It usually starts innocently enough. Marketing needs a better email tool, so someone signs up for one. Finance finds an expense app that saves a few hours every month. The development team gets a new donor platform, someone discovers a great project management tool, and another employee starts using an AI service that turns meeting notes into summaries.

Each decision makes perfect sense on its own. Then one day you look around and realize your 20-person organization somehow has 47 technology vendors. Welcome to “SaaS sprawl”.

How Did We End Up with All This Stuff?

Cloud software has made buying technology ridiculously easy, and that’s mostly a good thing. Employees don’t have to wait for IT to install something when they can create an account, enter a credit card and be working ten minutes later.

The downside is that when different departments choose their own applications, nobody necessarily has a complete picture of what the organization is using. One app was purchased by Finance, another is charged to someone’s corporate card, and three employees may be paying separately for a tool that offers an organization-wide plan. Somewhere in the mix, there’s probably an annual subscription nobody remembers buying that’s been quietly renewing since 2022.

The result isn’t necessarily 47 vendors. It could be 27 or 67. The important number is the one nobody actually knows.

The Problem Isn’t Just the Money

Unused software licenses are annoying, but security problems are considerably less amusing. Every cloud application potentially contains organizational data, has accounts that need to be managed and may be connected to Microsoft 365, Google Workspace or another system. Every employee who leaves creates another question: Did anyone remember to remove their access from all of those applications?

AI tools make this even more important. Employees are understandably eager to experiment with applications that summarize documents, transcribe meetings, analyze spreadsheets or generate content. But those tools may also be receiving internal documents, meeting conversations, customer information or other sensitive data. If nobody is keeping track of the applications being used, it’s pretty difficult to keep track of where your information is going.

Then There’s the Great Password Problem

More applications mean more accounts, more passwords and more opportunities for something to go wrong. Ideally, important applications are centrally managed, protected by multifactor authentication and, where possible, connected to a central identity system such as Microsoft Entra ID.

In reality, smaller organizations often end up with a mixture of corporate accounts, individual accounts and the occasional dreaded shared login that six people know and nobody wants to admit exists. That arrangement becomes particularly interesting when the person who originally set up an important application leaves and everyone suddenly realizes nobody knows who the administrator is.

Time for a Technology Inventory

The answer isn’t to discourage employees from finding useful technology. It’s to create a simple process for choosing and managing it.

At least once a year, inventory your applications and cloud services. Identify the owner and administrators, costs, stored data and current business need. Look for duplicate tools, unused subscriptions, former employees with access and services without MFA.

Also review third-party applications connected to Microsoft 365 or Google Workspace. A lightweight approval process can ensure someone checks the security, cost and business value of new software before it’s purchased.

You’ll probably find tools you no longer need and, more importantly, some you didn’t know you had.

Small Organization Doesn’t Mean Simple IT

A 20-person nonprofit or startup can now have a surprisingly sophisticated technology environment: Microsoft 365, cloud storage, cybersecurity tools, accounting software, CRM, video conferencing, project management, HR systems, backups, AI applications, websites, mobile devices and laptops. Add a few specialized applications for different departments, and suddenly your “small” organization has a fairly large technology ecosystem.

That’s one of the odd realities of modern IT. You don’t need hundreds of employees to create technology complexity anymore. You just need a credit card and an internet connection.

Smaller organizations increasingly need someone keeping an eye on that whole picture, even if they don’t need a full-time IT department or an all-inclusive managed services package. That might mean getting outside help with Microsoft 365 administration, cybersecurity, account management or simply taking periodic stock of what’s being used and whether it’s being managed properly.

Because sometimes the smartest technology decision isn’t adding another tool.

It’s figuring out what the other 47 are doing.

For over forty-three years, CGNET has provided state-of-the-art IT services to organizations of all sizes, across the globe. We’ve done it all, from IT and cybersecurity assessments to cloud services management to generative AI user training. Want to learn more about who we are and how we might be able to help you? If so, check out our website or send us a message!