How SaaS Management Tools Actually Find Your Apps — and What Each Method Can't See

The Short Answer

SaaS management platforms find applications through six signals: identity/SSO logs, finance data, cards the platform issues itself, a browser extension, a credential vault, and device or network telemetry. Each one is blind to a specific and predictable class of application. A tool that reads only your finance systems cannot see anything free. A tool that reads only your identity provider cannot see anything nobody wired to it. A browser extension sees the free AI account the other two miss, and misses the desktop app they both catch on an invoice.

Which means the buying question is not "which platform discovers the most apps," a claim every vendor makes and none can substantiate for your estate. It is "where does my unknown spend actually hide, and which signal points there?" A company with 95% SSO coverage and sprawling card spend has a completely different answer from one with sixty invoices and an engineering team quietly running four AI subscriptions on personal cards.

The twelve platforms below all sit in our verified SaaS spend management directory, where each profile is researched from the vendor's own documentation and independently re-checked. We sell none of them. What follows is a comparison of documented discovery mechanisms, not a bake-off — we have not run all twelve against the same estate, and neither has anyone else publishing on this topic.

The Six Signals

Every discovery claim in this category reduces to one or more of these. Reading a vendor's integration list through this lens tells you more in two minutes than a demo does in forty.

1. Identity provider and SSO logs. Read authentication events from Entra ID, Okta, Google Workspace or OneLogin. Gives you access truth — who can get into what, who actually logged in, when they stopped. This is the only signal that natively answers dormancy, which is where most license savings live.

2. Finance systems. Read invoices from the ERP or AP system, card transactions, and expense-report line items. Gives you cost truth: a real dollar figure attached to a real vendor, including vendors nobody in IT has heard of. Zylo builds its entire discovery layer here, applying machine learning to ERP, accounts-payable and expense data.

3. Cards the platform issues. A variation on the finance signal with a twist: instead of reading someone else's card feed, the platform is the card. Cledara issues one virtual card per subscription, which turns discovery into a byproduct of payment and makes cancellation a button rather than a support ticket. Complete visibility into its own rail, zero into any other.

4. Browser extension. Watch what people actually open. This catches applications that generate no invoice and no SSO event — the entire free-tier and shadow-AI category — and gives genuine engagement data rather than seat counts.

5. Credential vault. The newest signal, and the least discussed. 1Password SaaS Manager discovers applications from credentials employees saved in the 1Password vault, alongside its browser extension and the usual identity and finance connectors. Employees save logins because it is convenient for them, not because IT asked — which makes the vault a rare place where shadow IT self-reports.

6. Device and network telemetry. MDM inventories, CASB, firewall logs, desktop agents. Sees installed software and outbound traffic regardless of who paid or who authenticated. The most complete signal and the most expensive to deploy, both technically and politically — agent rollouts and traffic inspection attract privacy and works-council scrutiny that a finance integration never does.

Which Platform Uses What

From each vendor's own documentation, as recorded in our directory listings. "Direct integrations" means app-by-app API connections, which are a delivery mechanism rather than a seventh signal — they enrich what the primary signals surface.

Two things jump out of that table. First, signal breadth and price transparency move in opposite directions. The platforms with a published number — Genuity at $39.99, Substly at €95, Josys at $100, Setyl from $300 — are the ones reading directories and integrations, which is the cheapest signal set to build and operate. The eight-signal platforms are all quote-only, because CASB and agent deployments are professional-services work priced per estate. That is a real trade and not a scandal, but it does mean a published price is partly a statement about coverage.

Second, two platforms in this set cost nothing at small scale — BetterCloud's Spend Optimization Basic tier and SpendHound, free outright for companies under 1,000 employees on a give-to-get benchmark model. Both are SSO-and-finance tools, so their blind spot is the free-tier and shadow-AI class. For a company whose actual problem is unknown invoices rather than unknown apps, that blind spot may not matter at all, and the correct budget for solving it is zero.

The Blind Spots, Stated Plainly

Nobody's marketing page has this column. It is the useful one.

The important asymmetry: identity and finance signals answer different questions, and most buyers only need one of them answered. Finance tells you what you are paying for. Identity tells you what is being used. If your renewal problem is "we keep discovering invoices," a finance-first platform solves it. If your problem is "we pay for 150 seats and I suspect 30 people use them," a finance-first platform will confirm the 150 and tell you nothing about the 30 — you need login data, and that is a different product.

Coverage Test: 220 People, 12 Apps

A 220-person B2B software company, Okta for identity, NetSuite for finance, corporate Amex cards issued to department heads, reimbursed expenses through Expensify. Twelve real line items, chosen because each one is invisible to at least one signal:

Now score four representative signal profiles. This is reasoning from documented mechanisms, not a lab test — but the mechanism is what determines the result, and the mechanisms are published.

Three conclusions the scores make hard to avoid.

The finance-only tool is not the weak one — it is the one that gets the dollars right. Zylo finds eight of twelve and is the only profile here that attaches a verified spend figure to every one of them, including the $2,400 API key. Its four misses are all zero-dollar items. If your board question is "what are we spending," an 8/12 that is right about money beats a 12/12 that is right about presence.

The browser extension earns its deployment by itself. Items 7, 8 and 9 — nine ChatGPT subscriptions on personal cards and two free AI tools in daily use — are worth roughly $2,160 a year in visible spend and rather more in data-governance exposure, and they are invisible to both classic signals. That is the entire argument for adding a usage signal, and it is a governance argument rather than a savings one.

Item 6 is the one that actually pays for the tool. 128 idle Miro seats is the largest recoverable number on the list, and finding it needs login data — a signal the cheapest tools have and the finance-first tools do not. The category's savings pitch is usually about discovery; the money is usually in dormancy.

Where Token-Billed AI Breaks Everything

Item 10 deserves its own section, because it breaks the assumption underneath every signal in this article: that an application is a subscription with seats.

A token-billed API has no seat count, so the identity signal has nothing to reconcile and the dormancy analysis has nothing to count. The finance signal sees one merchant line — a charge from a model provider — with no team, no project, no model and no per-key breakdown behind it. You know you spent $2,400. You do not know whether that was one runaway evaluation script or the production feature paying for itself, and the difference is the entire decision.

This is new enough that it splits the category cleanly, and several vendors have shipped for it specifically. 1Password SaaS Manager meters AI spend by team, user, model and API key and adds token budgets with burn-rate alerts. Torii runs an AI dashboard forecasting spend across tokens, agents and project ROI. Tropic tracks token usage by supplier, model, user and API key. CloudEagle sells AI governance as a distinct module covering shadow-AI detection and non-human identity management, and Zylo has added AI consumption tracking to its finance-first model.

The practical test for a 2026 shortlist is one question: can it tell you which team spent the tokens? A platform that reports AI spend as a vendor total has simply put your credit-card statement behind a nicer chart. Our percentage calculator does that much for free.

Two Questions That Pick Your Tool

Answer these before you take a single demo, because the answers eliminate most of the shortlist.

Question one: what fraction of your applications are already behind SSO? If it is high, your unknown is cost, not existence — buy the finance signal and stop paying for discovery breadth you will not use. If it is low, your identity provider is a partial map of a territory you have not surveyed, and a finance-first tool will inherit that same partiality with a dollar sign in front of it.

Question two: is your actual problem unknown spend, or unknown usage? These sound alike and have opposite answers. Unknown spend — surprise invoices, renewals nobody logged, department cards — is a finance-signal problem. Unknown usage — over-provisioned contracts, seats bought for a team that shrank, tools nobody opens — is an identity-signal problem. Buying the wrong one produces a beautiful dashboard that answers a question you did not have.

Then apply a deployment filter. Agent, CASB and network signals need device rollout, security review and in much of Europe a works-council conversation; if that is a six-month project in your organisation, an eight-signal platform is effectively a four-signal platform for the first two renewal cycles, and you should price it as one. A cheaper tool deployed in March beats a comprehensive one deployed in October when the renewals you are trying to catch fall in between.

Two closing notes on the shape of this market. It consolidates fast and it fails abruptly — the reasoning in our piece on Productiv's four-day shutdown applies directly here, since the tool that holds your renewal calendar is exactly the tool whose disappearance costs the most. And if what you actually want is someone to negotiate the contracts rather than inventory them, that is a different product with different economics, which we worked through in Tropic vs Vertice vs Spendflo.

FAQ

How do SaaS management platforms discover applications?

Through six signals, alone or combined: identity-provider and SSO logs, finance data (ERP, AP, expense reports, card feeds), payment cards the platform issues itself, a browser extension watching real usage, a credential vault of stored logins, and device or network telemetry from MDM, CASB, firewall logs or a desktop agent. The combination a vendor chose determines what it can never find.

Why can't SSO-based discovery find shadow IT?

An identity provider logs only applications someone connected to it. A free ChatGPT account, a Canva login on a personal email, or a team tool bought on a department card and never wired to Okta generates no SSO event at all. SSO logs are excellent at telling you who uses the apps you already know about — including which paid seats are dormant — and structurally incapable of surfacing apps nobody registered.

What does finance-based discovery miss?

Everything free, and everything about usage. It reads invoices, card charges and expense lines, so it finds any app somebody paid for whether or not IT knew — but a free tier generates no transaction, and an invoice proves you bought 150 Miro seats, not that 22 people opened one last quarter. It also lags: an annually invoiced tool is visible for one day a year.

Which platform uses the most discovery methods?

Zluri documents eight parallel methods — SSO/IdP, finance and expense systems, direct integrations, browser extensions for Chrome, Firefox and Edge, CASB, MDM, HRMS and directories — plus an optional desktop agent, matched against a catalog of over 240,000 applications. Breadth costs deployment: the CASB, MDM and agent signals need device-level rollout and, in several jurisdictions, privacy or works-council review.

Is there a free SaaS management tool?

Two in our verified set. SpendHound is free outright for companies with fewer than 1,000 employees, funded by contributing de-identified spend data to a shared benchmark pool, and includes negotiation support. BetterCloud offers a Spend Optimization Basic tier at $0. Both read SSO and finance signals, so both share the free-tier and shadow-AI blind spot.

How do you discover AI tools and token spend?

Token billing defeats both classic signals: no seat count for identity to reconcile, and one undifferentiated merchant charge in finance. Platforms that address it treat AI consumption as its own object — 1Password SaaS Manager breaks spend down by team, user, model and API key with token budgets and burn-rate alerts, and Torii, Tropic, CloudEagle and Zylo all publish some form of AI cost tracking. Ask whether it can attribute tokens to a team; a vendor-level total is your card statement with better typography.

Do I need a browser extension?

You need one if your unknown is free tools rather than unknown invoices. Along with a credential vault and network telemetry, it is the only signal that sees an application producing no payment and no SSO event — the exact shape of shadow AI adoption. It is blind to desktop and mobile apps and covers managed browsers only, so it complements a finance signal rather than replacing it.

Discovery mechanisms taken from each vendor's own published documentation and recorded in our verified directory listings, checked 20–24 August 2026. The coverage test reasons from those documented mechanisms against a constructed scenario; it is not a hands-on benchmark, and any vendor may extend its signal set. Third-party price figures are labelled as such.