After 5+ years of Flexera’s State of ITAM report, one thing’s clear: there’s no shortage of daily challenges faced by ITAM teams. Business units now buy applications directly. Teams experiment with unsanctioned AI tools. Free trials turn into paid subscriptions. All while overlapping apps stack up across departments. All of this rolls up under SaaS sprawl.

SaaS sprawl isn’t about having too many tools. It’s about losing control over:

Software audits aren’t new; nearly half (48%) of the organisations surveyed in Flexera’s 2026 State of ITAM Report said they had been audited in the last year. But they are becoming more frequent, more complex and more expensive. They’ve become a constant reality for IT leaders who are constantly asking themselves:

How do I reduce software audit risk while maintaining control across SaaS, cloud and AI?

The answer sits with governance, visibility and proactive ITAM practices.

Gartner has slammed AI vendors’ lack of transparency, saying developers are facing sharply increased costs from coding agents.

Since the main AI coding agent vendors have shifted from seat-based licensing to consumption-based pricing, developer teams now face highly variable cost structures.

Developer teams face an emerging problem of escalating costs, said Nitish Tyagi, senior principal analyst at Gartner. AI coding bills were leaping from $20 or $100 to $2,000 to $5,000 per developer per month, while in extreme cases, the bill might hit $20,000 in token charges.

However, software engineering departments get little insight into how token consumption is calculated and billed, making it difficult for them to forecast and control costs accurately. AI coding vendors have not yet delivered built-in features to allow developers to optimise costs in AI coding agents, resulting in cost escalation, Gartner said.

“None of the vendors have incredible features when it comes to cost optimisation,” said Tyagi. Instead, he said vendors were focusing on the concept of “tokenmaxxing” to “boost the high” of token consumption, suggesting that if

developers increase the number of tokens, they will increase productivity gains.

“There is no direct relation between the increase in token consumption and an increase in productivity gains,” he said.

Gartner recommends developer teams optimise token consumption and adopt strategies such as context engineering practices, where software engineers improve the input context provided to AI systems. Another recommended strategy is model routing, where engineering and platform teams direct simpler, high-frequency tasks to smaller models, using frontier models only for complex, high-value work

“All of these things will improve the output quality, and, therefore, will increase the productivity gains as well, so while there is no direct relation between tokenmaxxing and productivity gains, there is a relation between optimisation of token consumption with the output quality,” Tyagi said.

As a result of the lack of cost optimisation tools among vendors and consumption-reduction strategies among users, AI development is in a situation where a developer’s coding agents may cost more than they earn, at least in some parts of the world. Gartner predicts that by 2028, AI coding costs will overtake the average developer’s salary due to rising LLM token consumption and the shift to consumption-based licensing models.

“We’re not saying AI token cost will be higher than every developer’s salary on the planet, because US salaries tend to be higher than in India, for example. But current token costs are already more than most of the salaries in India,” he said.

However, the cost of coding agents does not vary according to where they are consumed, meaning AI coding costs for a developer in India may be equivalent to the salary of an engineer with four to six years’ experience, Tyagi said.

“We’re not saying AI token costs will be higher than every developer’s salary on the planet, because US salaries tend to be higher than in India, for example,” Tyagi said, adding that token costs do not vary by location, and in India they may already be equivalent to the salary of an engineer with four to six years’ experience.

New data from SAP Concur has apparently confirmed employees are still ignoring company policies, with three in four UK business travellers using (or would use) unapproved AI tools.

Data from the company’s Global Business Travel Survey shows that, while organisations are investing heavily in AI, they’re not giving workers access to the right tools.

As a result, employees are opting to use other, more suitable alternatives and often prefer publicly available chatbots such as ChatGPT and Gemini.

Two in five (43%) said they use unapproved tools because they prefer different options to what they’re provided, but one-third (32%) say their organisation doesn’t even offer any AI tools to support planning or booking travel, forcing them to look elsewhere.

The data shows that remote workers (81%) are more likely to use shadow AI than office-based employees (71%), as are younger workers like Gen Z (79%) and Millennials (76%) compared with Gen X (62%) and Boomers (49%).

As for what employees are looking for when it comes to AI supporting their travel needs, the biggest use case is planning itineraries (37%). Tracking expenses (30%), assessing travel risks (26%), making changes to their trip (24%) and completing expense reports (21%) are also common use cases for the productivity-boosting technology.

But business leaders already know the scale of the problem – 100% of CFOs are concerned about shadow AI in business travel, the report found.

“Leaders must educate workers on the risks and provide T&E tools that deliver the desired level of AI support,” EMEA VP for Concur Travel Paul Dear noted.

Looking ahead, the fix must come from organisations – workers clearly aren’t too keen on having to navigate to third-party tools, and are doing it out of necessity. More than a third actually want their AI tools integrated into their productivity software (38%), communications platforms (36%) and CRM systems (32%).

Most businesses believe they are well-prepared to face cyberattacks, but the number of successful breaches in the last year alone paints a different picture.

Last week, NordLayer released a new report, called “Why Browser Security Can’t Wait: Web-based Threat Report 2026.” In it, the company states that while 73% of organisations claim to be prepared for web-based attacks and are confident in their solutions, 82% experienced some form of web-based attack.

The paper is based on an analysis of 504 “highest rated and most reviewed work applications”, an analysis of data stolen from various info-stealers, and a survey of 405 US cybersecurity and IT professionals.

NordLayer stresses that coverage is “modest and uneven”, with data loss prevention tools (DLP) leading at just 53%, followed by other security controls. Nearly all IT professionals reported that their organisations are concerned about web-based threats (98%), and most expect escalation. In fact, 81% expect greater sophistication and 73% believe there will be more incidents in the coming years.

“There’s a clear gap between recognising the threat and knowing how to address it,” says Buinovskis. “Concern is high, but awareness of which controls actually solve browser-specific risks is low. Much of the initial confidence most likely comes from having general security controls in place, yet they rarely adequately cover risks in the browser.”

The researchers also stressed that 100% of the tested applications were browser-accessible, and almost four in five (78.8%) were browser-only. At the same time, malware was able to harvest 1.8 million credentials and 68.8 billion cookies last year.

“Hackers don’t hack anymore, they just log in,” says Buinovskis. “Stolen cookies and credentials grant immediate access without raising alarm bells — a login looks legitimate. It’s low risk, high reward, and as reliance on web-based SaaS grows, so does the value of stolen data. Attackers will keep exploiting this until organisations secure the browser as a critical boundary.”

Security patching remained the most commonly cited challenge across organisations of all sizes. In the survey highlights, 38% said security patches and updates were their biggest open source challenge, ahead of installations, upgrades, and configurations at just over 29%. Technical support ranked third at just under 29%, up 21% year on year.

The report also found that 20% of organisations had no specific process for dealing with Common Vulnerabilities and Exposures. Among large enterprises, 39% said meeting internal service level agreements for vulnerability remediation was difficult.

Compliance risks also featured heavily. Among organisations that failed a compliance audit in the past year, 55% were using end-of-life software, underlining the risks tied to unsupported products and older software stacks.

Audit failure rates were reportedly twice as high for organisations running legacy versions of Tomcat, Spring Boot, and Spring Framework. End-of-life products still in use also included CentOS and AngularJS.