Most lists of SaaS metrics are really lists of cost metrics. They tell you what you spend, how many licences sit unused, when the next renewal lands - and for running a finance function, that is the right set.
My view is that for a bank it is also the less important half. A bank measured only on cost metrics is measuring half of what its SaaS estate is actually doing, because the other half - the governance half, does not show up on a spend dashboard at all. And it is the half a supervisor cares about.
So the eight below split into two groups. The first four are the familiar cost-and-usage metrics every organisation should track; a bank runs them like anyone else. The second four are the ones a general metrics list leaves out and a regulated firm cannot - the metrics that measure whether the estate is governed, not just whether it is cheap.
The four cost and usage metrics
These are well understood and worth stating only briefly, because the discipline here is shared with every other SaaS buyer and is covered well elsewhere.
Total SaaS spend and spend per employee tells you the size of the estate in money, and benchmarks it - a rising per-employee figure is the first signal that sprawl is outpacing headcount. Licence utilisation, active users against seats paid for - is the single most reliable waste indicator; a large share of licences in any organisation go unused in a given month, and the gap is pure recoverable spend.
Application count and overlap tracks how many distinct tools the estate runs and how many do the same job, which is where consolidation savings live. And renewal exposure, the value and timing of contracts coming up for renewal, is what turns renewals from surprises into planned decisions.
Run these well and the finance side of SaaS management is in order. None of them, though, tells you anything about whether the estate is governed - which for a bank is the half that carries the regulatory risk.
The four governance metrics a bank cannot skip
Here is the set a general metrics list never includes, and the reason this article exists. For a regulated financial firm, these four measure the thing cost metrics are blind to: whether the bank is actually in control of what its software is doing.
The first is discovery coverage - the share of the estate the bank can actually see, expressed honestly as discovered tools against estimated total. Every other metric is only as trustworthy as this one, because a utilisation or spend figure calculated over an incomplete inventory is precise about the wrong denominator.
In the years I spent on the buying side of technology - onboarding vendors, running the tools estate, answering for it - the number nobody could give me was this one: what share of what we run do we actually see. Every other figure was quoted to a decimal place over an estate we could not fully list.
A bank that cannot state its discovery coverage does not actually know how good any of its other numbers are.
The second is assessment currency - the share of tools supporting critical or important functions that have a current, in-date risk assessment. This is the metric a supervisor is, in effect, testing when they examine the estate: not "do you have tools" but "do you know, currently, what the ones that matter are doing." A high cost-efficiency score with a low assessment-currency score is a bank that is cheap and ungoverned.
The third is time-to-discovery - how long, on average, between a new tool appearing in the estate and the bank knowing about it. Cost metrics are lagging; this one is leading. A long time-to-discovery means the bank is governing on a delay, finding tools quarters after they arrived and after they have already been processing data or supporting a function ungoverned. Shortening it is what moves a bank from periodic clean-ups to actual control.
The fourth is supply-chain depth, the share of critical tools for which the bank has mapped not just the vendor but the fourth parties beneath it. A bank can have complete coverage of its direct vendors and still be blind one tier down, which for DORA's supply-chain expectations is the layer that increasingly matters.
Measuring it turns "we think we know our chain" into a number the bank can actually report.
Why the two groups have to be read together
The point of separating the eight is not to rank one group over the other - it is that a bank needs both, and the two tell you different things. The cost four tell you whether the estate is efficient; the governance four tell you whether it is controlled.
An estate can score beautifully on the first group and badly on the second, and that specific combination, cheap and ungoverned - is the one a bank should fear most, because it looks like success on the dashboard the board usually sees.
That is really the argument for tracking all eight. A bank that measures only cost is optimising the half of the problem that does not carry regulatory consequence, and flying blind on the half that does. The governance four are not harder to track than the cost four - they just require an inventory honest enough to compute them over, which is the same foundation the cost metrics quietly depend on anyway.
The through-line
Across all eight, one metric sits underneath the rest: discovery coverage. The cost metrics are computed over the inventory, the governance metrics are computed over the inventory, and a bank that has not measured how complete its inventory is has not earned confidence in any of the other seven.
Start there, get it honest, and the other seven become numbers the bank can actually stand behind - in a board pack and in front of a supervisor alike.
Frequently asked questions
What SaaS metrics should a bank track?
Montro's answer is eight, in two groups. Four cost-and-usage metrics every organisation tracks: total spend and spend per employee, licence utilisation, application count and overlap, and renewal exposure. And four governance metrics specific to a regulated firm: discovery coverage (how much of the estate you can see), assessment currency (share of critical-function tools with a current risk assessment), time-to-discovery (how fast new tools are found), and supply-chain depth (how far below the direct vendor you can see).
A bank that tracks only the first four measures efficiency and misses governance.
What is the most important SaaS metric for a bank?
Discovery coverage - the share of the estate the bank can actually see - because every other metric is computed over the inventory and an incomplete inventory makes the rest unreliable. A utilisation rate or an assessment-currency figure calculated over a partial estate is precise about the wrong total.
A bank should be able to state its discovery coverage honestly before trusting any of its other SaaS numbers.
What is the difference between cost metrics and governance metrics for SaaS?
Cost metrics - spend, utilisation, overlap, renewals - measure whether the estate is efficient. Governance metrics - discovery coverage, assessment currency, time-to-discovery, supply-chain depth, measure whether it is controlled. A general metrics list covers the first group; a bank needs both, because an estate can be efficient and ungoverned at once, which looks like success on a cost dashboard while carrying the regulatory risk the cost view cannot see.
Why do banks need more SaaS metrics than other companies?
Because a bank is measured by a supervisor as well as by finance. The cost metrics every firm tracks tell the bank whether its estate is efficient, but not whether it is governed to the standard DORA and related regimes expect.
The four governance metrics - coverage, assessment currency, time-to-discovery and supply-chain depth - measure the control a regulator actually tests for, which a general SaaS metrics list never includes because a general firm is never asked.
