Rex says
Money math without the spreadsheet headache. Plug in your numbers and I'll show you exactly where the dollars land.
Try a scenario
Click to load — tweak from there.Inputs
Result
Annual sprawl risk exposure
$210,375
One-time cleanup/remediation cost
$26,730
Estimated shadow/unmanaged apps
99
Shadow apps with no SSO/MFA coverage
84
Cleanup cost payback period (years)
0.13
Psst — share this and help Rex grow
One click, a permanent link with your numbers baked in.
How to use this
- 1Enter total saas apps in active use (est. or discovered).
- 2Enter share unmanaged/unreviewed (shadow it) (%).
- 3Enter avg annual risk cost per unmanaged app.
- 4Enter of shadow apps, share already on sso/mfa (%).
- 5Enter hours to review/remediate each shadow app.
- 6Enter loaded hourly rate for review work.
- 7Read your annual sprawl risk exposure on the right — it updates as you type.
- 8Hit Share to keep the scenario or send it to someone.
About this calculator
SaaS sprawl, meaning applications adopted by individual teams or employees without security review, procurement, or SSO integration, has become a leading source of shadow IT risk, with data showing the average mid-size company has 3-5x more SaaS apps in active use than IT/security actually knows about. Each unmanaged app is a potential data exfiltration point, an unmonitored access path that survives employee offboarding gaps, and a compliance blind spot if it touches regulated data. This calculator estimates total exposure by applying a per-app risk cost to your estimated shadow app count, then separately estimates the one-time cleanup cost (SaaS discovery tooling, app review, consolidation or SSO onboarding, and negotiating or terminating redundant contracts) to bring sprawl under control, so you can compare the cost of the problem against the cost of fixing it.
Worked example
Using the values the calculator loads with:
Inputs
- Total SaaS apps in active use (est. or discovered): 180
- Share unmanaged/unreviewed (shadow IT) (%): 55
- Avg annual risk cost per unmanaged app: 2500
- Of shadow apps, share already on SSO/MFA (%): 15
- Hours to review/remediate each shadow app: 3
- Loaded hourly rate for review work: 90
Results
- Annual sprawl risk exposure: $210,375
- One-time cleanup/remediation cost: $26,730
- Estimated shadow/unmanaged apps: 99
- Shadow apps with no SSO/MFA coverage: 84
- Cleanup cost payback period (years): 0.13
What each field means
Inputs
- Total SaaS apps in active use (est. or discovered)
- The total saas apps in active use (est. or discovered) used in the calculation. Starts at 180 so you have a working example on load.
- Share unmanaged/unreviewed (shadow IT) (%)
- The share unmanaged/unreviewed (shadow it) (%) used in the calculation. Starts at 55 so you have a working example on load. Accepted range: 0–100.
- Avg annual risk cost per unmanaged app
- The avg annual risk cost per unmanaged app used in the calculation. Starts at 2500 so you have a working example on load.
- Of shadow apps, share already on SSO/MFA (%)
- The of shadow apps, share already on sso/mfa (%) used in the calculation. Starts at 15 so you have a working example on load. Accepted range: 0–100.
- Hours to review/remediate each shadow app
- The hours to review/remediate each shadow app used in the calculation. Starts at 3 so you have a working example on load. Accepted range: 0–40.
- Loaded hourly rate for review work
- The loaded hourly rate for review work used in the calculation. Starts at 90 so you have a working example on load.
Results
- Annual sprawl risk exposure
- Returned as a money amount in US dollars and shown as the headline result. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- One-time cleanup/remediation cost
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Estimated shadow/unmanaged apps
- Returned as a whole number. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Shadow apps with no SSO/MFA coverage
- Returned as a whole number. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Cleanup cost payback period (years)
- Returned as a decimal number. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
FAQ
How do I find out how many shadow SaaS apps we actually have?
SaaS discovery tools that inspect SSO logs, expense reports, browser extensions, and OAuth grants against your Google Workspace/Microsoft 365 tenant typically surface 2-4x more applications than IT's official inventory in the first scan, since most shadow apps get signed up for with a corporate email and a credit card rather than through procurement.
Why does SSO/MFA coverage matter more than the app count itself?
An app outside SSO relies on a standalone password that isn't revoked when an employee is offboarded, isn't covered by your MFA policy, and isn't visible to your identity provider's anomaly detection, which is why the calculator treats apps with SSO coverage as substantially lower residual risk even if they remain technically 'unreviewed.'
What's actually in the per-app risk cost estimate?
It should reflect the blended probability-weighted cost of things like data exposure through an unreviewed app's own security incident, compliance violations if the app touches regulated data without a signed DPA, and orphaned access surviving employee departures; $1,500-4,000 per unmanaged app annually is a reasonable range for a typical mix of low-to-moderate sensitivity tools.
Is the cleanup effort really worth it given ongoing SaaS growth?
Yes as an ongoing program, not a one-time project, since new shadow apps appear continuously; the calculator's cleanup cost should be thought of as clearing the current backlog, after which a lighter continuous-discovery and app-approval process (much cheaper than the initial cleanup) keeps sprawl from re-accumulating to the same level.
Accuracy and limitations
- Results are estimates before tax, fees, and inflation unless an input explicitly covers them.
- Rates are treated as fixed for the whole period — variable-rate products will drift from this projection.
- This is educational maths, not financial advice. Check anything contractual with the lender or your accountant.
Related tools
Vendor Risk Exposure Calculator
Score and dollar-weight vendor risk from data access, criticality, and control maturity.
Zero-Trust Migration Cost Calculator
Budget identity, device, network, and app segmentation work for a zero-trust rollout.
SOC 2 Audit Cost Calculator
Estimate first-year SOC 2 Type II cost including prep, auditor fees, and tooling.
Cite this calculator
Writing about this topic? Grab a citation — every link helps keep these tools free.
RevenueLab. (2026). Third-Party SaaS Sprawl Risk Cost Calculator. Retrieved from https://www.revenuelab.fyi/toolbox/third-party-saas-sprawl-risk
<p>Source: <a href="https://www.revenuelab.fyi/toolbox/third-party-saas-sprawl-risk" target="_blank" rel="noopener">Third-Party SaaS Sprawl Risk Cost Calculator — RevenueLab</a> (2026).</p>
Source: [Third-Party SaaS Sprawl Risk Cost Calculator — RevenueLab](https://www.revenuelab.fyi/toolbox/third-party-saas-sprawl-risk) (2026).