Direct Costs: The License Fee

The direct cost of unused software is simply what you pay for licenses that nobody uses. For a seat-based SaaS tool, this is straightforward: the number of unused seats multiplied by the per-seat price. For a flat-rate tool that nobody uses, the entire subscription is a direct waste.

These numbers add up quickly. A 100-person company with 30% unused licenses across a $200,000 annual SaaS budget is paying $60,000 per year for nothing - before factoring in any indirect costs. This is the number most finance teams focus on, and it is the most straightforward to measure and recover.

But the direct cost is just the beginning. Every unused software tool carries additional costs that are harder to see but collectively represent two to four times the license fee itself.

Total cost research: Studies of software asset management programs consistently find that the indirect costs of unused and poorly managed software - security incidents, IT overhead, audit findings - represent 200-400% of the direct license waste. Companies that cancel $50,000 in unused licenses often find they also eliminate $100,000+ in indirect costs.

Indirect Cost 1: Security Risk

Every active software account in your environment that belongs to a tool nobody uses is an attack surface. Software vendors patch their products on a regular cadence - but those patches only matter if someone is monitoring the tool and applying updates. Unused tools often go unmonitored, which means they may be running with known vulnerabilities for months.

The Credential Exposure Problem

Unused SaaS accounts typically hold credentials - integration tokens, API keys, stored passwords, and user login credentials. When the software vendor experiences a breach (which happens regularly - SaaS vendors are high-value targets), those credentials can be exposed. If the unused tool is integrated with other systems via API keys, a breach in the unused tool can become an entry point into your core systems.

Former Employee Access

Accounts belonging to former employees represent a specific and serious security risk. A disgruntled former employee with still-active credentials to a SaaS tool that stores customer data, financial records, or intellectual property can cause significant damage. The cost of a single security incident caused by a forgotten account - incident response, legal review, customer notification, regulatory response - typically runs $50,000 to $500,000 depending on the scope.

Quantifying the Risk

Assigning a dollar value to security risk requires actuarial thinking. A useful approximation: for each unused account belonging to a tool that touches sensitive data, estimate the probability of an incident (typically 1-3% per year for well-managed environments, higher for poorly managed ones) multiplied by the expected cost of that incident. Even at 2% probability with a $100,000 incident cost, each high-risk unused account carries $2,000 in expected annual cost beyond the license fee.

Indirect Cost 2: IT Overhead

IT teams are responsible for every software tool in the company's environment, regardless of whether it is actively used. This responsibility creates overhead in several forms:

Vendor Management Time

Each SaaS tool requires periodic vendor management: reviewing invoices, responding to vendor communications, handling billing disputes, and evaluating upsell offers. For an unused tool, this is entirely wasted effort. Even a conservative estimate of 30 minutes per tool per month - at a fully loaded IT/ops cost of $75/hour - represents $450/year in overhead per unused tool, on top of the license cost itself.

User Support and Provisioning

Unused tools still require IT support when users lock themselves out, request access, or report issues. For tools that are technically active but sparsely used, IT tickets related to the tool represent staff time spent maintaining something that delivers minimal value.

Audit and Compliance Documentation

Every software tool that touches company data must be documented in security audits, SOC 2 reviews, ISO 27001 assessments, and compliance programs. The documentation burden for a single additional tool - questionnaires, vendor security reviews, configuration documentation - runs 4 to 8 hours per annual audit cycle. At $75/hour, that is $300 to $600 per tool per audit, purely for the documentation overhead.

Indirect Cost 3: Compliance and Audit Risk

For companies in regulated industries - healthcare, finance, legal, government contracting - unused software carries compliance exposure beyond just the IT overhead.

Data Processing Agreements

If a software tool processes personal data covered by GDPR, CCPA, HIPAA, or similar regulations, the company has legal obligations regarding how that data is handled - even if the tool is not actively used. An unused CRM that still holds customer records, or an unused HR tool that still contains employee data, creates ongoing compliance obligations that are easily overlooked and difficult to remediate after the fact.

Software Asset Management Audits

Software vendors periodically audit their customers' license compliance. A company with poor visibility into its software inventory is at higher risk of both compliance findings (using software without proper licenses) and over-payment findings (paying for more licenses than are contractually required). Both findings carry costs - remediation, penalties, and renegotiation time.

How to Calculate Total Cost of Ownership for Unused Tools

A practical framework for calculating the true cost of an unused tool:

  • Direct license cost: The actual subscription or per-seat fee
  • Security risk premium: (Data sensitivity level: low/medium/high) x (estimated incident probability) x (estimated incident cost). Use $0 for low, $500/year for medium, $2,000/year for high sensitivity tools.
  • IT overhead: 30 minutes x $75/hour x 12 months = $450/year per tool
  • Audit documentation: 6 hours x $75/hour x audit frequency = $450/year for annual audits
  • Total annual cost: Sum of all four categories

Applying this framework typically reveals that unused tools in sensitive data categories cost $3,000 to $5,000 per year in total cost against a $500 to $1,000 direct license fee - a 3x to 5x multiplier. Even for low-sensitivity tools with minimal security risk, the overhead alone adds 30 to 50% to the license cost.

The business case for finding and eliminating unused software is therefore much stronger than the license cost alone suggests. SubScrub's automated license detection pays for itself when measured against this full cost picture, not just the raw license savings.

Board presentation tip: When building a business case for a SaaS audit program, use the total cost of ownership framework rather than just the license waste number. A $60,000 license savings becomes a $150,000 to $250,000 total cost reduction story when indirect costs are included - a far more compelling investment case.