TL;DR: Software asset management (SAM) is the discipline of controlling every software asset an organisation owns across its whole lifecycle - purchase, deployment, usage, licensing, and retirement - so the organisation stays compliant with its licence agreements, avoids overspending, and can defend itself in a vendor audit. It is broader than SaaS management, which handles only the cloud-subscription slice. And its traditional methods pre-date shadow IT and shadow AI, which is why modern SAM depends on a foundation its older playbook never needed: discovery of what the organisation is actually running.
Most organisations already run software asset management, in the sense that someone owns a spreadsheet of licences and a renewal calendar. It is treated as a procurement chore, touched once a quarter when a vendor invoice arrives.
That framing was adequate when the only way to acquire software was to buy it, install it, and record it. It stopped being adequate the moment a team could stand up a tool with a corporate card and an email address, and it stopped entirely once those tools could call an external model on their own. The register still exists. What it describes and what the organisation is actually running have quietly drifted apart.
So the question I would put to any team is not whether they do SAM. It is whether the thing they do still points at reality. My experience is that it usually does not, and nobody has noticed.
What SAM actually is
Software asset management is the discipline of controlling every software asset an organisation owns across its whole lifecycle - procurement, deployment, usage, licensing, and retirement. The point is not the inventory for its own sake.
The point is the set of decisions the inventory lets you make: whether you are paying for seats nobody uses, whether a renewal is worth signing, whether a vendor who arrives asking for an audit will find you matching the agreement you signed or exposed to a true-up bill.
Three jobs sit underneath it. The first is licence compliance, knowing that what is deployed matches what was paid for, so an audit is a formality rather than a shock. The second is cost optimization - knowing where spend is going, so renewals are negotiated from evidence rather than habit. The third is audit-readiness - being able to produce, on request, a defensible account of what the organisation runs and under what terms.
Everything in that list depends on one thing being true: that the inventory is complete. A licence-compliance position built on a partial inventory is not a compliance position, it is a guess. Cost optimisation that only sees the tools procurement bought misses whatever grew up outside procurement. This is why inventory is not the boring precondition to SAM but the whole foundation it stands on.
How SAM differs from SaaS management
It is easy to treat SAM and SaaS management as the same thing under two names. They are not. SAM is the broader discipline - it covers on-premise software, perpetual licences, desktop installs, server estates, and cloud subscriptions alike. SaaS management handles one slice of that: the cloud-subscription tools bought per seat and billed monthly or annually.
SaaS management matters because that slice has grown fast, and the tools built for the old estate - the ones that scan a network for installed binaries, cannot see a subscription that lives entirely in someone else’s data centre. But it remains a subset.
An organisation that manages its SaaS well and ignores the rest has solved part of the problem. An organisation doing SAM properly treats SaaS management as one of its functions, not a replacement for it.
The distinction matters for a practical reason. Treat SaaS management as all of SAM and you will buy a tool that watches your subscriptions and conclude the problem is covered. It will not be, because the subscriptions are not where the hardest gap now sits.
Why discovery is now the foundation
Traditional SAM made an assumption that held for decades and quietly stopped holding. It assumed software entered the organisation through a front door - a purchase order, an IT-managed install, a contract someone signed. Discover what came through that door and you discovered the estate.
That assumption is now broken in two places. The first is shadow SaaS: tools adopted by a team without going through procurement, paid on a card, never recorded.
The second is sharper. A tool already inside the estate, already approved, can now add a capability nobody re-approved - a connector to an external model, a new data flow, an automation that reaches out to a service the register never listed. The asset on the books has not changed its name. What it does has.
When I ran technology estates on the buying side, the register was never wrong on the day it was written. It went wrong in the months after, as the tools we had signed off quietly became things we had not, and the document kept insisting otherwise.
So the foundation of modern SAM is no longer the register. It is discovery: the ongoing work of finding what the organisation is actually running, rather than reading back what it once recorded.
A register tells you what you believed on the day you wrote it. Discovery tells you what is true now. The gap between the two is exactly the risk that licence compliance, cost control, and audit-readiness were meant to close.
I will concede the reframing is uncomfortable. It means the document a team has trusted for years was never quite the source of truth they took it for.
Where this leaves SAM
SAM is not obsolete. The three jobs it has always done still need doing, and the lifecycle it has always managed is still the right frame. What has changed is the input.
The discipline was built on the premise that you could enumerate the estate by looking at how software was bought and installed. That premise no longer produces a complete list, and SAM built on an incomplete list produces confident answers to the wrong questions.
The organisations that keep SAM useful are the ones that put discovery under it - that stop treating the register as the source of truth and start treating it as a claim to be checked against what is running. The register remains the place you record decisions. It is no longer the place where you learn what is going on.
Frequently asked questions
Is SAM the same as IT asset management (ITAM)?
No. ITAM covers all IT assets - hardware, devices, and software. SAM is the software-specific discipline within it, concerned with licences, usage, and the software lifecycle rather than the physical estate.
Do we need a SAM tool if we already have a SaaS management tool?
A SaaS management tool covers the cloud-subscription part of the estate. If the organisation also runs on-premise or licensed desktop and server software, that sits outside the SaaS tool’s view, and SAM is the discipline that covers both.
Where does shadow IT fit into SAM?
Shadow IT - software adopted outside the procurement process, is precisely what a register-based SAM approach cannot see, which is why discovery has become the foundation rather than an optional extra.
