Magic Quadrant for SaaS Management Platforms

Magic Quadrant for SaaS Management Platforms

https://www.gartner.com/doc/reprints?id=1-2I5V5S8V&ct=240723&st=sb

SaaS management platforms empower organizations to address the compounding challenges of SaaS application usage across the business that lead to overspend, elevated risk, lack of visibility and contract sprawl. This inaugural Magic Quadrant helps I&O leaders identify suitable vendors.

Strategic Planning Assumptions

Through 2027, organizations that fail to centrally manage SaaS life cycles will remain five times more susceptible to a cyber incident or data loss due to incomplete visibility into SaaS usage and configuration.

Through 2027, organizations that fail to attain centralized visibility and coordinate SaaS life cycles will overspend on SaaS by at least 25% due to unused entitlements and unnecessary, overlapping tools.

Through 2027, over 50% of organizations will centralize SaaS application management using an SMP, an increase from less than 10% in 2024.

Market Definition/Description

This is the first version of the Magic Quadrant for SaaS Management Platforms. It replaces the Market Guide for SaaS Management Platforms.

Gartner defines SaaS management platforms (SMP) as software tools that aim to help organizations discover, manage, optimize and automate the SaaS application life cycle from one centralized console. Core SMP capabilities include discovery, cost optimization, employee self-service via an application store, insights to increase adoption and automation of onboarding/offboarding activities.

As SaaS adoption accelerates, IT leaders struggle to discover and support SaaS-hosted applications in accordance with company, market or geographic policies and regulations. Increased SaaS costs — combined with limited visibility into the entire SaaS portfolio (including unapproved SaaS) and high levels of overdeployed and underconsumed licenses — result in significant financial, operational and cybersecurity risk. SMPs help mitigate these risks and offer these benefits:

  • Discovery and monitoring of approved and unapproved SaaS usage.
  • Increased SaaS ROI due to providing data to help drive adoption.
  • Improved management, forecasting and decision making regarding SaaS contracts and renewals, as well as optimized costs and license entitlements.
  • Enhanced employee experience via a curated self-service app catalog or store to find and request access to approved SaaS apps.
  • Streamlined onboarding of new employees to existing SaaS apps, and of new SaaS apps to the organization.
  • Automated employee offboarding within SaaS applications.
  • Reduced IT overhead with automation of configuration and policy management.
  • Increased collaboration between teams that participate in the SaaS application life cycle, including all stakeholders internal and external to IT.
  • Reduced risk with greater awareness of unapproved SaaS applications that are not integrated into corporate identity providers.
  • Improved ability to comply with an increasing number of new regulations that require complete awareness of where company and customer data resides, and accelerated disclosure of potential breaches or vulnerabilities.

Common use cases include:

  • Discover: Uncover sanctioned and unsanctioned SaaS use and costs, while balancing employee privacy.
  • Optimize: Analysis, insights, alerting and automation to optimize SaaS costs and entitlement.
  • Enable: Availability of an employee-facing application store or catalog to simplify SaaS requests. Analysis, insights and alerting to help drive SaaS adoption and maximize ROI.
  • Automate: Simplify SaaS administration (request fulfillment, onboarding, offboarding, license reclamation, etc.) with customizable and template-based workflows.
  • Manage: Management of configuration, policy, users and licenses via read/write API integration.
  • Comply: Identification of SaaS applications and common certification details to determine compliance with industry regulations and organizational policy.

Must-Have Capabilities

The must-have capabilities for this market include:

  • The ability to discover authorized and unauthorized SaaS usage via browser extension, device agent, financial/expense systems integration, security tool integration (including but not limited to SASE, SSE, CASB, SIEM, SWG, firewall and EDR), SSO and IDP platform integration, endpoint management tool integration, email system integration or direct API integration with SaaS applications.
  • An automated workflow capability, including the ability to automate employee onboarding and offboarding for SaaS applications.
  • The ability to optimize SaaS-related expenses, including the ability to identify redundant applications, identify and reallocate unused licenses, optimize usage, forecast SaaS expenses and assign ownership of applications to business owners outside of IT with role-based access controls.
  • The ability to directly manage common SaaS applications from the SMP via read/write API integration.

Standard Capabilities

The standard capabilities for this market include:

  • A platform compliant with applicable regulatory requirements, such as GDPR and CCPA/CPRA.
  • ITSM integration, including ticketing, service catalog, self-service and CMDB.
  • Extensibility via APIs, integrations, as well as providing capability for data import and export.
  • An employee self-service SaaS application catalog, including a high number of direct SaaS application integrations.

Optional Capabilities

Optional capabilities for this market include:

  • Providing risk and compliance ratings for discovered apps, including applicable certifications.
  • Pricing and adoption benchmarking reports.
  • Vendor and contract management capabilities.
  • GenAI integration for admins.
  • Application request form and process for employees to request SaaS applications.

Magic Quadrant

Figure 1: Magic Quadrant for SaaS Management Platforms

Figure 1: Y24Q3 Magic Quadrant for SaaS Management Platforms

Vendor Strengths and Cautions

BetterCloud

BetterCloud, a Visionary in this Magic Quadrant, was founded in 2011 and is headquartered in New York, New York. Its operations are based in North America, Latin America and APAC, and its customers consist mainly of North American small businesses to midsize enterprises. The BetterCloud platform was launched in 2016. It is GDPR-compliant and has earned ISO-27000-family and SOC 2 certifications. The vendor does not enable customers to determine where their data is stored.

Historically focused on SaaS operations, BetterCloud acquired G2 Track in 2024 to address a previous gap in SaaS license optimization and expense management capabilities.Strengths

  • Market responsiveness/record: As an original SMP vendor, BetterCloud has a deep understanding of the market and customer needs. Its recent acquisition of G2 Track for SaaS expense management is an example of the vendor’s recognition that market requirements extend beyond improving and automating SaaS operations.
  • Workflow orchestration: BetterCloud’s low-code/no-code workflow orchestration capability provides a simple but powerful platform for automating common SaaS management tasks. In addition to built-in integrations, custom webhooks can be used to extend automation to a wide variety of SaaS applications and other IT management tools.
  • SaaS operations: Due to BetterCloud’s historical focus on SaaS operations, it excels at improving and automating common operational activities, such as onboarding/offboarding, license management, and configuration and policy management.

Cautions

  • Geographic operations: BetterCloud’s geographic strategy is heavily focused in North and Latin America. The vendor does not offer customers the ability to choose where their data is stored, and customer support is only offered Monday through Friday, 9 a.m. to 8 p.m. U.S. Eastern time. This may challenge organizations outside of North America.
  • SaaS discovery: BetterCloud currently supports SSO, direct SaaS application API integration, financial system integration and OAuth for discovery. The fact it does not offer a browser extension may limit its ability to discover no-cost unsanctioned (shadow) SaaS.
  • Product strategy: BetterCloud’s historical lack of emphasis on SaaS spend management has caused some customers to consider other options to fulfill their requirements. However, BetterCloud’s recent acquisition of G2 Track, once fully integrated into the platform, is intended to quickly close this gap.

Calero

Calero, a Niche Player in this Magic Quadrant, was founded in 1995 and is headquartered in Rochester, New York. Its operations are based in North America, Europe and APAC, and its customers consist mainly of large enterprises. Calero SaaS Management was launched as part of its Technology Expense Management platform in 2021. The platform is GDPR- and CCPA/CPRA-compliant and has earned ISO 27000-family and SOC 2 certifications. The vendor enables customers to determine if their data is stored in North America or Europe.

Historically focused on telecom, unified communications and mobility spend management, Calero has added SaaS management capabilities to identify SaaS waste, overlap and optimization opportunities.Strengths

  • Internal operations: Calero’s 30-year history, and strong geographical and effective internal operations investments, have enabled it to deliver efficient SaaS management alongside its mobility, telephony, UCaaS and market data expense management solution.
  • Sales strategy: Although not publicly listed, Calero’s pricing is straightforward and lower compared with other vendors participating in this research. Customers can purchase direct or through resellers.
  • Expense management: Calero leverages its historical focus on technology expense management to deliver an SMP that enables organizations to continually optimize SaaS expenses. Its platform provides robust invoice processing, deep and actionable license health insights, rich application usage data, detailed pricing data, and cost allocation capabilities.

Cautions

  • Limited direct SaaS application integrations: Although Calero utilizes robotic process automation (RPA) and direct API integrations to interact with SaaS applications, only a limited number of integrations are supported. This can limit the product’s ability to perform more complicated management activities within SaaS applications where integration isn’t provided, such as license reclamation and providing detailed usage data that is essential for license entitlement optimization and adoption efforts.
  • SaaS operations: Calero has been historically focused on technology expense management. It has defined a solid roadmap to provide improvement, but additional enhancements are needed within its SaaS configuration management and automation capabilities to fully meet the needs of IT operations buyers.
  • Marketing strategy and execution: Calero’s marketing has been generally focused on overall technology-spend-related use cases, resulting in a diluted SMP message. It also infrequently publishes relevant SMP content on social and other media channels. Limited success in product marketing can limit prospects’ ability to find the vendor, which may impact growth.

CloudEagle

CloudEagle, a Niche Player in this Magic Quadrant, was founded in 2021 and is headquartered in Palo Alto, California. Its operations are based in North America, Europe and APAC, and its customers are predominantly midmarket to small enterprises. Its CloudEagle.ai was launched in 2021. The platform is GDPR-compliant and has earned ISO 27000-family and SOC 2 certifications. The platform enables customers to determine whether their data is stored in North America or Europe.

Primarily focused on SaaS optimization, CloudEagle has invested heavily in AI to enable data-powered decisions for managing applications and renewing SaaS contracts.Strengths

  • Innovation: CloudEagle’s extensive usage of AI and ML is a differentiator. Its SaaSMap, an LLM-powered knowledge graph, provides a conversational interface to enable data-powered decisions for managing and renewing SaaS.
  • Product strategy: CloudEagle’s roadmap is directly aligned to customer needs and looks to help close the gap with its leading competition. As evidenced by its 405 direct integrations (second-most among vendors in this report), CloudEagle has proven its ability to rapidly develop. This is reflected in its roadmap and aggressive release of new features.
  • License entitlement optimization: CloudEagle provides robust capabilities to easily enable organizations to optimize expenses by harvesting unused licenses and downgrading license tiers. Direct integration with Slack and Microsoft Teams enables efficient interactions with employees and SaaS application owners during this process.

Cautions

  • Sales execution/pricing: CloudEagle’s pricing model is based primarily on custom quotes priced on an annual cost based on an agreed number of employees. This may enhance a customer’s ability to negotiate a favorable deal, but it limits pricing transparency, and complicates budgeting and forecasting.
  • Vertical industry strategy: CloudEagle’s strength and primary target customers are midmarket to small enterprise organizations, with focus on the technology sector. Larger clients, or those in regulated verticals, should assess CloudEagle’s ability to address unique requirements.
  • SaaS configuration management: CloudEagle does not provide a capability to manage the configuration of SaaS application platforms. This reduces the platform’s utility for IT operations buyers and does not address their need to streamline SaaS configuration management and reduce risk.

FinQuery

FinQuery (formerly LeaseQuery), a Niche Player in this Magic Quadrant, was founded in 2011 and is headquartered in Atlanta, Georgia. Its operations are based in North America and its customers range from small businesses to midsize enterprises. Its FinQuery Software Management was originally launched in 2020 as StackShine before being acquired by LeaseQuery and rebranded in 2023. The vendor does not enable customers to determine where their data is stored (all data is stored in North America).

Initially focused on lease accounting, FinQuery has expanded to include solutions for contract management and software asset management. FinQuery differentiates itself by catering to the SaaS management needs of finance and IT departments. FinQuery recently received a $25 million investment to accelerate product development and expand market reach through strategic acquisitions.Strengths

  • Product offering: FinQuery offers SaaS management as a stand-alone product within its spend management portfolio. When combined with its lease accounting and management and contract management products, it helps organizations manage their largest areas of spend in a single platform.
  • Customer experience: FinQuery makes extensive use of customer success managers to simplify deployment, decrease time to value realization and simplify client interactions and engagement with the vendor. They do not charge customers for this service.
  • Expense management: FinQuery enables organizations to effectively manage SaaS expenses and rationalize the overall application portfolio through generated insights and recommendations.

Cautions

  • Geographic strategy: FinQuery’s platform is not currently GDPR-compliant, nor has the company earned any major compliance or cybersecurity certifications. The platform does not enable customers to store their data outside of North America. Clients in regulated verticals or with geographic data residency regulations should assess FinQuery’s ability to address unique requirements.
  • Overall viability: While FinQuery is profitable and has received a $25 million investment, SaaS management currently makes up a small portion of its overall revenue. Despite consistent and relatively strong R&D investment, this raises questions about the vendor’s long-term commitment to and viability in the SaaS management platform market.
  • Organizational size focus: FinQuery’s focus is on small businesses to midsize enterprises. As a result, its product features may not fit the requirements of large enterprises.

Flexera (Snow Software)

Snow Software, acquired by Flexera in February 2024, is a Challenger in this Magic Quadrant. It was originally founded in 1997 and is now headquartered in Itasca, Illinois as a result of the acquisition. Its operations are globally diversified, and its customers range from midmarket to large enterprises. Its Snow SaaS Management solution was launched in 2023. The platform is GDPR-compliant and has earned ISO 27000-family and SOC 2 certifications. Snow SaaS Management offering enables customers to determine if they want their data stored in North America, Europe or Australia.

Historically focused on software asset management, Flexera (Snow Software) has added SaaS application management capabilities and is investing in AI to accelerate operations and expense management.Strengths

  • Operations: Flexera (Snow Software) has an extensive global partner network for implementation and support services. The vendor has staff in North and South America, Europe, India and Australia. As a result of its acquisition by Flexera on 15 February 2024, the combined company has a greater capability to enable customers globally.
  • Customer experience: Flexera (Snow Software) has a customer success management program that focuses on increased customer engagement, as well as driving adoption and effective use of their platform. As a result, customers can accelerate their SaaS management programs and time to value.
  • Marketing execution: Flexera (Snow Software) has published a wide range of thought-leading content through a variety of channels. Their acquisition should only amplify this strength, as Flexera is also established at product marketing and has demonstrated historical thought leadership.

Cautions

  • SaaS discovery and limited direct integrations: Flexera (Snow Software) does not provide integration with common expense management platforms, which may limit its ability to discover all SaaS spend. It also provides a limited number of direct SaaS API integrations, which may limit SaaS usage and expense-related optimization and automation capabilities.
  • Compliance analysis: Flexera (Snow Software) does not provide SaaS application security risk ratings or certification compliance information. This complicates IT security, and compliance and IT procurement’s ability to effectively review existing and assess new applications.
  • Impact of acquisition: The complete impact of Snow Software’s acquisition by Flexera is unknown. As the merger plans are further developed and shared, customers should prepare for possible transformations in product strategy and company operations.

Josys

Josys, a Niche Player in this Magic Quadrant, was founded in 2021 and is headquartered in Tokyo, Japan. Its operations are based in the APAC region, and its customers range from small to midmarket businesses. Josys’ SaaS management platform was launched in 2021. The platform is GDPR-compliant and has earned SOC 2 certification. The vendor does not enable customers to determine where their data is stored.

Historically focused on technology asset management usage, Josys added SaaS management and workflow automation capabilities to modify access within the platform. The vendor also continues to expand its SaaS discovery capability to improve identification of unmanaged (shadow) IT.Strengths

  • Customer experience: Josys uses customer success managers to increase speed and ease of deployments. Josys also provides over 240 prebuilt integrations to simplify connections to new SaaS applications and other discovery sources.
  • Marketing strategy: Josys demonstrates thought leadership and engagement within the Japanese SMP market through extensive use of webinars and customer, partner, and roadshow events. Consistent messaging and blog posts emphasize its value proposition, which is well-aligned to the needs of SMP buyers.
  • Regional focus: Josys has a strong focus on Japan, with multiple regional customer case studies to illustrate its success in that market. Customers in the Asia/Pacific market will benefit from the vendor’s deep regional understanding and expertise. It is actively expanding into other markets following its last funding round in 2023.

Cautions

  • Regional data storage strategy: Josys does not enable customers to determine the geographic region where their data is stored. Also, its limited exposure beyond the Japanese market may pose challenges for organizations outside of Japan.
  • Product offering: Josys’ workflow orchestration is limited to onboarding and offboarding activities. In addition, the vendor does not provide an employee-facing self-service application store or the ability to manage SaaS configurations. It also does not provide prebuilt integrations with ITSM, SAM or SIEM platforms.
  • SaaS discovery: Josys enables discovery via SSO, browser extension and direct SaaS API integrations. However, the lack of integration with expense management platforms for SaaS discovery limits its ability to manage SaaS expenses.

Lumos

Lumos, a Visionary in this Magic Quadrant, was founded in 2020 and is headquartered in San Francisco, California. Its operations are based primarily in North America, and its customers range from midmarket businesses to large enterprises. Lumos’ SaaS management platform was launched in 2022. The platform is GDPR-compliant and has earned certifications within the ISO 27000 family, as well as SOC 2. The vendor does not enable customers to determine where their data is stored.

Historically focused on SaaS discovery and simplifying employees’ access to SaaS via an app store, Lumos continues to invest in expanding to holistic SaaS and AI-powered access management for automating contract ingestion, access request workflows, unsanctioned (shadow) IT discovery and license management.Strengths

  • Innovation: Lumos uses AI extensively to improve SaaS management tasks. Lumos also has implemented a unique capability to enable limited time-based access to SaaS (i.e., for 30 to 90 days, if license agreements allow) to optimize expenses. They also offer extensive integration with Slack to interact with IT administrators and employees.
  • Product offering: Lumos provides a robust and easy-to-use workflow orchestration capability to streamline on/offboarding and license tier modification. Its entitlement review capability enables automated deprovisioning of unapproved or unused accounts and licenses, and the platform is extensible using a published API.
  • Employee-facing application store: Lumos provides a comprehensive and easy-to-use application store that enables employees to find approved and request access to new SaaS applications. The catalog is customizable, and specific apps can be filtered for some employees based on customer-defined and organizational attributes. Status reporting is available on fulfillment processes as well.

Cautions

  • Geographic strategy: Lumos does not enable customers to store their data outside North America. As a result, Lumos may not be suitable for organizations with geographic data residency requirements.
  • Vertical/industry strategy: Lumos does not differentiate its product, marketing or sales strategy based on industry verticals. The company’s lack of a differentiated strategy may limit its ability to be successful within markets that have specialized regulatory or security requirements.
  • Compliance analysis: Lumos does not provide SaaS risk ratings or compliance information. This could limit the effectiveness of the platform for IT security and compliance buyers, as well as IT procurement’s ability to easily assess new SaaS vendors.

Oomnitza

Since the initial publication of this Magic Quadrant (22 July 2024), Oomnitza was a party in the following significant corporate transaction(s). For Key Background and Considerations for Technology and Service Selection, see:

Analysis within this Magic Quadrant remains as originally published.

Oomnitza, a Niche Player in this Magic Quadrant, was founded in 2012 and is headquartered in San Francisco, California. Its operations are based primarily in North America. Its SMP offering was launched in 2022. The platform is GDPR- and CCPA/CPRA-compliant, and has earned SOC 2 certification. The vendor enables customers to determine the geographic region where their data is stored.

Historically focused on IT hardware asset management (ITAM), Oomnitza has invested in features to improve SaaS operations, automate processes, reduce security and compliance risks, and eliminate redundant spend. It offers a low-code/no-code platform and technology database that simplifies SaaS management.Strengths

  • Innovation: The Oomnitza AI Assistant uses generative AI (GenAI) to create workflows, reports and employee communications, as well as the creation and syntax validation of code. The AI assistant reduces the IT administrator learning curve and reduces the time to value realization.
  • Workflow orchestration: Oomnitza’s low-code/no-code workflow orchestration capability provides a deep and extensible automation of common SaaS management tasks. It provides prebuilt connectors for over 150 IT management tools and SaaS applications.
  • Customer experience: Oomnitza makes extensive use of customer success managers to simplify deployment and reduce time to value realization.

Cautions

  • Vertical/industry strategy: Oomnitza does not differentiate its marketing or sales strategy based on industry verticals. The company’s lack of a differentiated marketing or sales strategy may limit its ability to be successful within markets that have specialized regulatory or security requirements.
  • SaaS life cycle management: Oomnitza provides limited capabilities for SaaS procurement and renewal optimization. Its platform does not currently offer price benchmarking, or application risk and compliance certification details (though it provides data fields for compliance information to be manually added). As a result, Oomnitza may not meet the needs of buyers focused on IT procurement.
  • Product offering: Many of Oomnitza’s SaaS management capabilities have evolved from its ITAM roots. As a result, it is less mature in expense management, configuration management, compliance analysis and life cycle management.

Productiv

Productiv, a Niche Player in this Magic Quadrant, was founded in 2018 and is headquartered in Palo Alto, California. Its operations are based primarily in North America, and its customers are primarily midmarket and small enterprise organizations. Its SMP, Productiv Platform, was launched in 2019. The platform is GDPR- and CCPA/CPRA-compliant, and has earned SOC 2 certification. The vendor enables customers to determine if they want their data stored in North America, Europe or APAC.

Historically focused on SaaS intelligence (optimization and expense management), Productiv has expanded its SaaS management capabilities to address more procurement and IT operations focused needs, and has added GenAI to the platform to further simplify SaaS management activities.Strengths

  • Innovation: Productiv released Sidekick to reduce the learning curve for its platform and improve time to value realization. This GenAI-powered assistant promises to simplify spend optimization, improve vendor management and streamline contract management. Productiv also holds several patents for SaaS management techniques and capabilities.
  • Marketing execution: Productiv is well-established in the SMP market and frequently publishes thought-leading content through a variety of channels. Its annual “State of SaaS” report provides a comprehensive review of SaaS trends across its customer base. The vendor also appears frequently in industry and trade press.
  • Application portfolio optimization: Productiv provides an extensive application catalog, along with automated categorization to quickly identify overlapping or redundant applications. It also provides comprehensive departmental and organizational SaaS usage information to enable portfolio optimization and drive ROI. Finally, its employee-facing application store reduces unsanctioned (shadow) SaaS risk by making it easy to find and request access to new and existing SaaS applications.

Cautions

  • SaaS configuration management: Productiv does not provide a capability to manage the configuration of SaaS application platforms. This reduces the platform’s utility for IT operations buyers and does not address their need to streamline SaaS configuration and reduce risk.
  • Business model: Productiv primarily targets midmarket and enterprise firms located in North America. They are organizationally smaller than many competitors partly as a result of a 2023 downsizing. Combined with recent senior leadership changes, Productiv may struggle to scale its offering and operations to support globally distributed enterprises or expand into other geographic regions if they experience rapid growth.
  • Onboarding and offboarding: Productiv’s automated on/offboarding is limited to Microsoft Entra ID or Okta SSO group management. For applications that do not integrate with either or for customers that use other identity providers, workflow is limited to creating a Jira ticket for an application owner or IT administrator to manually provision access.

ServiceNow

ServiceNow, a Challenger in this Magic Quadrant, was founded in 2004 and is headquartered in Santa Clara, California. Its operations are geographically diversified, and it segments its customers as marquee (largest 250), enterprise, commercial and nonprofits. Its SaaS License Management application is a feature with ServiceNow IT Asset Management, which was launched in 2019. The platform is GDPR- and CCPA/CPRA-compliant, FedRAMP-authorized, and has earned ISO-27000-family and SOC 2 certifications. The vendor enables customers to determine if they want their data stored in a specific geographic region.

Historically focused on holistic IT and software asset management, ServiceNow has added basic SaaS management capabilities to address the needs of IT asset management and IT procurement buyers.Strengths

  • Geographic and vertical strategy: ServiceNow has a proven ability to service global organizations of all sizes. Its extensive global operations and large 2,000-plus partner network assists with its entire portfolio. It is established in all industry verticals. ServiceNow is also the only SMP with FedRAMP authorization.
  • Customer experience: ServiceNow provides comprehensive customer success programs paired with highly effective support to accelerate value realization and improve product usage. It also has a robust process to assess and respond to customer feedback through product advisory councils and an online community.
  • Extensibility and integration: The ServiceNow platform provides extensive integration capabilities to other IT management tools, identity/SSO providers, financial management systems, other SaaS applications and native ServiceNow applications. Its no-code Flow Designer simplifies workflow creation and task automation.

Cautions

  • Market understanding: ServiceNow’s SMP offering is part of their SAM product, which focuses primarily on procurement and asset management use cases. Its SMP strategy also focuses on expense and asset management, which may not fit the needs of buyers that prioritize IT operations and security use cases.
  • Product offering: ServiceNow’s browser extension for SaaS discovery is only available within its Digital End-user Experience (DEX) product. Not having a browser extension as an included component of their SMP offering could limit the discovery of unsanctioned (shadow) SaaS. ServiceNow SaaS License Management also does not natively provide SaaS risk ratings or compliance information (available separately within their Security Operations product), which complicates the ability to effectively review existing and assess new applications for risk.
  • SaaS configuration management: ServiceNow SaaS License Management does not natively provide a capability to manage the configuration of SaaS application platforms (available separately within their Security Operations product). This reduces the platform’s utility for IT operations buyers desiring to streamline SaaS configuration management and reduce risk.

Torii

Torii, a Leader in this Magic Quadrant, was founded in 2017 and is headquartered in New York, New York. Its operations are based in North America and Israel, and its customers consist predominantly of midmarket to large enterprises. Its SMP was launched in 2017. The platform is GDPR- and CCPA/CPRA-compliant and has earned ISO-27000-family and SOC 2 certifications. The vendor does not enable customers to determine where their data is stored.

Historically focused on automated SaaS management, Torii has recently made significant investments in AI discovery and mapping, contract ingestion and parsing, RBAC to enable distributed SaaS management, and a low-code/no-code workflow builder.Strengths

  • Offering/product strategy: Torii’s roadmap is focused on customer needs curated via a robust multichannel customer feedback program. As a result, Torii’s value proposition is strongly aligned with the core needs of SMP buyers, and its high Critical Capabilities performance reflects the progress it has made. Torii has recently accelerated its release cadence and publishes updates on its website.
  • Innovation: Torii provides an AI assistant to simplify SaaS management activities. It also extensively uses AI for streamlining the identification and merging of user profiles from various sources, contract ingestion, application categorization, and data aggregation and deduplication, and for the retrieval of application compliance information. It also released a developer portal and APIs that enables customers, partners and SaaS application vendors to build integrations with its platform.
  • Workflow orchestration: Torii provides flexible low-code/no-code workflow orchestration with unlimited branching. This provides an easy-to-use and highly customizable automation framework to eliminate common SaaS management tasks. The vendor also provides Slack integration and a large number of prebuilt connectors to other IT management systems and SaaS application platforms.

Cautions

  • Operations: In 2023, Torii transitioned from growth to operationally sustainable mode, which included restructuring and elimination of some back-office roles. The intent was to clear its path to profitability and invest in additional development talent. Some back-office functions may not be able to keep pace if they experience rapid growth, which may result in challenges in account servicing.
  • Geographic strategy: Torii only offers data storage in North America, which may not be suitable for global organizations or those with geographic data residency requirements.
  • Scalability: Torii is a young company and is also smaller than most vendors participating in this report. This may concern larger enterprises about its overall viability and ability to scale to accommodate their needs if Torii experiences rapid growth.

Trelica

Trelica, a Niche Player in this Magic Quadrant, was founded in 2018 and is headquartered in Cambridge, United Kingdom. Its operations are based in Europe and North America, and its customers consist predominantly of midmarket to medium enterprises. Its SMP was launched in 2021. The platform is GDPR-compliant and has earned SOC 2 certification. The vendor enables customers to determine if they want their data stored in North America or Germany.

Historically focused on overall SaaS management, Trelica has recently invested in AI to improve data processing throughout the platform, extracting data from contract documents and improving its application library. It also continues to invest in its SaaS application direct integration capability (300-plus integrations).Strengths

  • Product offering: Trelica has a flexible workflow orchestration with an extensive number of templates and robust reporting. It offers customizable expense reporting dashboards, rightsizing recommendations and automated license tier downgrade workflows. The vendor provides a large number of integrations to other IT management tools, identity/SSO providers, and HR information systems (HRIS) platforms. Trelica has developed over 300 direct SaaS API integrations.
  • Business model: Trelica is founder-owned and funded. It is singularly focused on the needs of SMP buyers, given that their SMP is the company’s sole product offering. This reduces the risk of external parties trying to influence their mission and vision, and prepares them to overcome macroeconomic disruptions or accommodate new customer requirements.
  • Market responsiveness: Trelica has a robust customer success management program and feedback mechanisms to identify new product requirements and requested features. It has also adopted a continuous release cadence to accelerate new capabilities and fixes.

Cautions

  • Marketing strategy and execution: Trelica is less-established than many SMP competitors. Although the product performed very well in the companion Critical Capabilities research, limited investment and success in product marketing limits prospects’ ability to find the vendor, which will impact growth.
  • Scalability: Trelica is a young company and is also smaller than most vendors participating in this report. This may concern larger enterprises about its overall viability and ability to scale to accommodate their needs.
  • Vertical/industry strategy: Trelica does not differentiate its product, marketing or sales strategy based on industry verticals. The lack of a differentiated strategy may limit its ability to be successful within markets that have specialized regulatory or security requirements.

USU

USU, a Niche Player in this Magic Quadrant, was founded in 1977 and is headquartered in Möglingen, Germany. Its operations are based in Europe and North America, and its customers consist mainly of medium to extra-large enterprises. Its Optimization for SaaS (soon to be known as SAM for SaaS) product was launched in 2018. The platform is GDPR-compliant and has earned ISO-27000-family and SOC 2 certifications. The vendor enables customers to determine if they want their data stored in a specific geographic region.

Historically focused on IT asset management, USU has recently invested in AI to improve its SaaS management capabilities with intelligent automation, data-driven insights and decision-making support for more accurate recommendations.Strengths

  • License entitlement optimization: USU provides comprehensive SaaS license optimization capabilities, including the ability to reclaim unused licenses, adjust license tiers, interact with employees via email and automatically deactivate accounts via direct SaaS API connections.
  • Sales execution/pricing: USU has a flexible pricing and discounting model based on organization size, strategic account status and vertical industry. As a result, customers may have a greater ability to create an agreement that better fits their organization.
  • Customer experience: USU deploys customer success managers to simplify deployment and reduce time to value realization. It also has a comprehensive customer feedback program to ensure satisfaction and fuel the product roadmap. USU also offers a fully managed service offering. It has won several customer-related awards in the past few years.

Cautions

  • Product offering: USU’s platform performed inadequately within the IT operations and IT security and compliance analysis use cases within the companion Critical Capabilities research. Organizations should examine their own critical needs to determine whether USU can fully meet their requirements.
  • Compliance analysis: USU does not provide any SaaS compliance details such as application risk ratings, security certification details, regional regulatory compliance status or data storage location details. This complicates IT security and regulatory compliance analysis, as well as IT procurement’s ability to effectively review and assess existing and new applications.
  • SaaS configuration management: USU does not provide any ability to manage its SaaS configuration settings. This reduces the platform’s utility for IT operations buyers and does not address their need to streamline SaaS configuration management and reduce risk.

Zluri

Zluri, a Leader in this Magic Quadrant, was founded in 2020 and is headquartered in Milpitas, California. Its operations are based in North America, Europe and India, and its customers consist of midmarket to small enterprises. Its SMP was launched in 2020. The platform is GDPR-compliant and has earned ISO 27000 family and SOC 2 certifications. The vendor enables customers to determine if they want their data stored in North America, Europe, Middle East or APAC.

Historically focused on complete SaaS management, Zluri has recently invested in adding identity governance and administration (IGA) capabilities and an AI engine to capture and ingest all details from any contract or document, as well as a GenAI chatbot assistant that provides SaaS usage insights.Strengths

  • Market understanding: Zluri’s platform is well aligned with the needs of SMP buyers. The vendor anticipates and adapts to market trends well, resulting in several enhancements to its product. It also implemented internal organization changes to be better-prepared for macroeconomic uncertainty.
  • Innovation: Zluri has integrated AI and ML into its product for automated contract ingestion and SaaS application analysis. Its GenAI-powered assistant, Zluri Co-Pilot, reduces the learning curve and enables IT administrators to quickly obtain actionable insights about their SaaS estate. Its platform is powered by its patent-pending AuthKnox engine, which informs policy configuration and provides SaaS insights.
  • Product offering: Zluri’s platform has broad capabilities and performed very well in the Critical Capabilities dimensions. They provide the highest number of direct SaaS application integrations (753) of all vendors in this report. Its application library also has over 250,000 apps with profiles containing relevant SaaS information, as well as certifications, hosting details, cybersecurity incident history and application risk rating.

Cautions

  • Sales execution/pricing: Zluri’s pricing is based on a tiered model, with add-ons available for access management and access reviews. Although not publicly disclosed, Zluri’s all-inclusive pricing is more expensive than many of its competitors.
  • Operational scalability: Zluri’s customer base is predominantly midmarket or smaller. Also, Zluri is a younger company with a smaller installed base than most of the competition. This may concern larger enterprises about its overall viability.
  • Product marketing: Zluri’s marketing content, while very frequent and detailed, tends to be too broad and not focused on its core capabilities of SMP and IGA. This can lead to confusion among prospective buyers about what the vendor actually provides, potentially resulting in unrealistic expectations or lost opportunities.

Zylo

Zylo, a Leader in this Magic Quadrant, was founded in 2016 and is headquartered in Indianapolis, Indiana. Its operations are based in North America, and its global customers consist of enterprises of all sizes. Its Zylo SaaS Management platform was launched in 2016. The platform is GDPR- and CCPA/CPRA-compliant, and has earned SOC 2 certification. The vendor does not enable customers to determine where their data is stored.

Historically focused on complete SaaS management, Zylo continues to invest in its AI-powered SaaS application discovery, as well as data aggregation, normalization and analysis. It has also added workflow orchestration to manage and optimize licensing, and has partnered with Netskope to include SaaS security and compliance insights.Strengths

  • Thought leadership and marketing execution: Zylo consistently and effectively publishes a high volume of thought-leading content through all available channels. Its annual, virtual SaaSMe event, and its SaaSMe Unfiltered and SaaSMe Anything podcasts, promote success stories, strategies and practical guidance on how anyone can improve SaaS management. It has published the annual SaaS Management Index (SMI) for six years, which compiles insights gleaned from an installed base of over 30 million licensed employees and $34 billion in spend.
  • Product offering: Zylo’s application library, the Zybrary, includes over 22,000 applications, with financial, risk and functionality details on each to enable informed purchasing and renewal decisions. It also provides extensive low-code/no-code workflow orchestration, onboarding/offboarding automation, and an employee-facing application store to simplify employees’ ability to find and request access to or a new application.
  • Customer experience: Zylo makes extensive use of customer success managers to enrich customer experience. The Zylo Value Framework is a proprietary methodology that includes key metrics and methods to maximize value and accelerate operations, and drives customers to fully leverage the platform. As a result, Zylo has won several awards for its customer experience.

Cautions

  • Geographic strategy: Zylo does not enable customers to store their data outside of North America. As a result, Zylo may not be suitable for organizations with geographic data residency requirements.
  • SaaS discovery: Zylo enables discovery via SSO and OAuth, as well as integrations with SaaS security tools, financial systems and SaaS APIs. Not offering a browser extension may limit its ability to discover unsanctioned (shadow) SaaS.
  • Sales execution/pricing: Zylo’s pricing model is tiered based on organization size, and also offers several product and service add-ons. This perceived complexity can make it difficult for customers to understand, estimate and forecast SMP costs.

Inclusion and Exclusion Criteria

To qualify for inclusion, providers need:

  • A single-license SKU, generally available by 31 March 2024, that includes all must-have capabilities defined in the market definition and also provides all of the following capabilities:
    • The ability to discover authorized and unauthorized SaaS usage via three or more of the following methods:
      • Browser extension
      • Device agent
      • Financial/expense system integration; security tool integration (including but not limited to SASE, SSE, CASB, SIEM, SWG, firewall and EDR)
      • Single sign-on (SSO) and identity provider (IdP) platform integration
      • Endpoint management tool integration
      • Email system integration
      • Direct API integration with SaaS applications
      • OAuth integration
  • To help organizations optimize SaaS spend, the SMP must be able to
    • Categorize and identify redundant applications with overlapping capabilities across product categories
    • Mnually or automatically identify, revoke and/or reallocate unused license entitlements.
  • Workflow orchestration capability to automate common SaaS application management tasks such as employee onboarding/offboarding, license allocation/deallocation, access modification and configuration management.
  • The ability for an administrator to take action on five or more distinct SaaS applications directly from the SaaS management platform, including but not limited to the following:
    • Modification of SaaS application access privileges
    • Modification of entitlement/licenses
  • All capabilities listed in the sections of the first two bullets above must be the vendor’s own intellectual property; none of the capabilities may be enabled via third-party products or partnerships.
  • The SaaS management platform must be purchasable as a stand-alone product and must not solely be sold or licensed as an add-on to another product.
  • Rank among the top 20 organizations in the customer interest index (CII) defined by Gartner for this Magic Quadrant. Data inputs used to calculate the SaaS Management Platform CII include a balanced set of measures, including but not limited to:
    • Gartner customer search, inquiry volume and trend data
    • Frequency of mentions as a competitor to other SaaS management platform vendors within reviews on Gartner’s Peer Insights forum between April 2023 and March 2024
    • Customer interest and engagement as represented by various social media engagement measurements.

Honorable Mentions

The criteria for inclusion of platform providers in this Magic Quadrant are based on a combination of quantitative and qualitative measures, as noted in the Inclusion Criteria section. Below are several noteworthy providers that did not meet all inclusion criteria but could be appropriate for clients, contingent on requirements. The following is a nonexhaustive list, presented in alphabetical order:

Beamy: Beamy’s SaaS governance platform provides large enterprises the ability to monitor and govern their SaaS landscape. Through its web browser extension, Beamy provides SaaS usage observability and real-time guidance for end users while using SaaS. The solution integrates with enterprise IT tools such as ITSM, cloud security, SAM and IAM platforms. Beamy did not meet the inclusion criteria for direct API-based SaaS application integration.

CloudNuro: CloudNuro’s SaaS management platform combines FinOps with SaaSOps to deliver visibility across all cloud-hosted services and to increase operational efficiency, reduce shadow IT risks, governance and enhance compliance. CloudNuro did not meet the inclusion criteria for workflow orchestration, the capability to revoke unused license entitlements and the ability to directly manage common SaaS applications from the SMP via read/write API integration.

Flexera: Flexera One SaaS Management enables SaaS discovery and spend optimization for SaaS applications. Flexera recently acquired Snow Software to increase its SaaS management capabilities. Flexera did not meet the inclusion criteria for role-based access controls.

Nudge Security: Nudge Security enables SaaS discovery via an organization’s email system by analyzing messages for known SaaS usage patterns. The platform encourages app owners and other SaaS stakeholders to take action via workflow-based multichannel (email, Slack, etc.) nudges. Nudge did not meet the inclusion criteria for SaaS expense optimization and the ability to take direct action to modify SaaS application entitlements from the platform.

Evaluation Criteria

Ability to Execute

Gartner analysts evaluate vendors on the quality and efficacy of the processes, systems, methods or procedures that enable provider performance to be competitive, efficient and effective, and to positively impact revenue, retention and reputation. Ultimately, vendors are judged on their ability and success in capitalizing on their vision.

Product: This criterion looks at the core technology product that competes in and or serves the defined market. This includes current product capabilities, quality, feature sets and the like. Additional consideration is given to the breadth and depth of the base platform, ability to optimize SaaS spend and overall application portfolio, and the vendor’s track record of delivering on their roadmap.

Overall viability: This criterion includes an assessment of the organization’s overall financial health, as well as the financial and practical success of the business unit. It considers the likelihood of the organization to continue to offer and invest in the product, as well as the product position in the current portfolio. Additional consideration is given to sustainable investment/ownership structure, revenue and growth, leadership stability, and organizational and partner scalability.

Sales execution/pricing: This criterion looks at the vendor’s capabilities in all presales activities and the structure that supports them. This includes deal management, pricing and negotiation, presales support and the overall effectiveness of the sales channel. Additional consideration is given to sustained growth, volume and impact of conquest sales (competition take-out) and bundling, pricing, and discounting evolution.

Market responsiveness: This criterion looks at a vendor’s ability to respond, change direction, be flexible and achieve competitive success as opportunities develop, competitors act, customer needs evolve and market dynamics change. This criterion also considers the provider’s history of responsiveness to changing market demands. Additional consideration is given to tenure in the market, product vision and value proposition and product roadmap (including items identified by customers).

Marketing execution: This criterion looks at the clarity, quality, creativity and efficacy of programs designed to deliver the vendor’s message in order to influence the market, promote the brand, increase awareness of products and establish a positive identification in the minds of customers. This “mind share” can be driven by a combination of publicity, promotional activity, thought leadership, social media, referrals and sales activities. Additional consideration is given to brand awareness, thought-leading content and events, webinars, podcasts, and other forms of engagement.

Customer experience: This criterion covers the products and services and/or programs that enable customers to achieve anticipated results with the products evaluated. Specifically, this includes quality supplier/buyer interactions, technical support or account support. This may also include ancillary services, customer support programs, availability of user groups, service-level agreements and the like. Additional consideration is given to general customer feedback and sentiment, the availability of customer success services, and customer case studies.

Operations: This criterion looks at the ability of the vendor to meet goals and commitments. Factors include quality of the organizational structure, skills, experiences, programs, systems and other vehicles that enable the organization to operate effectively and efficiently. Additional consideration is given to size and scalability of the organization, size and scalability of partners, and scalability of the platform.

Criteria for product service and customer experience are weighted high. These are often key drivers for vendor selection with potential buyers. Buyers express interest in product functionality, the vendor’s ability to deliver against objectives, overall satisfaction with the vendor, and the vendor’s ability to provide implementation, support and consistent delivery.

Criteria for overall viability, sales execution/pricing, market responsiveness, marketing execution and operations are weighted medium. This is to ensure vendors have sufficient investment and growth in their product, support a diverse set of customer requirements and have a track record of maintaining long-term customer relationships. It also ensures that included vendors have the ability to build brand-name recognition while using multiple brand channels to build market share in this emerging market.

Ability to Execute Evaluation Criteria

Enlarge Table

Evaluation CriteriaWeighting

Source: Gartner (July 2024)

Completeness of Vision

Completeness of Vision Evaluation Criteria

Enlarge Table

Evaluation CriteriaWeighting

Source: Gartner (July 2024)

Quadrant Descriptions

Leaders

Leaders exhibit strong execution and vision scores and exemplify the functionality required for IT organizations to continuously discover, manage and optimize SaaS. Leaders have the broadest set of capabilities, strongest roadmaps, a larger installed base, and cover the most geographic regions and industries.

Challengers

Challengers exhibit a strong set of technologies, marketing and sales execution, and intellectual property, as also exhibited by Leaders, but do not have the requisite strategic support, vision, innovation or roadmap to compete in the Leaders quadrant. Many tailor solutions to specific market segments or use cases.

Visionaries

Visionaries exhibit strong strategic support, vision, innovation and a robust roadmap, but have not yet amassed the requisite size, installed base, platform breadth or integration points to compete in the Leaders quadrant.

Niche Players

Niche Players exhibit consistent ability to address specific use cases, geographic regions, market segments or verticals. Their offerings, however, fail to provide a breadth of features and cannot scale to be relevant to all buyers.

Context

The goal of any Magic Quadrant is to provide a level view of comparable products (size, capability and corporate structure) to address the demands of a wide variety of buyers. Not every company’s requirements are identical. We encourage clients to review the accompanying Critical Capabilities research to review use case and functionality requirements, and this research to align industry expertise, vision, technology and cost requirements to the right vendor, regardless of the vendor’s quadrant.

Market Overview

The SMP market focuses primarily on addressing the operational and financial challenges associated with SaaS-hosted application portfolios.

Organizational SaaS spend continues to grow as organizations shift from traditional on-premises application hosting strategies to operationally efficient “as-a-service” delivery models. Per-employee SaaS spend currently averages $1,370, a 55% increase since 2021 (12% CAGR).1 Further compounding the challenge, Gartner estimates that as many as 25% of provisioned licenses are not regularly used by employees. In addition to increased spend, decentralized ownership and sourcing results in increased risk, as organizations are generally only aware of 40% of applications in use. Social media analysis has also revealed that some SaaS application vendors may be adopting less-transparent pricing practices, resulting in further challenges for buyers.2

Emerging governmental regulations (see Note 1) focused on asset discovery, risk assessment and disclosure require that many organizations maintain an accurate inventory of their application portfolio. Given the lack of visibility into SaaS application usage, most organizations will be unable to fully comply without a centralized SMP, alongside other asset management and security tools. Though the majority of regulations are currently focused on specific industries (mainly financial services and technology providers), Gartner expects these regulations to expand to all industries in the near future, further driving SMP market growth.

SMP providers often target four discrete buyer personas: IT asset management, IT security and compliance, IT procurement and IT operations. However, SMP features often are oriented toward the needs of IT procurement and IT operations, and most providers have the best success marketing and selling to them.

Many Gartner clients are not yet fully aware of the complexity and challenges presented by unmanaged SaaS portfolios and frequently rely on traditional, yet ineffective, tools and methods to identify and manage discrete SaaS application entitlements and usage. SaaS security tools such as SaaS security posture management (SSPM), cloud access security brokers (CASBs), and security service edge (SSE) can generally identify and block visits to SaaS provider websites. However, they often lack the context to distinguish between a site visit and actual usage. These tools also lack functionality to manage, automate, optimize or enable SaaS entitlements.

While hype has progressed past the Peak of Inflated Expectations (see Hype Cycle for Digital Workplace Infrastructure and IT Operations, 2024), demand from Gartner clients for SMP and related strategy topics remains low. Most conversations with Gartner clients are currently focused on solving a specific problem: trying to understand the market landscape; choosing between SMP, SaaS security and software asset management (SAM) tools; and overcoming resistance to adding another tool. Despite low client demand, Gartner recommends that organizations implement the capabilities of an SMP to reduce the financial, operational and visibility risks associated with unmanaged applications and the largely underestimated size and related spend within the SaaS portfolio.

Most of the vendors in this market are fairly nascent. Due to the relatively low market maturity and vendors’ need to generate revenue, buyers have significant leverage when negotiating SMP contracts. Despite this leverage, Gartner recommends negotiating relatively short-term contracts (one or two years), as it is difficult to determine the overall viability for many of the vendors in this report. Outcomes such as mergers, acquisitions and financial instability may impact the serviceability of vendors in this market.

Over the next 12 to 18 months, Gartner anticipates the following demand-side market changes:

  • Stronger partnerships and collaboration across procurement, finance, IT security and applications, and lines of business to control SaaS sprawl.
  • Organizations will centralize SaaS portfolio responsibility and will formalize roles in response to increased regulation and cost scrutiny.
  • Demand and budget for SaaS management will increase as organizations realize the magnitude of unmanaged SaaS cost, sprawl and risk, while adoption growth remains uncontrolled.
  • Increased use of SMP to monitor SaaS adoption and measure return on strategic SaaS investments.
  • Growing interest in automating employee onboarding and offboarding processes.
  • Rising demand for simplified contract negotiation and renewal, and detailed usage data to support rightsizing of contracts.

Over the next 12 to 18 months, Gartner anticipates the following supply-side market changes:

  • SMP vendors will increase their focus on high-value use cases within IT operations and IT procurement.
  • Traditional SAM market vendors will expand their capabilities to include SMP use cases.
  • Continued investor interest in and further funding of SMPs.
  • Increased normalization in base feature sets due to coalescing buyer needs and vendors’ needs for increased operational scalability.
  • Increased partnerships, as well as mergers and acquisitions, among SMP and adjacent tool vendors.
  • Introduction of managed services offerings from SMP, consulting and outsourcing vendors to address skills gaps. Few SMPs offer managed services today.
  • Increased focus on automation of common IT operations tasks, such as onboarding and offboarding, and automatic inactive license harvesting.
  • Increased number of direct SaaS application integrations from the average of 114 per vendor today.
  • Enhanced risk rating for SaaS applications, including compliance with common certifications and detection of data breaches.