SaaS Management Platforms (Gartner)

Gartner published the Magic Quadrant for SaaS Management Platforms on 18 June 2026. It is the third edition of a category that did not exist in analyst terms before 2024, and the newest name on its top rung sells a password manager.

Four vendors have announced a Leader placement for this edition. Flexera, which says the placement is its second consecutive year on the rung. Torii, which says this is its third. Calero, a technology expense management vendor that has been in the spend business for three decades. And 1Password, whose product in this market is called SaaS Manager.

The 2026 Magic Quadrant for SaaS Management Platforms, and the four vendors that took the top rung

The lineage is short and worth holding in view. Gartner published the first quadrant for this market on 22 July 2024 and the second on 30 July 2025, which makes the 2026 report a young evaluation of a young category rather than a settled one. Ten months separate the second edition from the third, and the Leader rung looks different at the end of that gap than it did at the start.

The byline is Tom Cipolla and Lina Al Dana together with a third analyst the vendor citations do not agree on, naming Todd Larivee in most of them and Dan Wilson in one. The disagreement is minor in itself and useful as a reminder that placement announcements are a marketing artifact, transcribed by marketing departments from a document most of them are not free to reproduce in full.

Two numbers about the field do not agree either. Calero's announcement describes an evaluation of seventeen vendors. Flexera's describes sixteen. The 2025 edition evaluated seventeen. There is no way to settle the difference from outside the report, so the honest reading is a field of roughly seventeen vendors, with four names on the Leader rung that the vendors themselves have published.

A password manager on the spend rung is the category boundary moving

1Password was included in the 2025 quadrant. It was not a Leader then; the blog post it published in April 2025 describes inclusion, and says the recognition signals the need for unified SaaS governance and security. In 2026 it announced a Leader placement, and the company's own account of why is worth reading closely, because it is not primarily a spend argument.

The chief executive, David Faugno, put the case in terms of SaaS sprawl made worse by AI tools and agentic workflows, ungoverned access, and costs that arrive with no clear return. The discovery sources 1Password lists for SaaS Manager are identity providers, finance systems, device agents, browser extensions and the vaults the company already runs. That is a security vendor's inventory of an organization rather than a finance department's. Spend optimization is in the product, including the consumption of AI tokens, but it sits beside access requests, automated approvals, audit trails, and the revocation of OAuth tokens that were never in the identity provider to begin with.

The company's own research makes the argument the company wants to make. Its 2025 Access Trust Gap report found that 52 percent of employees had downloaded applications without IT approval and that 27 percent had worked on AI-based applications their employer had not approved. Those are the vendor's numbers and should be read as such. The shape of the claim is what matters: the software that nobody bought through procurement is often the same software that nobody reviewed for security, and the tool that finds the first problem is now positioned to fix the second.

A market that began as a way to count licences has acquired a Leader whose differentiator is access governance. That is a boundary moving, and buyers should treat it as a real change in what the category is for.

Two vendors that led this quadrant in 2025 have not said anything about 2026

Zylo was named a Leader in 2024 and again in 2025, and its own announcements say it was positioned furthest for Completeness of Vision and highest for Ability to Execute in both years. It was also, by its own account, the only provider named both a Customers' Choice in the 2025 Gartner Peer Insights Voice of the Customer report for this market and a Leader in the quadrant. BetterCloud was a Leader in 2025 as well.

Neither company has published a statement about the 2026 edition. A silence is not a demotion. Analyst placements become public when a vendor chooses to make them public, and a company can decide to promote a result quietly, or not at all, for reasons that have nothing to do with where it was placed. What can be said is narrower and still useful: the public record for the 2026 top rung contains four names, the public record for the 2025 rung contained more, and the two lists do not line up the way a buyer scanning announcements would assume. Anyone treating four press releases as the complete Leader set is reading a marketing channel as though it were the research document.

The same limit applies to strengths and cautions. The reprint coverage of this edition records product strengths for the announcing vendors and carries specific cautions for one of them: Torii is described as having shipped sixty-two product updates during the assessment period, with extensive discovery methods and a multi-agent capability, while the report also notes that its data storage is offered only in North America and that its centralized delivery model may constrain multinational deployments. For the other three, the public record is a list of strengths with no equivalent column, which is what a press release is. A buyer who wants the cautions has to obtain the report.

FinOps entered the criteria in the same year AI consumption reached the invoice

Calero's announcement notes that FinOps appears as a primary use case in the Gartner evaluation for the first time in 2026. That line is the most consequential change in the edition, because it describes a change in the unit being managed.

Software was priced by the seat for two decades, and a seat is countable. Hire a person, buy a seat, remove the seat when the person leaves, and the invoice follows the headcount. The pricing models arriving now are consumption-based and hybrid, which means the quantity on the invoice is not a person and does not move when the people do. Calero's vice president of SaaS management, Stephanie Day, framed the shift directly: as SaaS economics moves away from predictable seat-based pricing toward more dynamic consumption and hybrid models, SaaS becomes the next domain of FinOps. AI tools add a third unit on top of that one, the token, which can be consumed by an agent that no employee ever logged in to supervise.

Once the unit moves, the tool has to move with it. A discovery engine that counts logins will count a seat correctly and a token not at all, and a renewal calendar built on seat counts will miss the contract that grew by forty percent without a single new user. Flexera positions its platform at the intersection of IT asset management, FinOps and SaaS operations, which is the same claim arriving from a different direction, and Calero's own framing of SaaS as the next logical domain of FinOps is a third version of it. Three of the four announcing vendors are making the same argument, which is the closest thing to consensus this edition offers.

Gartner put a fifty percent overspend and a five-fold breach risk in one forecast

The report's projections, as cited by the vendors that published them, are worth reading together rather than separately.

Through 2028, Gartner expects more than 70 percent of organizations to centralize SaaS application management on a platform of this kind, up from less than 30 percent in 2025, and expects organizations that lack central visibility and coordinated SaaS life cycles to overspend on SaaS by at least 25 percent. Through 2029, it expects organizations that do not centrally manage SaaS-hosted AI tools to spend at least 50 percent more and to be five times more likely to experience a cyber incident.

The second projection is the one that changes a budget conversation. An overspend argument gets a SaaS management platform funded by a finance team and reviewed once a year at renewal. An argument that puts a cost number and a breach multiple in the same sentence gets it funded by a security team, which is a different budget with a different tolerance for risk and a much shorter approval path. That is the same movement as 1Password's arrival on the Leader rung, stated as a forecast rather than as a product.

Forrester grades the same ground nine vendors deep under a wider name

The cross-analyst counterpart on this site is Software Asset Management Solutions, Forrester's inaugural Wave in the category, published 25 March 2025 and led by principal analyst Biswajeet Mahapatra, scoring nine vendors. Its confirmed Leaders are ServiceNow and USU.

The two evaluations draw their boundaries in different places. Forrester grades the whole asset problem and covers SaaS inside it, including in the published title. Gartner scores SaaS on its own. That difference explains why the two fields barely intersect: neither of Forrester's two confirmed Leaders appears among the four vendors that have announced a Leader placement at Gartner.

The more useful overlap is in the criteria. One of the three selection features Forrester emphasized in its 2025 Wave was SaaS management with extended FinOps. Gartner made FinOps a primary use case fifteen months later. The firm grading the wider market named the overlap first, which is what a wider perimeter buys a buyer, and it means the two documents are not competing accounts of one market. They are a wide view and a narrow view of a problem that both firms had already decided belonged in a single purchase.

What to ask before you standardize on a SaaS management platform

Ask what the discovery actually sees, and get the answer separated into the four sources that matter: the identity provider, the finance system, the device agent and the browser. A product that relies on one of those alone will miss a category of application, and the missing category tends to be the software bought on a corporate card without a ticket, which is also the software nobody has reviewed.

Ask how the platform treats AI tools specifically, and insist on a distinction between an application and a model. An application has a named owner and a renewal date. A model has a consumption meter, a rate that can change without a version number, and users who may be agents rather than people.

Ask what the platform does after it finds an application nobody registered. Discovery and governance are separate capabilities in most of this market, and the second one is where the money is: access requests, approvals, the audit trail, and the ability to revoke access that was granted outside the identity provider.

Ask whether the FinOps half of the product matches your pricing reality. If the contracts are still seat-based, that half is insurance against a renewal you have not signed yet. If they have already moved to consumption, the seat-counting half is the part you can skip in the first year.

Ask whether the placement you are relying on is one the vendor published. Four names are public for the 2026 edition and the field holds roughly seventeen vendors. A shortlist assembled from announcements is a shortlist of the companies with active marketing departments, and the vendors that stayed quiet may have been placed just as well.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

The finance-side reading of consumption is graded separately at Cloud Cost Management And Optimization Solutions. The split between that page and this one is the split between the meter and the contract. Cloud cost management reads what the infrastructure consumed; a SaaS management platform reads what the business agreed to buy and whether anyone is still using it. Gartner made FinOps a primary use case in this edition precisely because those two questions have started arriving on the same invoice.

The policy layer that follows is scored on its own by Gartner at AI Governance Platforms. That evaluation covers policy, risk and the controls around models; this one covers the inventory and the meter. A buyer who needs both will find that the two reports assume each other, because neither scores the discovery problem the other depends on.