Flexera Archives - EasySAM https://easysam.co.uk/tag/flexera/ Software Asset Management. Simplified. Tue, 20 Oct 2026 13:35:10 +0000 en-GB hourly 1 https://wordpress.org/?v=7.1.4 https://easysam.co.uk/wp-content/uploads/2022/04/easysam_icon-60x60.png Flexera Archives - EasySAM https://easysam.co.uk/tag/flexera/ 32 32 The biggest IT compliance risks for 2027 https://easysam.co.uk/knowledge-base/the-biggest-it-compliance-risks-for-2027/ Wed, 21 Oct 2026 08:51:00 +0000 https://easysam.co.uk/?p=38502 IT compliance in 2027 could bring unexpected changes for teams that aren’t prepared. Find out what to focus on now and how to get ahead.

The post The biggest IT compliance risks for 2027 appeared first on EasySAM.

]]>
Search Mobile-alt Envelope Linkedin Bell

Flexera

Search Mobile-alt Envelope Bell

Find out more below

Flexera

IT compliance in 2027 could bring unexpected changes for teams that aren’t prepared. Find out what to focus on now and how to get ahead.

Published on 21st October 2026

Ask almost any IT leader how they feel about compliance and you will hear a familiar sigh: it is an exhausting, endless cycle of audit prep, messy spreadsheets and scrambling to show that corporate policies exist on paper.

Yet managing IT compliance is not getting harder simply because lawmakers are writing more rules. The real issue is that the technology beneath those rules is changing just as fast as the legal text.

Machine learning models and AI systems are being spun up across every business unit. Cloud infrastructure, SaaS tools and remote endpoints have pushed corporate environments far beyond the traditional datacenter perimeter. Every custom platform or enterprise software package depends on sprawling software supply chains loaded with third-party libraries, external micro-services and outside vendors. At the same time, regulators have stopped accepting static paperwork: they want real, demonstrable proof of how you find, control and report technology risks across your stack.

That reality makes 2027 a critical year for IT compliance and risk management.

A wave of major compliance regulations is either already live or heading straight for firm implementation deadlines. The phased rollout of the EU AI Act continues, while the EU Cyber Resilience Act (CRA) takes broad effect on December 11, 2027.

The day-to-day challenge for IT leaders, enterprise architects and compliance officers goes well beyond pinning deadlines to a wall calendar. What matters is knowing what technology you have, the risks tied to it, who is responsible for it and whether your compliance controls can stand up to genuine technical scrutiny.

Here are the seven major enterprise IT compliance risks:

1. AI governance must move from policy to proof

Over the past few years, enterprise AI adoption has moved at breakneck speed. Teams across marketing, engineering and customer support rushed to adopt shiny new generative tools to move faster. Corporate compliance programs, caught off guard, have been playing catch-up ever since.

Heading toward 2027, that catch-up game has to turn into an organised, defensible system.

The biggest driver here is the EU AI Act, an expansive, risk-based regulatory framework governing how organisations build, market, deploy and run AI software. It introduces stringent rules for high-risk AI systems, clear transparency requirements for tools that interact with users or create synthetic content and strict oversight for general-purpose AI models.

Do not make the mistake of assuming this only matters to companies registered in Frankfurt or Paris. The Act has teeth outside Europe, applying to providers and deployers worldwide whenever the output generated by their AI system is used within the European Union.

The compliance timeline has also continued to shift. Following amendments under Regulation (EU) 2026/1744 in July 2026, the legislative schedule is locked in: the entire framework is set to be fully applicable by August 2, 2027.

That timeline makes AI governance much more than a routine legal drafting exercise. Before you can even tell which compliance requirements apply to your business, you need a clear, unvarnished accounting of what models are running and what your exact role is with each of them.

This visibility gets complicated fast when employees adopt off-the-shelf AI tools on corporate credit cards without talking to procurement or security. This widespread Shadow AI leaves governance teams with huge blind spots, making it nearly impossible to evaluate data exposure, model bias or intellectual property risks.

How to prepare

  • Build an honest inventory of your AI estate: Run discovery across business units to find active AI software, custom in-house models and SaaS applications with embedded AI features. Record what business problem each tool solves, where its training data comes from and who internally owns it
  • Define your role under the law: Evaluate each system to determine whether your organisation is acting as an AI provider (building or tuning models) or a deployer (putting someone else’s model to work). Your compliance duties look very different depending on which category you fall into
  • Tie AI into your existing IT compliance and governance processes: Do not build a completely separate, disconnected AI silo. Connect AI oversight straight into your existing vulnerability management, data privacy rules and access control systems
  • Create clear, practical guardrails: The point of AI governance is not to kill innovation or ban helpful tools. It is about building enough visibility so you know what is running, understand your exposure and meet your AI regulation compliance duties without friction

2. End-of-life technology is easier to exploit

Ask an engineer why a piece of software is still running on an internal server, and you will often hear: “If we touch it, the whole workflow breaks.”

Software and hardware do not disappear just because a vendor decides to stop supporting them. They stay right where they are: quietly ageing and getting riskier by the day.

End-of-life technology has always weakened security and compliance controls. The growing problem now is how quickly threat actors can discover and expose these weaknesses, frequently chaining together even low-level vulnerabilities in unpatched software to compromise an environment. For regulated sectors like financial services, demonstrating that the operational stack is free of obsolete or vulnerable software has become a direct compliance requirement under frameworks like DORA and FCA standards, where unsupported systems can no longer receive the fixes needed to pass an audit.

The Cybersecurity and Infrastructure Security Agency (CISA) has been plain about this: running unsupported or end-of-life software across critical infrastructure is a dangerous practice that sharply escalates enterprise risk. When a product crosses into end-of-life (EOL) status, security patches stop, bug fixes disappear and routine vulnerability handling ends.

That danger is particularly real at the network edge. In joint guidance, CISA, the FBI and the UK National Cyber Security Centre (NCSC) warned that unpatched, end-of-support edge devices, such as older firewalls, VPN appliances and routers, are prime targets for threat actors. Attackers routinely scan for well-known, unresolved bugs in ageing edge hardware to bypass perimeter network security, establish access and move laterally into supported corporate networks.

For IT teams, this creates a major breakdown between written policy and real-world compliance controls.

You can write pristine corporate policies on regular patching, identity management and data protection, but those controls fall flat during a compliance audit if obsolete systems in your environment can no longer take patches or integrate with modern identity-based access control.

Regulators are paying closer attention to this lifecycle reality. The EU Cyber Resilience Act (CRA) establishes mandatory cybersecurity requirements across the entire lifecycle of products with digital elements, focusing heavily on vulnerability management and requiring vendors to be clear about their product support periods. The goal is to give buyers the transparency they need to stop buying blind and manage hardware and software lifecycles responsibly.

How to prepare

  • Keep your asset discovery current: Make sure your hardware and software inventory captures everything on your network, separating active, fully supported products from assets that are approaching or already past their vendor support dates
  • Actively search for undocumented edge devices: Follow CISA, FBI and UK NCSC guidance by auditing your network perimeter for forgotten, outdated edge hardware. Check that your firewalls, nextgen firewalls and intrusion prevention systems are running supported, patchable firmware
  • Connect asset lifecycle data to your vulnerability scans: An end-of-life spreadsheet tucked away in an IT drawer helps no one. Link your lifecycle tracking directly to your security tooling so unpatchable assets are flagged and prioritised for replacement
  • Ask the tough operational questions: Stop settling for knowing that an unsupported application exists. Find out: Where does it sit? What critical business processes depend on it? What temporary compensating controls protect it? And what is our actual plan to replace or decommission it?

3. Software supply-chain obligations reach deeper into the technology stack

Virtually no enterprise builds applications completely from scratch these days.

Modern software is assembled from open-source packages, external libraries, commercial frameworks, and cloud APIs. If any single piece of that upstream chain contains a critical flaw, that vulnerability flows straight into your production environment. That reality has dragged supply chain security out of the procurement office and placed it right at the heart of IT risk and compliance.

The EU Cyber Resilience Act makes this shift impossible to ignore as 2027 approaches. The regulation covers hardware and software products with digital elements, requiring manufacturers to manage cybersecurity and vulnerability handling throughout the entire lifecycle of their offerings.

The bulk of the CRA takes effect on December 11, 2027, but treating that date as a distant problem is a mistake. Certain obligations, like early vulnerability reporting, arrive much sooner and reworking software pipelines, vendor agreements and vulnerability processes takes significant time.

A big part of meeting these expectations comes down to software transparency, which is where the Software Bill of Materials (SBOM) comes in. Think of an SBOM as a comprehensive ingredients list that spells out every component, library and dependency used to build a piece of software. NIST emphasises that SBOMs bring much-needed visibility to software supply chains, helping teams identify and remediate newly discovered vulnerabilities much faster. Yet an SBOM is not an automatic security shield.

NIST specifically cautions against ditching everyday cyber supply chain hygiene, like regular vendor risk reviews and active vulnerability scans, just because you collected an SBOM. An SBOM is simply a document; your team still needs the systems and workflows to ingest that file, analyse its contents and act when a problem turns up.

That distinction is everything. Passing an audit is not about proving you saved a vendor’s SBOM to a shared drive. It is about proving that your IT and security teams can take that component data, check it against your deployed software and make fast, defensible decisions to fix vulnerabilities before they are exploited.

How to prepare

  • Map out your software dependencies and key vendors: Pinpoint your most critical software applications and figure out which external libraries, open-source packages and third-party vendors they rely on
  • Integrate SBOMs into your active vulnerability workflows: When software vendors provide SBOMs, do not treat them as static compliance paperwork. Ingest that component data into your vulnerability management systems so new Common Vulnerabilities and Exposures (CVEs) trigger automated alerts
  • Review vendor contracts and security commitments: Update your vendor agreements to clarify expectations around support windows, component transparency and rapid vulnerability disclosure
  • Lean on solid IT asset management (ITAM): You cannot trace a vulnerable library if you do not know where the parent application is installed. Reliable asset management connects an abstract list of software components to the actual servers, virtual machines and cloud instances running inside your business

4. Fragmented technology makes compliance harder to prove

The days of managing IT out of a single server room are long gone.

Today’s technology estate is split across multiple public clouds, SaaS platforms, on-premises datacenters and remote employee laptops. Data travels back and forth constantly, while employee identities, privileges and access control systems span dozens of separate environments.

Where data resides adds another layer of complexity. Compliance teams must navigate strict data residency requirements, where certain regulations mandate that sensitive data must be held in-country or cannot be stored in public cloud environments. Under GDPR, transfers of personal data outside the European Economic Area are subject to specific legal safeguards rather than a blanket requirement that all personal data remain within Europe. In a fragmented cloud and SaaS environment, IT teams need direct visibility into the applications handling regulated data, where that data is processed and whether local residency rules are met.

This fragmentation creates a massive headache when it comes time to prove that your compliance controls actually work. Regulatory frameworks rarely accept good intentions. They demand clear, demonstrable proof that your security measures are live, configured properly and protecting the systems they are supposed to protect.

Take the NIS2 Directive across the European Union. It introduces widespread cybersecurity risk-management and reporting rules for covered entities in critical industries, including energy, transport, banking, healthcare, digital infrastructure, cloud computing and managed service providers.

NIS2 does not let teams focus on a single isolated security control. It demands broad operational capability across incident handling, supply chain security, access control and active vulnerability management.

This is where many IT teams run into practical trouble: having a well-written policy on a company wiki is not the same as having the day-to-day visibility needed to apply and prove those controls consistently.

When auditors ask tough questions, disconnected systems make it nearly impossible to answer with confidence:

  • Can your team produce an accurate, complete list of every digital asset on your network?
  • Do you know the exact versions and builds of software running in production right now?
  • Can you tie every server, cloud workload, and application to an accountable business owner and supplier?
  • Can you quickly surface every piece of unsupported software and unpatched vulnerability across the company?
  • Can you show where regulated data is stored or processed and identify the applications and providers responsible for it?

When different departments rely on contradictory spreadsheets and fragmented tools, answering those questions feels like conjecture. Auditors also require detailed information about asset lineage, provenance and historical perspective rather than just a snapshot of what the environment looks like today. Organisations need historical records showing how assets, configurations, ownership, lifecycle status or controls changed over time. When that history is scattered across spreadsheets and disconnected systems, producing reliable evidence becomes much harder.

As NIST outlines in its SP 1800-5 guidance on IT asset management, having clear, unified asset visibility forms the foundation of enterprise security. Tying physical, virtual and cloud assets together gives leadership a dependable view of what exists and where it lives, giving security analysts the context they need to investigate threats and defend the organisation.

How to prepare

  • Treat your technology inventory as a compliance essential: Stop looking at your IT inventory as just an operational IT database. A complete, accurate view of your hardware, software and cloud assets is the bedrock of your entire compliance program
  • Enrich asset data with real operational context: Bring together raw hardware and software inventories and link them with business services, asset owners, vendor lifecycles and known security vulnerabilities
  • Map controls directly to specific assets: Stop treating compliance rules like abstract ideas. Connect specific statutory requirements, like data encryption, privileged access and logging, directly to the systems and workloads within their scope
  • Get your cross-functional teams onto one page: Break down the walls between security, infrastructure, legal and risk teams. When everyone works from the same reliable technology data, evaluating risk becomes faster, cleaner and far more accurate

5. Overlapping reporting obligations test disconnected processes

When a major security incident strikes, stopping the bleeding and restoring backups is only your first hurdle.

Right behind the engineering response comes a wave of urgent legal questions: Does this event cross a regulatory notification line? What customer records or internal data were exposed? Were third-party vendors involved? And who internally is authorised to make the official reporting call?

These questions get messy when an organisation is subject to multiple frameworks, each with its own definitions, triggers and deadlines.

In the United States, public companies answer to the Securities and Exchange Commission (SEC) rules on cybersecurity disclosure. Under these rules, domestic registrants must disclose a material cybersecurity incident on Form 8-K generally within four business days.

Keep in mind that the four-day clock does not start the second an analyst spots strange network traffic. The countdown starts once the organisation officially determines that the incident is material. That determination requires swift, coordinated communication between technical responders, financial leaders and corporate legal counsel.

The SEC rules also require annual reporting covering your broader approach to cybersecurity risk management, strategy, and leadership governance.

Across the Atlantic, European regulations enforce their own aggressive reporting timelines. Under NIS2, covered entities face an early warning requirement within 24 hours of becoming aware of a significant incident, followed by detailed formal notifications. At the same time, the EU Cyber Resilience Act imposes strict reporting obligations on manufacturers of digital products to report actively exploited vulnerabilities and serious incidents to authorities within tight windows.

The reality is that there is no single, universal reporting timeline.

Instead, organisations face a tangled web of differing thresholds and deadlines that depend heavily on your industry, geography, and the nature of the breach. If your incident responders, risk managers, and legal counsel work in disconnected silos, that friction can cause you to miss mandatory reporting windows and face major regulatory penalties.

How to prepare

  • Document all applicable incident reporting rules: Review your regulatory and contractual obligations (including the SEC, NIS2, CRA, GDPR, and PCI DSS) and document exactly what constitutes a reportable event, what the deadline is and who receives the notification
  • Establish clear internal escalation workflows: Clarify how security incidents get escalated from the technical operations floor to legal counsel and executive leadership. Make sure everyone knows who leads materiality discussions and who makes final reporting decisions
  • Give incident response teams immediate technical context: When an incident occurs, responders cannot afford to spend hours guessing which business processes rely on a compromised server, what software version it runs or which suppliers support it. They need that context instantly
  • Run tabletop simulation drills: Test your escalation paths and reporting protocols before a real crisis hits. Bring security, IT, risk, legal and executive teams together to work through realistic scenarios, ironing out friction points before real reporting clocks start ticking

6. AI agents create a new identity and access challenge

AI governance gets harder when AI moves from answering questions to taking action.

AI agents can interact with enterprise data, invoke tools and APIs and carry out multi-step workflows across different systems. That introduces a new layer of risk around identity and access control: Which agents can access sensitive resources? What actions can each agent take? And who is accountable for that access?

Least privilege becomes particularly important. Agents should have access only to the data, systems and actions required for their approved purpose rather than inheriting broad permissions simply because the person or team creating them already has that access.

The risk can also grow as agents connect to more systems. An agent with individually limited access to email, files, business applications and other tools may accumulate much broader capabilities when those permissions are combined. Current Microsoft security guidance warns that AI agents can experience permission creep, excessive aggregate privileges and overly broad tool access when identity and authorisation controls are not designed carefully.

Ownership matters too. An agent’s business purpose, permissions and accountable owner can change over time, especially when employees change roles or leave the organisation entirely. Without proper lifecycle management, orphaned agents can continue running in the background with persistent access to data they no longer need. Organisations therefore need lifecycle governance that makes it clear who is responsible for an agent, treats agents as managed identities and ensures ownership and access are reviewed, transferred or revoked when personnel depart.

How to prepare

  • Give AI agents distinct identities: Maintain visibility into which agent is accessing enterprise resources and make sure its activity can be attributed and audited
  • Apply least-privilege access: Give each agent only the data, tools and permissions required for its approved task and review those privileges as its responsibilities change
  • Assign clear ownership and manage off-boarding: Every enterprise AI agent should have an accountable human owner responsible for its purpose and access. When an employee leaves the company or moves teams, include agent ownership and access permissions in standard off-boarding processes so orphaned agents do not retain access to corporate data
  • Review agent access throughout its lifecycle: Reassess permissions when an agent’s purpose changes and remove access that is no longer needed
  • Keep an audit trail: Maintain sufficient visibility into agent identities and actions to support security investigations and compliance reviews

7. Sustainability reporting puts IT data under greater scrutiny

IT compliance is increasingly connected to another source of enterprise reporting pressure: sustainability.

In the European Union, companies within the scope of the Corporate Sustainability Reporting Directive (CSRD) are required to disclose information about sustainability-related risks, opportunities and impacts using European Sustainability Reporting Standards (ESRS). The framework has continued to evolve as the EU refines and simplifies its sustainability reporting requirements.

For IT leaders, the important point is that sustainability reporting can create another demand for reliable operational data. As technology estates span physical hardware, datacenters, cloud infrastructure and other services, organisations need confidence in the information feeding their sustainability reporting processes.

The challenge will sound familiar to compliance teams. Hardware inventories can become outdated. Cloud environments change constantly. Technology ownership is split between teams. Different data sources can produce different answers.

When technology information contributes to formal corporate reporting, inconsistent or incomplete data becomes more than an IT housekeeping problem. Organisations need data that can be traced, explained and governed consistently.

How to prepare

  • Understand what sustainability requirements apply: Work with sustainability, finance and legal teams to establish which reporting requirements affect your organisation
  • Identify the IT data used in reporting: Determine which technology-related information feeds your sustainability reporting processes and where that information originates
  • Improve asset data quality: Maintain reliable hardware and infrastructure information rather than depending solely on manually reconciled snapshots
  • Establish clear data ownership: Identify which teams are responsible for providing, validating and maintaining technology data used in sustainability reporting
  • Keep supporting evidence: Maintain the underlying data and methodology needed to explain how technology-related sustainability information was produced

IT compliance checklist for 2027

Because every enterprise runs a unique technology stack and answers to different regulators, there is no universal, magic checklist that guarantees compliance.

However, addressing these practical checkpoints will put your team in a far stronger position heading into 2027:

  • Inventory your technology estate: Maintain an accurate, up-to-date accounting of the hardware, installed software, cloud workloads and SaaS tools across your organisation
  • Inventory AI systems and determine regulatory scope: Uncover where AI tools, models and features are deployed across departments, identify designated system owners and establish your organisation’s legal classification (provider vs. deployer) under the EU AI Act
  • Govern AI agent identities, permissions and off-boarding: Treat autonomous AI agents as distinct machine identities governed by least-privilege data access and embed agent ownership into standard employee off-boarding so access is revoked or reassigned when personnel leave
  • Track asset lifecycles to catch end-of-life risks: Keep a close eye on vendor support dates to spot end-of-life and end-of-support hardware and software early, prioritising remediation based on operational risk
  • Track relevant data locations: Connect applications and providers with information about where regulated data is stored, processed or accessed to ensure compliance with in-country data residency requirements and international transfer rules
  • Preserve historical context: Maintain auditable records of asset provenance, configuration changes, ownership transitions and lifecycle status over time rather than relying solely on today’s inventory
  • Connect IT assets directly to vulnerability data: Make sure your vulnerability management tools talk directly to your asset inventory so you can quickly see whether a newly disclosed CVE affects systems in your environment
  • Strengthen software supply chain transparency: Track component dependencies, ingest SBOMs where appropriate and review security expectations with your third-party software vendors
  • Link compliance controls to real infrastructure: Make sure your mandatory cybersecurity controls, such as identity-based access control, network segmentation, firewalls and encryption, are mapped directly to the systems they protect
  • Clarify applicable regulatory requirements: Take the time to figure out which compliance regulations actually apply to your operations (like NIS2, CRA, DORA or SEC rules) rather than relying on generic, surface-level guidance
  • Define incident reporting roles and escalation paths: Document who evaluates incident severity, who makes legal materiality calls and who owns communication with regulatory bodies
  • Move from static audits to continuous tracking: Stop relying on once-a-year snapshot audits in an enterprise environment that changes every single day. Implement continuous visibility that catches compliance drift in real time

You can’t govern what you can’t see

The biggest IT compliance risks heading into 2027 share a fundamental truth.

Whether your team is dealing with AI governance, unsupported edge devices, software supply chain obligations, distributed security controls or high-stakes incident reporting deadlines, compliance breaks down when you do not have a reliable, current picture of the technology you run.

That does not mean asset visibility is a substitute for a compliance program. Visibility on its own will not draft policies, conduct risk assessments or manage legal reviews.

What it does is provide a dependable foundation. When your IT compliance, risk and security teams work from an accurate picture of your technology estate, they can evaluate risk realistically, apply controls where they matter and generate audit evidence that stands up to scrutiny.

Meeting modern compliance demands cannot be solved by a single tool or dumped onto a single department. It takes active, coordinated work across IT asset management, cybersecurity, enterprise architecture, procurement and risk teams.

Heading into 2027, organisations do not need another isolated compliance dashboard or another unread policy document. They need clear, trustworthy insight into their technology environment so every stakeholder can make smarter, safer decisions.

Because the most dangerous compliance risk heading into 2027 might not be the next major regulation. It might simply be the technology already running inside your business that nobody is watching.

Is your software estate a compliance risk waiting to happen?

Take control before the risks become reality. Our software asset management solutions help you gain visibility of your software estate, optimise licence usage and maintain compliance with vendor agreements — reducing risk while keeping costs under control.

Get in touch

Source

https://www.flexera.com/blog/it-asset-management/it-compliance-risks/

Image Credit

Fahim Hamim via Vecteezy

The post The biggest IT compliance risks for 2027 appeared first on EasySAM.

]]> Flexera 2026 State of ITAM Report: How teams are regaining control of cloud, SaaS and AI https://easysam.co.uk/news/flexera-2026-state-of-itam-report-how-teams-are-regaining-control-of-cloud-saas-and-ai/ Fri, 03 Jul 2026 08:55:22 +0000 https://easysam.co.uk/?p=37757 Real progress has been made; but organisations can't let up, with AI and SaaS expansion moving faster than most can govern.

The post Flexera 2026 State of ITAM Report: How teams are regaining control of cloud, SaaS and AI appeared first on EasySAM.

]]>
Search Mobile-alt Envelope Linkedin Bell

Flexera

Search Mobile-alt Envelope Bell

Find out more below

Flexera

Real progress has been made; but organisations can't let up, with AI and SaaS expansion moving faster than most can govern.

Published on 3rd July 2026

As organisations scale across SaaS, public cloud and AI, ITAM teams are being asked to do more than track assets: They’re expected to restore visibility, prove value and govern environments that are growing faster than policy can keep up.

Based on a global survey of 512 professionals, Flexera’s 2026 State of ITAM Report shows clear progress. But complexity continues to outpace control.

Below, we break down the key findings through the lens of the questions IT leaders are asking most right now.

The visibility gap across cloud, SaaS and AI

Visibility remains the biggest structural gap in modern ITAM.

  • Only 31% of organisations report visibility into AI software
  • Complete IT visibility has dropped to 36%, down from 43% in 2025
  • Tracking or adopting AI applications is now the top combined challenge, cited by 84%

While visibility into on-premises, SaaS and cloud environments continues to improve, AI has created a new blind spot.

At the same time, ITAM’s scope is expanding:

  • 75% manage cloud software licenses
  • 64% manage SaaS licenses
  • 51% support AI spend visibility

Takeaway
Visibility is no longer a tooling problem. It’s a scope problem. As asset types expand, ITAM teams need a single system of record that spans cloud, SaaS and AI.

The growing pressure to prove ROI on AI, cloud and SaaS

Optimisation remains the clearest path to proving value. But AI is still catching up.

  • Optimising software spend is the number one SAM priority, leading all others by more than 19 percentage points
  • ITAM teams spend the largest share of SAM time optimising cloud and SaaS software
  • Nearly one-third of total ITAM time is dedicated to software optimisation

AI introduces a new challenge:

  • AI tools aren’t yet producing strong savings outcomes
  • Only 29% of organisations currently measure the value of AI software
Meanwhile, proven ROI drivers still dominate:
  • License reuse generates significant savings for 43% of organisations
  • Mature ITAM programs consistently deliver savings through reuse and negotiation

Takeaway
For most organisations, ROI comes from optimisation, reuse and governance. AI investments are scaling fast, but value realisation hasn’t kept pace.

Escalating waste and audit exposure across the IT estate

AI adoption is moving faster than governance frameworks can support.

  • 59% of organisations report increased wasted AI spend
  • Only 31% have visibility into AI software
  • 48% are tracking and rightsizing AI contracts
  • 45% are actively identifying unsanctioned AI usage
The challenge isn’t adoption. It’s an uncontrolled growth.
  • AI tracking is the top planned responsibility for ITAM teams
  • More than half of ITAM teams already support AI-related activities

Takeaway
Most organisations are reacting to AI risk instead of preventing it. ITAM is emerging as the control layer that brings structure, accountability and guardrails to AI experimentation.

Cost pressure and audit exposure remain persistent and expensive.

  • 48% of organisations were audited in the past year
  • 44% spent more than $1,000,000 on audits over the past three years
  • 64% of audited organisations reported Microsoft audits

Takeaway
Audit risk and waste aren’t disappearing. They’re evolving alongside AI and SaaS complexity. Organisations that improve visibility and licence control stand to unlock the greatest financial gains.

Why SaaS management is harder than expected

SaaS sprawl, cost pressure and fragmented ownership continue to create challenges.

  • Tracking SaaS and public cloud software keeps rising as a core ITAM responsibility
  • SaaS wasted spend continues to increase year over year
  • Negotiating SaaS contract terms jumped 14 percentage points compared to 2025
The root causes are clear:
  • A growing number of applications
  • Decentralised procurement
  • Increasingly complex software use rights

Not surprisingly, 78% of ITAM teams say maintaining an accurate inventory is their top priority.

Takeaway
SaaS is difficult to manage because it’s fast-moving, fragmented and hard to normalise. Without strong inventory, discipline and governance, sprawl becomes unavoidable.

The bigger shift: ITAM is evolving from SAM and HAM

Across every trend, one theme stands out. ITAM is becoming a strategic control layer for cloud, SaaS and AI.

  • 78% of organisations now have a FinOps team, and ITAM and FinOps responsibilities increasingly overlap
  • Ownership of cloud optimisation is nearly split between ITAM and FinOps

This convergence reflects a new operating model:

  • ITAM owns visibility and governance
  • FinOps owns financial accountability
  • Together, they define how organisations can control technology spend at scale

Final takeaway

The findings in the report show real progress, but it also makes one thing clear: AI and SaaS expansion are moving faster than most organisations can govern. To do this, leading teams are focusing on three priorities:

  • Unifying visibility across cloud, SaaS and AI
  • Driving measurable ROI through optimisation and reuse
  • Closing governance gaps before they turn into financial or audit risk

Get the full picture

See how your organisation stacks up against others in Flexera’s 2026 State of ITAM Report.

Read the full report

Source

https://www.flexera.com/blog/it-asset-management/state-of-itam-2026/

Image Credit

Flexera

The post Flexera 2026 State of ITAM Report: How teams are regaining control of cloud, SaaS and AI appeared first on EasySAM.

]]> Flexera 2026 State of ITAM Report: How leaders are balancing AI cost optimisation and governance https://easysam.co.uk/news/flexera-2026-state-of-itam-report-how-leaders-are-balancing-ai-cost-optimisation-and-governance/ Thu, 02 Jul 2026 10:46:45 +0000 https://easysam.co.uk/?p=37738 AI is reshaping ITAM faster than any previous technology shift - but that doesn't mean the fundamentals of good ITAM have changed.

The post Flexera 2026 State of ITAM Report: How leaders are balancing AI cost optimisation and governance appeared first on EasySAM.

]]>
Search Mobile-alt Envelope Linkedin Bell

Flexera

Search Mobile-alt Envelope Bell

Find out more below

Flexera

AI is reshaping ITAM faster than any previous technology shift - but that doesn't mean the fundamentals of good ITAM have changed.

Published on 2nd July 2026

Flexera’s newly-released 2026 State of ITAM Report reveals a growing disconnect: Organisations are investing heavily in AI tools, yet many lack the visibility and governance needed to manage them effectively. This tension creates a new challenge, and IT leaders are asking themselves:

How do we govern AI usage without slowing innovation and limiting ROI?

Below, is a breakdown of the key AI-specific findings shaping enterprise ITAM strategies today.

AI adoption is accelerating—but only 31% of organisations report having visibility into AI software

AI has rapidly moved from experimentation to a core part of the IT estate.

  • AI tools have surged in importance, rising from 1.94 to 3.13 on a 5-point technology relevance scale in just one year
  • 47% of organisations plan to significantly increase their focus on AI software
  • Only 36% report complete visibility across their IT estate, a year-over-year decline

At the same time, 84% of respondents highlight AI tracking as a top challenge. AI is expanding faster than traditional asset management models can support. Without visibility into AI tools being used, organisations risk operating with blind spots across cost, usage and risk.

Only 32% of organisations track AI applications within their configuration management database (CMDB)

AI governance is struggling to keep pace with adoption. As AI usage grows, governance gaps are becoming more visible.

  • 45% are actively identifying unsanctioned or shadow AI usage
  • 58% of SAM teams tracking AI report into cybersecurity teams, signalling a shift toward security-driven oversight
  • AI tracking is now the top planned ITAM responsibility at 47%

AI governance today is largely reactive. Most organisations are trying to catch up with adoption rather than controlling it upfront. Governance models are often built after AI is already embedded across the environment.

AI cost management is emerging as a critical challenge: 59% of organisations report increased wasted AI spend

AI doesn’t just add more tools. It changes how tools behave, and that’s why AI makes SaaS sprawl harder to control. AI-enabled SaaS often:

  • AI-related spend tracking is now bundled into broader software spend management for many organisations
  • More than half of ITAM teams already support AI spend visibility responsibilities

AI cost management is still immature. Rapid experimentation and decentralised adoption are driving inefficiency before optimisation frameworks are fully in place.

With only 29% of organisations measuring the value of AI software, determining ROI is still in early stages

While investment in AI continues to grow, value realisation remains limited.

  • According to survey respondents, AI tools aren’t yet delivering strong savings outcomes compared with SaaS or cloud optimisation
  • 48% of organisations are already tracking and rightsizing AI contracts

Organisations are starting to apply traditional optimisation practices to AI, but ROI frameworks are still catching up. The challenge isn’t just controlling cost—it’s proving business value.

AI usage governance is becoming a shared responsibility

AI is accelerating the convergence of ITAM, FinOps and security teams.

  • 51% of ITAM teams support AI spend visibility
  • AI governance responsibilities now span IT, security and financial teams
  • Many organisations split accountability for optimisation and cost control across functions

Governing AI usage is no longer owned by a single function; it requires cross-team coordination between ITAM and FinOps. That adds complexity, but it also creates an opportunity for stronger control and clearer accountability.

The core challenge: governing AI without limiting innovation

Across all findings, one tension stands out: organisations want and need to control AI usage—but not at the expense of innovation or speed.
  • Too much governance creates friction
  • Too little governance creates risk and waste

Today, many organisations lean toward fast adoption followed by delayed governance.

How leading organisations are closing the gap between increasing governance without delaying AI’s output

While the report highlights real challenges, it also shows where organisations are focusing next.

  • Expanding AI visibility across tools and environments
  • Integrating AI tracking into existing ITAM and CMDB systems
  • Applying cost optimisation practices such as rightsizing and contract management to AI
  • Strengthening alignment between ITAM, FinOps and security teams

The goal isn’t to slow AI adoption. It’s to make AI measurable, governable and accountable.

Final takeaway

AI is reshaping ITAM faster than any previous technology shift. But the fundamentals haven’t changed. The organisations that succeed will treat AI not as a standalone experiment, but as a managed, measurable part of the IT estate.

Get the full picture

See how your AI governance and cost optimisation stacks up against other organisations in Flexera’s 2026 State of ITAM Report.

Read the full report

Source

https://www.flexera.com/blog/it-asset-management/state-of-itam-2026-ai-cost-optimization/

Image Credit

Flexera

The post Flexera 2026 State of ITAM Report: How leaders are balancing AI cost optimisation and governance appeared first on EasySAM.

]]> Flexera 2026 State of ITAM Report: why SaaS sprawl is no longer just an IT problem https://easysam.co.uk/news/flexera-2026-state-of-itam-report-why-saas-sprawl-is-no-longer-just-an-it-problem/ Tue, 30 Jun 2026 12:33:16 +0000 https://easysam.co.uk/?p=37721 Without centralised visibility, SaaS environments grow organically. And organic growth rarely aligns with governance, security or cost control.

The post Flexera 2026 State of ITAM Report: why SaaS sprawl is no longer just an IT problem appeared first on EasySAM.

]]>
Search Mobile-alt Envelope Linkedin Bell

Flexera

Search Mobile-alt Envelope Bell

Find out more below

Flexera

Without centralised visibility, SaaS environments grow organically. And organic growth rarely aligns with governance, security or cost control.

Published on 30th June 2026

After 5+ years of Flexera’s State of ITAM report, one thing’s clear: there’s no shortage of daily challenges faced by ITAM teams. Business units now buy applications directly. Teams experiment with unsanctioned AI tools. Free trials turn into paid subscriptions. All while overlapping apps stack up across departments. All of this rolls up under SaaS sprawl.

SaaS sprawl isn’t about having too many tools. It’s about losing control over:

  • What applications are in use
  • Who owns them
  • How they’re being used
  • What they actually cost

In this year’s edition of the report, we can see that this challenge is intensifying. Managing new environments—including SaaS—is now cited as a significant and rising challenge year over year, alongside AI adoption and software complexity.

Without centralised visibility, SaaS environments grow organically. And organic growth rarely aligns with governance, security or cost control.

Only 36% of organisations report complete visibility into their IT estate

Traditional asset management models weren’t built for SaaS.

Unlike on-premises software, SaaS applications don’t sit neatly behind procurement or deployment processes. They enter the environment through expense reports, credit cards and browser logins.

That creates several visibility gaps:

  • IT doesn’t see what the business buys
  • Finance doesn’t see how tools are used
  • Security doesn’t know where sensitive data flows

AI-driven SaaS compounds the issue. These tools often expand usage dynamically, consume credits unpredictably and introduce new data and compliance risks. While 78% of ITAM teams say maintaining accurate inventory is their top priority, SaaS sprawl can soon become a never-ending challenge.

SaaS cost management breaks down before optimisation begins

SaaS cost management isn’t failing because teams aren’t trying. It’s failing because cost optimisation depends on visibility—and most organisations don’t have it. According to Flexera’s State of ITAM 2026 Report, a lack of visibility has major impacts on cost:

  • SaaS wasted spend increased year over year, contributing to broader software inefficiencies
  • Optimising software spend remains the #1 priority for SAM teams, leading all other initiatives by a wide margin

AI spend adds another layer of uncertainty. Consumption-based pricing and experimentation-driven usage make forecasting difficult.

Managing SaaS now requires shared ownership: why 78% of organisations have a FinOps team

SaaS used to sit squarely with IT, but today managing SaaS applications requires coordination across:
  • IT for application inventory and lifecycle management
  • Finance for cost tracking and optimisation
  • Security for risk, compliance and data governance
  • Business teams for usage context and value alignment

The shift is already underway:

  • 78% of organisations now have a FinOps team, reflecting growing shared ownership of cost and optimisation
  • ITAM now works more closely with cloud, finance and security teams as responsibilities expand

AI-powered SaaS accelerates this shift. Governance decisions now affect innovation speed, employee productivity and competitive advantage.

59% report increased wasted AI spend

AI doesn’t just add more tools. It changes how tools behave, and that’s why AI makes SaaS sprawl harder to control. AI-enabled SaaS often:

  • Scales usage dynamically
  • Introduces new pricing models
  • Creates indirect data exposure risks
  • Delivers value that’s harder to quantify
The data highlights just how quickly this is evolving:
  • AI software importance surged from 1.94 to 3.13 on a 5-point scale
  • Only 31% of organisations have visibility into AI software, compared to 66% of organisations that have visibility into their SaaS environment

That makes traditional SaaS management practices feel outdated. License counts alone no longer tell the story. Neither does spend reporting without usage context. Organisations that treat AI SaaS like any other application miss critical signals about cost, risk and ROI.

What effective SaaS management looks like today

Managing SaaS effectively means building guardrails that scale with the business. Here’s what leading organisations are focusing on:

  • Improving SaaS visibility: They establish a single source of truth for SaaS applications across departments—including shadow IT and AI-driven tools
  • Connecting usage to cost: They align license and consumption data with real usage patterns to identify waste early
  • Governing AI-enabled SaaS intentionally: They treat AI features as first-class assets, not add-ons, with clear ownership and oversight
  • Aligning teams around shared outcomes: They bring IT, finance and security together around the same data and decision-making framework
  • Mitigating unmanaged growth: They don’t prioritise growth driven by speed, autonomy, and innovation unless there is visibility in how the tools are being used

The combination of decentralised buying, AI-driven tools and limited visibility has made SaaS hard to manage. The organisations that are succeeding are bringing visibility, cost, and usage together.

Wasted AI spend, SaaS sprawl, and IT visibility on your mind?

Get all the insights in Flexera’s newly-released 2026 State of ITAM report.

Read the full report

Source

https://www.flexera.com/blog/it-asset-management/state-of-itam-2026-saas-sprawl/

Image Credit

Flexera

The post Flexera 2026 State of ITAM Report: why SaaS sprawl is no longer just an IT problem appeared first on EasySAM.

]]> Flexera 2026 State of ITAM Report: How governance gaps are driving costly software audits https://easysam.co.uk/news/flexera-2026-state-of-itam-report-how-governance-gaps-are-driving-costly-software-audits/ Mon, 29 Jun 2026 09:12:32 +0000 https://easysam.co.uk/?p=37694 Software audits are becoming more frequent, more complex, more expensive...and they're not going anywhere anytime soon.

The post Flexera 2026 State of ITAM Report: How governance gaps are driving costly software audits appeared first on EasySAM.

]]>
Search Mobile-alt Envelope Linkedin Bell

Flexera

Search Mobile-alt Envelope Bell

Find out more below

Flexera

Software audits are becoming more frequent, more complex, more expensive...and they're not going anywhere anytime soon.

Published on 29th June 2026

Software audits aren’t new; nearly half (48%) of the organisations surveyed in Flexera’s 2026 State of ITAM Report said they had been audited in the last year. But they are becoming more frequent, more complex and more expensive. They’ve become a constant reality for IT leaders who are constantly asking themselves:

How do I reduce software audit risk while maintaining control across SaaS, cloud and AI?

The answer sits with governance, visibility and proactive ITAM practices.

44% of respondents spent more than $1 million on audits over the past three years

Audit exposure remains one of the most persistent risks across the IT estate. Audit costs are rising because environments are harder to track. SaaS, cloud and AI introduce new licensing models, new usage patterns and new areas of non-compliance. On top of that, 64% of audited organisations report Microsoft audits, while Microsoft was also listed as the most relevant vendor to respondents’ SAM program. This should be concerning to businesses.

Lack of visibility is the root cause: only 36% of organisations report complete visibility into their IT estate

Audit exposure is often a visibility problem first—and a compliance problem second. Maintaining accurate inventory is the top priority for 78% of ITAM teams, because you can’t prepare for an audit if you don’t know what you have. With that said, visibility remains a major gap with only 36% of organisations report complete visibility into their IT estate.

SaaS and cloud environments expand outside traditional procurement controls, while AI introduces new consumption models with tokens and limits. The result? Missing licenses, untracked usage and unclear ownership.

Audit preparation has shifted from an event to an always-on capability

Traditional audit preparation was reactive, with organisations preparing when notified. That model no longer works, and teams that embed continuous compliance into ITAM will be better positioned.

The data shows why:

  • ITAM teams now spend a meaningful portion of their time responding to audits
  • Audit activity remains consistently high year over year
  • ITAM responsibilities now include cloud, SaaS and AI tracking, expanding the scope of compliance

Reducing waste isn’t just about cost savings—it’s one of the most effective ways to reduce audit risk

Waste and compliance are two sides of the same issue: lack of control. SaaS waste continues to increase year over year, while cloud waste (IaaS/PaaS) has also increased. Optimising software spend is the top priority for SAM teams, while ITAM responsibility continues to grow, with 75% of teams managing cloud licenses and 64% managing SaaS.

Where’s the connection between waste and audit exposure?

  • Unused licenses and decentralised ownership create audit exposure
  • Overprovisioned environments create compliance gaps
  • Poor tracking leads to inaccurate entitlement data

Responsibility for optimisation in public cloud is now nearly evenly split between ITAM and FinOps teams, which means audit compliance now requires coordination across ITAM and FinOps.

Governance gaps also increase software audit exposure

As software environments expand, governance frameworks are struggling to keep up.

  • Tracking new environments (SaaS, cloud, AI) is now a top challenge across organisations
  • Complexity of software use rights continues to increase year over year
  • Only 31% of organisations have visibility into AI software
This creates new audit risks:
  • Untracked usage
  • Unclear contract terms
  • Misaligned licensing models

Audit risk today is driven less by intentional non-compliance—and more by governance gaps in rapidly changing environments with shifting ownership.

What effective ITAM audit preparation looks like today

Leading organisations are shifting from reactive to proactive audit management and focus on:

  • Establishing complete visibility: A single, trusted source of truth across SaaS, cloud and AI
  • Maintaining accurate entitlement data: Aligning licenses, contracts and usage data continuously
  • Embedding audit readiness into daily operations: Treating compliance as an ongoing process—not a point-in-time exercise
  • Aligning ITAM, FinOps and security: Ensuring all teams work from the same data and governance model
  • Optimising continuously: Using license reuse, rightsizing and contract management to reduce both cost and risk

Reducing software audit risk in 2026 requires better control over the entire software lifecycle. The organisations that succeed will:

  • Improve visibility across SaaS, cloud and AI
  • Align ITAM, FinOps and security around shared data
  • Reduce waste as a path to reducing risk

Audit compliance is an always-on operating model connecting visibility, alignment between teams and waste reduction.

Software audits aren’t going anywhere

Check out Flexera’s latest State of ITAM report to see the vendors that are responsible for the most audits (and what it’s costing teams).

Read the full report

Source

https://www.flexera.com/blog/it-asset-management/state-of-itam-2026-audits/

Image Credit

Flexera

The post Flexera 2026 State of ITAM Report: How governance gaps are driving costly software audits appeared first on EasySAM.

]]> The risks of relying on AI alone for ITAM and FinOps https://easysam.co.uk/knowledge-base/the-risks-of-relying-on-ai-alone-for-itam-and-finops/ Tue, 23 Jun 2026 09:57:34 +0000 https://easysam.co.uk/?p=37671 AI is redefining how decisions are made, but it can't redefine what must be defensible - where the cost of being wrong is higher than the cost of being thorough.

The post The risks of relying on AI alone for ITAM and FinOps appeared first on EasySAM.

]]>
Search Mobile-alt Envelope Linkedin Bell

Flexera

Search Mobile-alt Envelope Bell

Find out more below

Flexera

AI is redefining how decisions are made, but it can't redefine what must be defensible - where the cost of being wrong is higher than the cost of being thorough.

Published on 23rd June 2026

AI is transforming how leaders interact with technology data. Natural language queries and automated recommendations make insights faster and more accessible. As a result, many executives are asking a reasonable question: “If AI can analyse everything, why do we still need IT Asset Management (ITAM) and FinOps platforms?”

The short answer is that AI accelerates insight but it is not held accountable. That gap introduces real risk.

AI optimises speed, not certainty

AI systems are probabilistic; they generate answers based on likelihood, not fixed logic. That works well for summarisation and exploration but breaks down without quality and reliable data as a foundation in environments where decisions must be repeatable, explainable and defensible.

Not only that, but as more data is scraped from the web, it becomes clear that curation and context are incredibly important to decision-making for technology leaders. AI can identify signals across environments, but it cannot reliably determine what software is, how it maps to licensing, whether it is end of life, vulnerable or even approved for use.

For example, if a CIO asks an AI assistant how many Oracle databases are deployed, the answer may change as new signals are inferred. That variability is acceptable for exploration. It is not acceptable when that same answer drives a licensing true up, a board report or a regulatory disclosure.

AI may also detect Apache Tomcat running on a server, but it cannot determine the version, bundled dependencies or associated risk without curated data and enrichment. Many of those datapoints aren’t discovered via AI search. Without normalisation and human-curated intelligence, discovery remains incomplete and decisions cannot be trusted.

AI produces fast answers. Enterprises still need durable ones.

The risks of AI-only IT asset management

ITAM appears to be an ideal use case for AI. Classification, pattern detection and lifecycle analysis map well to machine learning. The risk shows up when ITAM shifts from insight to accountability.

Unstable asset identity

Consider a merger where two product lines are consolidated under a new vendor name. An AI model may correctly infer today’s identity but fail to preserve how that software was classified three years ago. During an audit, the question is not what is installed now but what was true at the time of purchase.

Licensing exposure from non-repeatable outcomes

A head of software asset management (SAM) may accept an AI recommendation to downgrade an edition based on inferred usage. If that inference is wrong even once, the organisation assumes real financial exposure. Licensing scenarios do not tolerate occasional errors.

No audit lineage

When an auditor disputes a result, leaders must explain why it exists. An answer such as “the model inferred it” is not a defensible position. There is no accountable party and no stable logic chain to review.

In ITAM, speed without determinism increases risk.

The Risks of AI Only FinOps

FinOps also faces challenges with accountability for AI decisions and actions.

Inconsistent forecasts and chargeback

A CFO relies on dynamic cost allocation to forecast and chargeback spending. If AI driven asset classifications are not given appropriate context as the business changes, chargeback and budgeting may be inaccurate or confusing and thus will lose credibility.

Optimising for the wrong objective

An AI recommendation to resize compute may look correct in isolation. In practice, that change can affect performance of production workloads that the business may be planning to use for critical new applications. Without business context, AI-generated optimisations cannot account for future needs.

Model Drift

Cloud environments evolve continuously. New services are introduced daily, architectures change, and engineering practices evolve. A model trained on historical usage patterns may become less accurate over time.

The best AI FinOps systems optimise for business outcomes, not just cloud costs.

These are structural constraints, not model limitations

The hardest problems in ITAM and FinOps are not computational. They are economic, legal and historical.

Leaders must answer questions like:

  • What exactly was licensed and when
  • Who owns this cost and why
  • What decision was made and on what basis

AI can infer answers, while enterprises must declare them. That distinction will remain regardless of model improvements.

In summary

AI will redefine how decisions are made but it will not redefine what must be defensible.

Leaders who rely on AI alone gain speed but assume hidden risk. Those who pair AI with a trusted technology intelligence platform move faster while staying in control.

In ITAM and FinOps, the cost of being wrong is higher than the cost of being thorough.

How much are you utilising AI for ITAM and FinOps?

And how does that level of use feel after reading the guide? Too much? Just right? Maybe not enough? Let us know your thoughts.

Get in touch

Source

https://www.flexera.com/blog/perspectives/risks-of-ai-itam-finops/

Image Credit

Panuwat Dangsungnoen via Vecteezy

The post The risks of relying on AI alone for ITAM and FinOps appeared first on EasySAM.

]]> Flexera warns AI cloud costs strain technology budgets https://easysam.co.uk/news/flexera-warns-ai-cloud-costs-strain-technology-budgets/ Thu, 18 Jun 2026 14:49:58 +0000 https://easysam.co.uk/?p=37626 Rising AI use is making cloud bills harder to predict, with 85% of organisations saying cost control is now their main cloud challenge.

The post Flexera warns AI cloud costs strain technology budgets appeared first on EasySAM.

]]>
Search Mobile-alt Envelope Linkedin Bell

Flexera

Search Mobile-alt Envelope Bell

Find out more below

Flexera

Rising AI use is making cloud bills harder to predict, with 85% of organisations saying cost control is now their main cloud challenge.

Published on 18th June 2026

Flexera has published research showing that every organisation surveyed uses generative AI public cloud services. It also found that 85% now see managing cloud costs as their main cloud challenge.

The findings point to growing pressure on technology budgets as companies juggle hybrid cloud estates, AI spending and limited visibility over usage. Some 17% of organisations exceeded their public cloud budgets in the past year, while estimated wasted cloud spend rose to 29%, reversing a five-year decline.

Hybrid cloud has become the dominant operating model in the survey. Flexera found that 69% of organisations now use a hybrid cloud approach, rising to 78% among those with more than 5,000 employees.

Spending patterns also point to larger, more complex estates. Among organisations spending more than USD $500,000 a month on cloud, 79% operate hybrid environments.

The report suggests AI is adding a new source of cost volatility. While all respondents said they use generative AI public cloud services in some form, 45% described that use as extensive and 30% said cost unpredictability was one of the biggest challenges in scaling AI workloads.

Chris Andersen, Chief Financial Officer at Flexera, linked those pressures to broader changes in how finance teams track technology spending.

“The conversation around cloud costs has shifted significantly. It has moved from spending more on technology to solve problems to managing increasingly complex environments that have often evolved organically over time.

“Many organisations have not intentionally designed hybrid or multi-cloud strategies. Instead, these environments emerge through acquisitions, new business requirements or teams independently adopting different platforms. As a result, finance leaders are being asked to manage technology estates that are much harder to monitor and optimise.

“The challenge is that complexity itself creates inefficiencies. The more environments organisations operate across, the harder it becomes to maintain visibility into what resources are being used, whether they are delivering value and where opportunities exist to reduce unnecessary spend,” Andersen said.

The survey also points to a more formal approach to cloud oversight. Flexera found that 71% of organisations now have a Cloud Centre of Excellence, while 63% have established dedicated FinOps teams.

Governance spread

Responsibility for cloud governance is also moving beyond specialist infrastructure teams. According to the research, business units and software asset management teams are taking a larger role in overseeing cloud usage and costs.

Managed service providers are adjusting their offerings in response to AI-related demand. Nearly half plan to offer AI consulting and SaaS management services, while two-thirds are adopting AI for cybersecurity use cases.

The data also shows a divide between larger and smaller organisations in the use of outside providers. Enterprise use of managed service providers rose by three percentage points from a year earlier, while use among small and medium-sized businesses fell from 48% to 39%.

Andersen said the shift in AI spending could change the balance of costs on company profit and loss statements.

“There is enormous pressure on organisations to invest in AI quickly enough to remain competitive, but AI costs behave very differently from traditional technology spending. Usage can scale rapidly across cloud environments, making costs far harder to predict and control.

“People costs have traditionally been the largest line item on the profit and loss statement for technology companies. If AI develops as many expect, technology spend could eventually overtake that. Yet most organisations are nowhere near as disciplined in managing technology costs as they are people costs.

“Companies know exactly who works for them and what those people cost. Far fewer can say the same about every cloud workload, SaaS agreement or AI tool operating across the business. That becomes a serious financial challenge once AI usage starts scaling.

“The organisations best positioned to succeed will be those that simplify where they can, improve visibility across increasingly hybrid environments and establish clear accountability for technology spending. Without that discipline, complexity itself becomes a driver of unnecessary cost,” Andersen said.

The research was based on a survey of 753 technical professionals and executive leaders worldwide, including cloud decision-makers and users across industries, organisation sizes and functional roles.

Feeling the strain in your budget too?

Maybe there's some opportunity to remedy that. Why not get the experts in to take a look at what optimisations might be available to you?

Get in touch

Source

https://itbrief.co.uk/story/flexera-warns-ai-cloud-costs-strain-technology-budgets

Image Credit

Siraphol Siricharattakul via Vecteezy

The post Flexera warns AI cloud costs strain technology budgets appeared first on EasySAM.

]]> How is ITAM being influenced by AI? https://easysam.co.uk/knowledge-base/how-is-itam-being-influenced-by-ai/ Wed, 03 Jun 2026 08:59:00 +0000 https://easysam.co.uk/?p=37566 AI is transforming IT asset management - from contract ingestion to spend optimisation. Learn how ITAM teams can govern AI, reduce risk and drive value.

The post How is ITAM being influenced by AI? appeared first on EasySAM.

]]>
Search Mobile-alt Envelope Linkedin Bell

Flexera

Search Mobile-alt Envelope Bell

Find out more below

Flexera

AI is transforming IT asset management - from contract ingestion to spend optimisation. Learn how ITAM teams can govern AI, reduce risk and drive value.

Published on 3rd June 2026

For years, IT Asset Management (ITAM) has been about control: controlling spend, compliance, and risk across an increasingly complex technology estate. Now, artificial intelligence is reshaping that mission. AI isn’t just another tool we need to manage; it’s fundamentally changing how we work, what we manage, and where we deliver value. So how is AI already impacting the roles of ITAM and SAM professionals? And what makes it central to the job moving forward?

AI-powered contract and entitlement ingestion

One of the most time-consuming parts of ITAM, specifically software asset management (SAM), has always been data intake. Contracts, entitlements, purchase orders, license metrics, and use rights arrive in every imaginable format including PDFs, spreadsheets, portals, emails, and scanned documents. Historically, turning this chaos into normalised, trustworthy data required hours, days, or even weeks of manual work. And if this work wasn’t outsourced, often it wasn’t done with the exception of the few most important IT contracts.

AI changes that equation.

With AI-driven automation, contract and entitlement ingestion becomes faster, more accurate, and far less dependent on human effort. Modern AI models can:

  • Read and interpret contracts using natural language processing (NLP)
  • Extract key terms like quantities, metrics, renewal dates, and product use rights
  • Normalise entitlements across vendors and licensing models

Instead of spending my time manually keying in data or validating line items, ITAM and SAM practitioners can focus on exceptions, decisions, and strategy. The result isn’t just efficiency, it’s scale. As software portfolios grow and licensing models become more complex, AI-enabled ingestion is the only way to keep up without becoming overwhelmed and producing costly errors.

Taking Action with AI: From Insight to Outcomes Using Agents

One of the most meaningful shifts AI brings to ITAM isn’t just better analysis; it’s the ability to translate insights into execution through agent‑based automation.

AI agents can act continuously on behalf of ITAM and SAM teams, monitoring environments, evaluating conditions, and initiating actions based on defined policies and guardrails. Instead of relying on dashboards that require constant human review, agentic AI enables ITAM to move from reactive response to proactive control.

In practice, AI agents can:

  • Monitor contract, entitlement, and usage data for anomalies or risk conditions
  • Identify upcoming renewals, compliance gaps, or optimisation opportunities
  • Trigger workflows, notifications, or approvals when thresholds are met
  • Recommend or initiate corrective actions, such as reclaiming unused licenses or flagging risky AI usage

This doesn’t remove human oversight, and it shouldn’t, but it does enhance it. ITAM professionals remain responsible for decisions and governance, but AI agents dramatically reduce the time between signal and action. The outcome is a more responsive ITAM function that can operate at scale, even as software portfolios and AI usage grow more complex.

Over time, agent‑driven workflows will become a natural extension of ITAM operations: a digital workforce that handles routine execution so humans can focus on judgement, negotiation, and strategy.

Synthesising Data with AI to Enable Better Collaboration

ITAM has never been isolated. It sits at the intersection of procurement, finance, FinOps, security, legal, cloud, and business stakeholders, and that complexity often leads to siloed data, fragmented conversations, and slow decision‑making.

AI changes this by acting as a synthesis layer across systems, domains, and teams.

Instead of forcing stakeholders to interpret raw reports or reconcile conflicting data sources, AI can aggregate, contextualise, and translate information into shared, decision‑ready insights. Contract terms, entitlement data, consumption patterns, financial impact, and risk signals can be surfaced together in the language each team understands.

This enables:

  • Finance to understand cost drivers and ROI without decoding license models
  • FinOps to assess cloud environments and overall cloud strategy
  • Procurement to negotiate with clarity around usage, entitlements, and risk
  • Security and legal to assess AI exposure and compliance implications
  • Executives to see a unified view of technology value, cost, and risk

For ITAM and SAM professionals, this positions the function as a hub for cross‑functional alignment, not just a source of data. AI doesn’t just analyse; it connects people, decisions, and outcomes.

As AI continues to mature, the most successful organisations won’t be the ones with the most dashboards. They’ll be the ones using AI to turn complex technology data into shared understanding and coordinated action across the business.

AI software will become a core category of spend and optimisation

AI itself is rapidly becoming one of the fastest-growing categories of enterprise technology spend. This isn’t just about buying AI tools, it’s about a new layer of cost complexity that ITAM and SAM teams must manage.

AI-related spend shows up in many forms:

  • Standalone AI applications and copilots
  • AI features embedded into existing SaaS products
  • Usage-based consumption tied to tokens, prompts, and API calls
  • Premium licensing tiers for AI-enabled capabilities

Unlike traditional software, AI costs are often variable, opaque, and difficult to forecast. A team experimenting with generative AI today can quietly become a major contributor to software costs tomorrow.

This is where ITAM and SAM must evolve. Optimisation will no longer focus solely on unused licenses it will require:

  • Monitoring AI usage patterns and consumption drivers
  • Identifying over-provisioned AI entitlements
  • Identifying AI separately in software
  • Aligning AI spend to real business outcomes
  • Allocating use of AI, and its cost, to respective business units
  • Establishing guardrails to prevent “runaway” consumption

In short, AI optimisation will more closely resemble cloud cost optimisation than classic on-premises license management and ITAM/SAM professionals along with FinOps professionals are uniquely positioned to lead and contribute to this effort.

Shadow AI will create new governance and compliance risks

Years have been spent talking about shadow IT. Now, we’re entering the era of shadow AI.

Employees can sign up for AI tools in seconds, embed generative AI into workflows, or connect external models to corporate data and do so often without IT, security, or procurement ever knowing. The risks are real:

  • Sensitive data exposure
  • Unapproved AI models trained on proprietary information
  • Licensing and usage violations
  • Regulatory and compliance gaps

AI-driven discovery will become essential. Just as ITAM tools evolved to detect SaaS sprawl, AI-aware asset management must identify:

  • AI-enabled applications already in use
  • Embedded AI features within licensed software
  • Data flows between AI tools and enterprise systems

For ITAM/SAM managers, governance will mean enabling innovation safely, with visibility, policies, and controls that scale as fast as the technology itself.

AI Will Elevate ITAM/SAM from Operational to Strategic

As AI takes over more of the repetitive, manual work, ITAM/SAM roles naturally shift up the value chain. Instead of spending a bulk of time reconciling data, ITAM/SAM professionals will focus on:
  • Advising the business on AI investment trade-offs
  • Supporting procurement with AI-specific licensing insights
  • Partnering with security, legal, and finance teams on AI risk and compliance
  • Providing executives with clear visibility into AI value, cost, and exposure

AI will not replace ITAM or SAM it will simply amplify it, and organisations that get this right will treat ITAM/SAM as a strategic function, not a back-office necessity.

Closing

AI is already automating the work that slows us down, introducing new categories of spend we must manage, and elevating ITAM/SAM roles across the organisation.

For ITAM and SAM professionals willing to adapt, AI represents an opportunity: to move faster, think bigger, and play a more strategic role in how organisations adopt and govern technology.

The job isn’t disappearing. It’s becoming more important than ever.

Source

https://www.flexera.com/blog/perspectives/how-ai-affects-itam/

Image Credit

Imam Fathoni via Vecteezy

The post How is ITAM being influenced by AI? appeared first on EasySAM.

]]> Valuemaxxing: why it matters and how leaders can master it https://easysam.co.uk/knowledge-base/valuemaxxing-why-it-matters-and-how-leaders-can-master-it/ Wed, 13 May 2026 10:46:25 +0000 https://easysam.co.uk/?p=37480 AI is reshaping business fast. Learn how “valuemaxxing” helps leaders align ROI, governance, and FinOps to maximise technology investments.

The post Valuemaxxing: why it matters and how leaders can master it appeared first on EasySAM.

]]>
Search Mobile-alt Envelope Linkedin Bell

Flexera

Search Mobile-alt Envelope Bell

Find out more below

Flexera

AI is reshaping business fast. Learn how “valuemaxxing” helps leaders align ROI, governance, and FinOps to maximise technology investments.

Published on 13th May 2026

In recent years, the technology landscape has been a whirlwind as AI reimagines nearly every longstanding process. Globally, teams are expected to navigate market shifts, drive innovation, and respond to sudden disruption, all while juggling competing priorities and proving ROI. Sounds easy, right?

For most, navigating the AI landscape is a challenge. With CFOs focusing on ROI, CIOs managing governance, technology leaders championing tech optimisation, and boards and investors prioritising outcomes, everyone has their own agenda and key metrics to march toward. Yet this growing list of competing demands has become difficult to manage cohesively, leading to increasingly rash pivots and continued missteps by large organisations.

As we continue riding the wave of the AI hype cycle, it’s imperative that businesses look beyond siloed success metrics and focus on the overall organisational impact. A market-wide reset is needed: one where leaders realign priorities and prioritise company-wide value. We’re entering an era defined by a new term: valuemaxxing.

What is Valuemaxxing?

To keep pace with the fast-moving, AI-driven technology landscape, leaders are quick to adopt the newest, hottest innovation, but few are stopping to ask “is this adding real value?”. This is where valuemaxxing comes in, challenging the need for more tools, more tokens, or more spend…and pushing for more return, more accountability, and more control.

Looking ahead, enterprises must shift from usage-maxxing to valuemaxxing, bringing together visibility, governance, and financial accountability to maximise their technology investments. Organisations can begin to master the art of valuemaxxing by:

Creating Structured Oversight

While technology is becoming the largest line item on many balance sheets, there’s still a lack of structured oversight. To make the most out of investments, organisations must stand up new AI-focused teams and metrics to promote intentional investment, performance measurement, and lifecycle governance – much like HR teams. In a world where technology does more work than ever, it must be managed with the same rigour and discipline as talent.

Eliminating Application Redundancy

Today, there’s a new application for everything – and unknowingly, many organisations may be paying for duplicative, underutilised or unneeded resources. To mitigate application sprawl, it’s important to have complete inventory across your on-premises, SaaS and cloud environments to ensure you’re not paying for applications you don’t need. This is where FinOps can step in, offering organisations the visibility required to overcome unnecessary technical debt.

Ditching Technology Short Cuts

Many organisations are latching onto shortcuts to propel innovation. A recent example of this is “vibe coding,” the use of AI to generate, refine, and debug code. While this offers clear short-term benefits like speed, accessibility, and lower upfront cost, it often comes with trade-offs in reliability, security, and long-term maintainability. These shortcuts will only harm organisations’ output in the future, and those that continue to operate with intention will come out on top.

Valuemaxxing is emerging as a necessary reset for how organisations think about technology in an AI‑driven world. Differentiators will be those who can consistently tie technology decisions to measurable, enterprise‑wide outcomes. Leaders that prioritise visibility, governance, and accountability will be better positioned to stay in control amid the innovation-frenzy.

What do you think of this new buzzword?

Something you've already been doing - even if you've not been calling it valuemaxxing?

Or the start of a good idea? Or perhaps just a new fad?

Let us know your thoughts.

Get in touch

Source

https://www.flexera.com/blog/saas-management/what-is-valuemaxxing/

Image Credit

Dilok Klaisataporn via Vecteezy

The post Valuemaxxing: why it matters and how leaders can master it appeared first on EasySAM.

]]> Flexera 2026 State of the Cloud Report: The convergence of cloud and value https://easysam.co.uk/news/flexera-2026-state-of-the-cloud-report-the-convergence-of-cloud-and-value/ Thu, 19 Mar 2026 10:47:54 +0000 https://easysam.co.uk/?p=37146 The latest iteration of Flexera's annual report shows FinOps maturing as AI adoption accelerates cost, risk and governance demands.

The post Flexera 2026 State of the Cloud Report: The convergence of cloud and value appeared first on EasySAM.

]]>
Search Mobile-alt Envelope Linkedin Bell

Flexera

Search Mobile-alt Envelope Bell

Find out more below

Flexera

The latest iteration of Flexera's annual report shows FinOps maturing as AI adoption accelerates cost, risk and governance demands.

Published on 19th March 2026

Flexera’s 2026 State of the Cloud Report marks a pivotal moment in cloud maturity. Now in its fifteenth year, the report shows cloud entering the value era—where organisations tie cloud decisions to measurable business outcomes, accelerate GenAI adoption and lean on centralised governance to manage rising complexity.

Those looking to get a handle on cloud spend and cloud governance must pay attention to these trends and to the goals that can help drive the most value possible, or risk getting left behind in reactive states.

Cloud success is increasingly measured by value, not just savings

For the first time, organisations are measuring cloud success less by cost efficiency and more by the value technology delivers. Sixty‑four percent of organisations now rely on value delivered to business units as their top metric for cloud progress, up twelve percentage points from last year. Cost efficiency dropped six points, reflecting a broader shift toward prioritising impact over savings.

  • Value delivered to business units rose 12 percentage points year over year
  • Use of unit economics increased from 40% to 49%
  • Cost efficiency dropped 6 percentage points

Nearly half of organisations (49%) now leverage unit economics to measure cost per service and link cloud consumption to business outcomes, up from 40% last year. This shift reflects a more proactive and mature approach, as FinOps teams move from simply explaining past spend to shaping architectural and investment decisions early in the process. Cloud is increasingly recognised not just as infrastructure, but as a strategic driver of growth, innovation and competitive advantage.

FinOps has expanded from a cloud cost discipline into a strategic capability focused on technology value. Teams aren’t just looking at what cloud costs add up to, but they’re also looking at what cloud delivers, and they’re shaping decisions long before workloads hit the cloud.

Brian Shannon - Chief Technology Officer, Flexera

AI is everywhere, and making cloud waste worse

Despite the increase in FinOps maturity placing focus on value, this year’s report shows cloud-based AI workloads are surging causing an increase in wasted cloud spend (29%) for the first time in five years. AI is permeating every area of tech, but Generative AI (GenAI) specifically has moved rapidly from experimentation to everyday use. In 2026, GenAI surged to the third most widely used public cloud service, rising to 58% from 50%. AI is now one of the most widely adopted public cloud services, reshaping both cloud economics and risk profiles.

But rapid adoption has introduced new challenges, such as:
  • Security and compliance risks
  • Data quality concerns
  • Difficulty forecasting unpredictable usage patterns

Security and compliance are now the top concern for cloud-based AI initiatives, followed closely by data quality and the difficulty of forecasting unpredictable usage patterns. AI workloads behave differently than traditional cloud services, making visibility, governance and financial controls harder—but more essential—than ever.

AI is no longer experimental. As organisations integrate GenAI into everyday workflows, strong governance ensures they can innovate with confidence while keeping cost, risk and performance in balance.

Brian Shannon - Chief Technology Officer, Flexera

Organisations are responding by formalising oversight. A significant majority of large enterprises now have a dedicated AI leader or governance team, signalling that AI is no longer a side project; it’s a core business capability that demands discipline and accountability.

Hybrid cloud and centralised governance remain essential

Seventy-three percent of respondents are using hybrid cloud, an increase from last year. Multi‑cloud adoption also continues to rise, but often unintentionally. This trend could stem from mergers, siloed application teams or inherited architectures rather than deliberate strategy.

Organisations with higher monthly cloud spend are more likely to run hybrid estates, suggesting greater sophistication and a stronger need for workload placement flexibility. SMBs and enterprises alike continue using hybrid environments to balance cost, performance and governance.

Cloud spend continues to climb—along with waste

Cloud spending is trending upward, with large enterprises leading the way: 76% of large enterprises now spend more than $5 million monthly on public cloud. The increase in monthly spend paired with reversal in wasted spend underscore why centralised governance and FinOps discipline are becoming essential, not optional.

Centralisation and governance gain momentum

As cloud environments grow more complex, organisations are doubling down on centralised oversight. Seventy‑one percent have a cloud center of excellence (CCOE) or equivalent, and 63% rely on a FinOps team. Business units and software asset management teams are also becoming more involved, reflecting a broader organisational commitment to governance and accountability.

MSPs continue to play a role, but their focus is shifting. Nearly half plan to expand into AI consulting or SaaS management, while enterprises increasingly rely on them for specialised support. SMB use of MSPs dipped this year, potentially due to budget constraints or improved internal capabilities.

Cloud migration strategies evolve with a shift‑left mindset

Organisations are investing earlier in architectural and cost planning. Cost optimisation after migration dropped from the third- to the fifth-ranked challenge, while selecting the best instance and assessing cloud vs. on‑premises costs increased in importance. This shift‑left approach reflects a growing understanding that planning early prevents expensive inefficiencies later.

Europe sees parallel trends with subtle distinctions

European organisations largely mirror global trends, including increased use of FinOps teams (up nine points) and a strong preference for Azure for significant workloads. Sustainability initiatives saw a modest increase as regulations shift, with 47% of European respondents reporting defined programs.

Cloud success hinges on governance, value and AI oversight

The 2026 findings point to a cloud landscape that is more complex, more strategic and more value-focused than ever. Organisations are maturing their FinOps practices, accelerating AI adoption and strengthening governance structures to manage scale and risk. IT, finance and operations teams are collaborating more closely, building the unified visibility and accountability needed to support innovation while maintaining control.

Looking ahead at 2026 and beyond, organisations that excel at effective oversight and managing complexity will stand out in the pack. They’ll unlock new opportunities for growth and build resilience as they innovate.

Read the full report at: https://info.flexera.com/CM-REPORT-State-of-the-Cloud

Source

https://www.flexera.com/blog/finops/flexera-2026-state-of-the-cloud-report-the-convergence-of-cloud-and-value/

Image Credit

Flexera

The post Flexera 2026 State of the Cloud Report: The convergence of cloud and value appeared first on EasySAM.

]]>