{
  "slug": "third-party-saas-sprawl-risk",
  "title": "Third-Party SaaS Sprawl Risk Cost Calculator",
  "heading": "SaaS Sprawl Security Risk Cost Calculator",
  "category": "financial",
  "url": "https://www.revenuelab.fyi/toolbox/third-party-saas-sprawl-risk",
  "summary": "Estimate exposure and cleanup cost from unmanaged, unreviewed SaaS applications.",
  "description": "SaaS sprawl, meaning applications adopted by individual teams or employees without security review, procurement, or SSO integration, has become a leading source of shadow IT risk, with data showing the average mid-size company has 3-5x more SaaS apps in active use than IT/security actually knows about. Each unmanaged app is a potential data exfiltration point, an unmonitored access path that survives employee offboarding gaps, and a compliance blind spot if it touches regulated data. This calculator estimates total exposure by applying a per-app risk cost to your estimated shadow app count, then separately estimates the one-time cleanup cost (SaaS discovery tooling, app review, consolidation or SSO onboarding, and negotiating or terminating redundant contracts) to bring sprawl under control, so you can compare the cost of the problem against the cost of fixing it.",
  "formula": "Annual sprawl risk exposure = shadow app count × avg data sensitivity risk cost per app × (1 − % on SSO/reviewed). Cleanup cost = shadow app count × per-app review/remediation hours × loaded rate.",
  "dateModified": "2026-09-30",
  "run_url": "https://www.revenuelab.fyi/api/public/calc?tool=third-party-saas-sprawl-risk",
  "inputs": [
    {
      "id": "totalSaasApps",
      "label": "Total SaaS apps in active use (est. or discovered)",
      "kind": "number",
      "hint": null,
      "default": 180,
      "unit": null,
      "min": 0,
      "max": null
    },
    {
      "id": "shadowSharePct",
      "label": "Share unmanaged/unreviewed (shadow IT) (%)",
      "kind": "number",
      "hint": null,
      "default": 55,
      "unit": null,
      "min": 0,
      "max": 100
    },
    {
      "id": "riskCostPerApp",
      "label": "Avg annual risk cost per unmanaged app",
      "kind": "number",
      "hint": null,
      "default": 2500,
      "unit": null,
      "min": 0,
      "max": null
    },
    {
      "id": "ssoIntegratedPct",
      "label": "Of shadow apps, share already on SSO/MFA (%)",
      "kind": "number",
      "hint": null,
      "default": 15,
      "unit": null,
      "min": 0,
      "max": 100
    },
    {
      "id": "reviewHoursPerApp",
      "label": "Hours to review/remediate each shadow app",
      "kind": "number",
      "hint": null,
      "default": 3,
      "unit": null,
      "min": 0,
      "max": 40
    },
    {
      "id": "loadedRate",
      "label": "Loaded hourly rate for review work",
      "kind": "number",
      "hint": null,
      "default": 90,
      "unit": null,
      "min": 0,
      "max": null
    }
  ],
  "outputs": [
    {
      "id": "annualExposure",
      "label": "Annual sprawl risk exposure",
      "format": "currency",
      "hint": null,
      "primary": true
    },
    {
      "id": "cleanupCost",
      "label": "One-time cleanup/remediation cost",
      "format": "currency",
      "hint": null,
      "primary": false
    },
    {
      "id": "shadowApps",
      "label": "Estimated shadow/unmanaged apps",
      "format": "number",
      "hint": null,
      "primary": false
    },
    {
      "id": "unmitigatedShadowApps",
      "label": "Shadow apps with no SSO/MFA coverage",
      "format": "number",
      "hint": null,
      "primary": false
    },
    {
      "id": "paybackYears",
      "label": "Cleanup cost payback period (years)",
      "format": "decimal",
      "hint": null,
      "primary": false
    }
  ],
  "worked_example": {
    "inputs": [
      "Total SaaS apps in active use (est. or discovered): 180",
      "Share unmanaged/unreviewed (shadow IT) (%): 55",
      "Avg annual risk cost per unmanaged app: 2500",
      "Of shadow apps, share already on SSO/MFA (%): 15",
      "Hours to review/remediate each shadow app: 3",
      "Loaded hourly rate for review work: 90"
    ],
    "outputs": [
      "Annual sprawl risk exposure: $210,375",
      "One-time cleanup/remediation cost: $26,730",
      "Estimated shadow/unmanaged apps: 99",
      "Shadow apps with no SSO/MFA coverage: 84",
      "Cleanup cost payback period (years): 0.13"
    ]
  },
  "how_to": {
    "title": "How to use this",
    "steps": [
      "Enter total saas apps in active use (est. or discovered).",
      "Enter share unmanaged/unreviewed (shadow it) (%).",
      "Enter avg annual risk cost per unmanaged app.",
      "Enter of shadow apps, share already on sso/mfa (%).",
      "Enter hours to review/remediate each shadow app.",
      "Enter loaded hourly rate for review work.",
      "Read your annual sprawl risk exposure on the right — it updates as you type.",
      "Hit Share to keep the scenario or send it to someone."
    ]
  },
  "scenarios": [
    {
      "name": "Conservative",
      "description": "Lower-end numbers — what if things land soft?",
      "values": {
        "totalSaasApps": 110,
        "shadowSharePct": 35,
        "riskCostPerApp": 1500,
        "ssoIntegratedPct": 10,
        "reviewHoursPerApp": 1.7999999999999998,
        "loadedRate": 55
      }
    },
    {
      "name": "Typical",
      "description": "Defaults — the most common real-world setup.",
      "values": {
        "totalSaasApps": 180,
        "shadowSharePct": 55,
        "riskCostPerApp": 2500,
        "ssoIntegratedPct": 15,
        "reviewHoursPerApp": 3,
        "loadedRate": 90
      }
    },
    {
      "name": "Ambitious",
      "description": "Higher-end numbers — what if things really pop?",
      "values": {
        "totalSaasApps": 290,
        "shadowSharePct": 90,
        "riskCostPerApp": 4000,
        "ssoIntegratedPct": 25,
        "reviewHoursPerApp": 4.800000000000001,
        "loadedRate": 145
      }
    }
  ],
  "limitations": [
    "Results are estimates before tax, fees, and inflation unless an input explicitly covers them.",
    "Rates are treated as fixed for the whole period — variable-rate products will drift from this projection.",
    "This is educational maths, not financial advice. Check anything contractual with the lender or your accountant."
  ],
  "faq": [
    {
      "q": "How do I find out how many shadow SaaS apps we actually have?",
      "a": "SaaS discovery tools that inspect SSO logs, expense reports, browser extensions, and OAuth grants against your Google Workspace/Microsoft 365 tenant typically surface 2-4x more applications than IT's official inventory in the first scan, since most shadow apps get signed up for with a corporate email and a credit card rather than through procurement."
    },
    {
      "q": "Why does SSO/MFA coverage matter more than the app count itself?",
      "a": "An app outside SSO relies on a standalone password that isn't revoked when an employee is offboarded, isn't covered by your MFA policy, and isn't visible to your identity provider's anomaly detection, which is why the calculator treats apps with SSO coverage as substantially lower residual risk even if they remain technically 'unreviewed.'"
    },
    {
      "q": "What's actually in the per-app risk cost estimate?",
      "a": "It should reflect the blended probability-weighted cost of things like data exposure through an unreviewed app's own security incident, compliance violations if the app touches regulated data without a signed DPA, and orphaned access surviving employee departures; $1,500-4,000 per unmanaged app annually is a reasonable range for a typical mix of low-to-moderate sensitivity tools."
    },
    {
      "q": "Is the cleanup effort really worth it given ongoing SaaS growth?",
      "a": "Yes as an ongoing program, not a one-time project, since new shadow apps appear continuously; the calculator's cleanup cost should be thought of as clearing the current backlog, after which a lighter continuous-discovery and app-approval process (much cheaper than the initial cleanup) keeps sprawl from re-accumulating to the same level."
    }
  ],
  "related": [
    "https://www.revenuelab.fyi/toolbox/vendor-risk-exposure",
    "https://www.revenuelab.fyi/toolbox/zero-trust-migration-cost",
    "https://www.revenuelab.fyi/toolbox/soc2-audit-cost"
  ],
  "license": "CC-BY-4.0",
  "citation": "RevenueLab — Third-Party SaaS Sprawl Risk Cost Calculator (https://www.revenuelab.fyi/toolbox/third-party-saas-sprawl-risk)"
}