SaaS spend management: what Zylo and Torii can see, and what they cannot

The inventory problem comes before the savings problem

Every platform here indexes data you already own: identity and licence assignment. Zylo discovers from accounts payable, expense and card records, turns payment lines into a classified application inventory, then reconciles SSO and usage against that baseline. Torii works from identity and browser signals instead.

The blind spot is measurable. Zylo puts the share of applications behind SSO at about 21%, and reports that an average of 51% of software purchases are not categorised as software inside expense and financial systems.

What each discovery method can and cannot see

SSO and IdP logs show the applications IT approved and connected, who is assigned to them and how often they sign in. They are the right foundation for access reviews and offboarding, and blind to free tiers signed up with a work address, tools bought on personal credentials, tenants inherited through an acquisition, and the AI tools a team adopts before anyone asks.

Browser telemetry answers what people do on the browsers it monitors, catching tools that never touched the identity provider. It misses a subscription bought on a personal card and used through a desktop client, because native apps and API-only integrations generate no browser traffic at all.

Expense and card data works from the money, so it needs only that a payment happened. That makes it the one method reaching purchases made outside IT, and it carries contract terms and renewal dates that login data never holds. It cannot see a free tool. Direct API and agent integrations report licence counts straight from the vendor, and coverage stops at the integration catalogue.

The tool is only as good as the identity data under it

Reclamation is arithmetic over three inputs: who exists, what they are licensed for, and what they touched. Groups carry members who changed team two reorganisations ago, so entitlement inherits from a group nobody maintains. Licences stay assigned to leavers because the joiner, mover, leaver process stops at the directory and never reaches the application, inflating the seat count the platform reports and the vendor negotiates against.

The clean-up means a named owner for every application, leaver automation that reaches the applications, and a rule that each licence belongs to a human or a service identity.

What reclamation recovers, quarter by quarter

The first quarter is where the arithmetic is easy: dormant seats, duplicate tools where three teams bought the same capability, and subscriptions on expense reports with no owner. That tranche pays for the subscription, arriving as cost avoidance more often than as a cancelled contract, because most agreements have months left to run.

The second quarter is where discipline shows. With a year of usage in the record, leverage moves to renewals: consolidating overlapping vendors, right-sizing tiers against measured consumption, and treating the renewal date rather than the budget cycle as the trigger. Teams that skipped the identity clean-up end up arguing about a seat count neither side trusts.

Some spend never comes back. A tool the business uses daily is not waste, whatever the per-seat cost. Capability bundled into a platform you already run gets paid for again at renewal. Contracts with minimum commitments resist reduction, and 38% of contracts are multi-year on average according to Zylo's index.

The renewal calendar is the product you actually run

A platform that only produces an inventory goes stale in a quarter. What keeps working is the calendar: every contract with its term end date, notice period, uplift clause and named owner, and a workflow that opens the renewal conversation while there is still something to negotiate. Torii attaches contract and renewal management to the same application record, and Vendr takes the renewal itself.

Two fields decide whether the calendar is worth anything. An agreement that renews automatically unless notice is given 60 or 90 days out turns a missed task into a twelve-month commitment, and a fixed annual uplift clause does the same slowly. Keep both in the platform as data, and route the alerts into procurement, because a reminder delivered to someone who has left is no reminder.

Per seat or percentage of spend, and which one grows against you

Both vendor platforms are quote only; no rate card is published. A per-seat subscription is priced on the population the platform manages, so it grows every time you hire even if software spend stays flat. Percentage-of-spend is priced on the estate being managed, so it grows when spend grows. Vendr sits outside both: its service is free to buyers, and it charges verified partners a transaction fee.

Per seat is predictable and easy to defend to finance, and it punishes headcount growth. Percentage-of-spend tracks the value delivered, so a platform that discovers more spend earns more for having found it. In an estate of a few thousand employees, per seat is usually the easier line to approve; where the inventory itself is the deliverable, the percentage model scales with the problem.

Whichever shape you buy, fix the denominator in the contract. Per seat priced on employees is a different number from per seat priced on licensed users, and the two diverge fastest in the estates that need this software most.

The decision

Zylo fits better when finance already holds the truth: if accounts payable, expense and card data are clean enough to classify, a spend-first inventory reaches shadow IT that an identity-first tool cannot see. Torii fits better when identity and access governance are already the centre of the programme, because discovery, licence consumption and the employee lifecycle share one record. Vendr is not a substitute for either: it is for teams that need the renewal negotiated and have no procurement bench.

LicenseFortress belongs on a different shortlist. It works on entitlement, deployment and usage across Oracle, Microsoft, IBM, VMware, SAP and Adobe, sold as a managed service with licensing specialists and legal counsel behind it. If the exposure sits in a perpetual-licence estate or an agreement measured in processor cores rather than named users, a per-user SaaS inventory will not touch it.

Productiv is no longer one of the options. The company ceased operations on 6 August 2026, terminated customer access the previous day and states that production systems, data stores and backups were destroyed with no customer data retained.