starts at the contract level is already months behind reality. 

Shadow IT has become shadow AI

The scale is no longer marginal

Shadow IT used to mean a handful of rogue spreadsheets or an unsanctioned project management tool. The scale today is different: 

• 55% of employees adopt SaaS applications without security’s involvement.³

• 39% of EMEA employees use free AI tools at work, and another 17% pay for AI tools out of their own pocket.⁴ 

• Only 23% of organizations report full visibility into their SaaS applications.⁵ 

That 39% + 17% figure from IDC is worth pausing on. It means 56% of employees are using AI tools that IT has no line of sight into.  

In the Q1 2026 report, this pattern clearly shows up in the user-led category. Tools such as Google Drive, Canva, Miro, and DeepL continue to show meaningful adoption and engagement.  

These aren’t experimental side projects, but daily productivity tools processing corporate data.

The governance blindspots

The questions that shadow AI raises go beyond licensing: 

• Where is corporate data being stored and processed? 

• Which identities (personal or corporate) are tied to these accounts? 

• What happens when an employee leaves and their personal AI subscription holds company data? 

• Which AI tools have access to internal code repositories, customer data, or financial models? 

Traditional SAM tools weren’t built to answer these questions. They were designed for a world where software had a license key and an install path. When adoption is browser-based and identity-driven, the discovery challenge is fundamentally different.

The real risk is information asymmetry

Vendors see adoption before customers do

The most important lesson from the “1,500 users vs thousands more accounts” story is that the vendor had better visibility into account-level reality than the customer did. 

That should concern every CIO, IT leader, SAM team, and security leader. 

Consider Cursor, the AI coding assistant that reached $2 billion in annual recurring revenue by February 2026⁶, without a dedicated enterprise sales team until well past $200 million. Cursor didn’t need enterprise sales. Individual developers signed up, used it daily, and the usage data told Cursor exactly which companies had deep adoption before those companies’ IT departments knew Cursor existed. 

That pattern repeats across categories. The vendor’s CRM contains more accurate adoption data about your organization than your own asset management systems do. 

The power dynamic shifts

This information gap doesn’t just create a visibility problem. It shifts the negotiation dynamic. 

When a vendor approaches for an enterprise agreement, they already know how many users are active, how dependent those users have become, and what the switching cost looks like. The customer, meanwhile, may be learning about the tool’s presence for the first time. 

This isn’t just about the cost. It’s a strategy problem. Organizations negotiating renewals without accurate usage data are negotiating blind.

Why this is accelerating now

Several structural forces are converging, and they reinforce each other. 

Frictionless adoption has become the default. The average organization runs 106 SaaS applications⁷. Adding one more requires nothing more than a browser and a corporate email address. There’s no installation, no deployment, no infrastructure request. The barrier to entry is effectively zero. 

Software spreads socially, not contractually. Tools are designed to spread through teams organically. One developer tries an AI assistant. Three more adopt it within a week. A month later, the entire engineering team depends on it. Adoption follows behavior, not purchasing authority. 

AI is acting as an accelerant. AI tools are entering organizations faster than any previous software category because they deliver immediate individual productivity gains. Employees don’t need permission to be more productive. 

Consumption-based pricing hides cost until it’s too late. Unlike per-seat licensing, consumption models bill based on actual usage. When employees use AI tools that charge per API call, per query, or per gigabyte processed, costs scale without any procurement decision. The invoice arrives after the spend is already committed. 

These are structural changes in how software is built, distributed, and adopted. Any governance approach that depends on procurement as the point of control will continue to fall further behind.

What leaders should do next

Build continuous discovery

Quarterly software audits were designed for a world where the software estate changed slowly. That world is gone. 

Continuous, automated discovery across SaaS, on-prem, and cloud environments is now a baseline requirement. Organizations need to see what’s actually being used, not just what was purchased or provisioned. That means watching for corporate identities appearing in unmanaged tools, tracking browser-based application usage, and identifying AI tools processing corporate data.

Treat adoption signals as intelligence

When employees adopt a tool outside IT’s view, that’s a signal, not just a violation. It tells you something about unmet needs, workflow gaps, and where productivity pressure is highest. 

The most effective IT and SAM leaders are moving from a detection-and-block posture to a detection-policy-procurement-enablement cycle. When shadow usage reveals a tool that’s become business-critical, the response should be to govern it. Negotiate proper terms, ensure compliance, and bring it into the managed estate. Not to shut it down and create friction. 

Vendor-side adoption data, once surfaced, becomes strategic intelligence for procurement negotiations, budget planning, and technology roadmap decisions.

Close the gap before the vendor does

If your visibility into software usage starts with contracts and purchase orders, you’re looking at a lagging indicator. The vendor already knows what’s happening inside your organization. The question is whether you do. 

Organizations that discover usage automatically, through continuous scanning and identity-based detection, can respond within days. They can negotiate from a position of knowledge rather than surprise. They can identify compliance exposure before it becomes a breach, and they can right-size licenses before the renewal conversation starts. 

23% of data breaches are caused by IT failures⁸, including gaps created by unmanaged applications. Closing the visibility gap is a security and compliance imperative.

The real software estate is behavioral

The software estate that lives in your contracts is not the software estate your employees use every day. The gap between those two realities is where AI tools spread unchecked and browser extensions capture corporate data without oversight. It’s also where vendors build more accurate pictures of your organization than your own asset management systems can provide. 

That gap is closing, but only for organizations that treat software discovery as a continuous, automated discipline rather than a periodic audit.  

The vendors already have the data. Organizations that close this visibility gap negotiate from a position of knowledge. Those that don’t negotiate blind.

Want to go deeper?

The shift from shadow IT to shadow AI is something SAM practitioners are dealing with in the field right now.  

In episode 2 of The Software Reality Check podcast, Joel Sanderi sat down with May Turnbull (SAM Assured) and Alexander Golev (SAMexpert) to discuss the governance gaps, the unpredictable costs of token-based licensing, and why visibility is the first problem organizations need to solve before anything else can follow. 

Listen to the conversation here

Ready to see what’s actually running across your organization?  

Book a demo to learn how Xensam delivers continuous software discovery across SaaS, on-prem, and cloud, so you can close the visibility gap before your next renewal.