The Hidden Costs of Enterprise SaaS: Six Taxes You're Already Paying

The hidden costs of enterprise SaaS aren't hidden at all once you know where to look: cancellation friction, SSO price gates, fragile identity architecture, third-party breach exposure, unused licenses, and renewal price creep. Regulators, vendors, and security researchers have documented each of these six taxes separately. Put together, they explain why the number on your contract is never the number you actually pay.

The bill you signed isn't the bill you pay

Every SaaS buyer knows the sticker price. Fewer know the real one. Zylo's 2026 SaaS Management Index, built on more than 40 million tracked licenses and $100 billion in spend, found that 77% of IT leaders experienced unexpected costs surfacing after a contract was already signed, and 78% specifically tied those surprises to consumption-based or AI pricing.¹ That's not a rounding error. That's most buyers.

Six taxes make up that overrun: mechanisms baked into how vendors sell, price, and secure their products that quietly shift cost and risk from vendor to customer. Each one has a receipt. Each one shrinks, or disappears, once you own the software instead of renting it.

Tax #1: The cancellation dark-pattern tax

Renting software means someone else controls the exit, and for years that control got abused. In October 2024, the FTC finalized its Click-to-Cancel rule, requiring that ending a subscription take no more effort than starting one.² The rule didn't come from nowhere. It followed a 2024 DOJ/FTC action against Adobe for hiding a steep early-termination fee behind fine print and burying the cancellation flow in dead ends.³ Adobe settled for $150 million.⁴

Adobe is not a fringe operator. It's one of the largest software vendors on earth, which means the incentive to build cancellation friction into a billing flow is structural, not accidental. The tax here is time, retention spam, and, in Adobe's case, a fee you were never clearly told about. Vendors profit from the seats you forgot to cancel and the fee you never noticed on the way out, which is a big part of why SaaS lock-in fees run so high even after you've decided to leave.

Tax #2: The SSO tax

Single sign-on is basic account security. Most vendors sell it as a luxury upgrade. The tracking site sso.tax has cataloged dozens of vendors that charge dramatically more for a plan that simply includes SSO, with premiums like Airtable (+500%), GitHub (+425%), and Railway (+9900%). A separate, quarterly-verified tracker at ssopricing.com found a median SSO premium of 150% across 15 live-verified vendors in 2026, with CRM tools showing the steepest median markup at 1059%, and many vendors requiring a "call us" quote instead of posting the number at all.

CISA has called this out by name. Its Secure by Design guidance argues SSO shouldn't be priced as a luxury good, and that gating it behind enterprise tiers pushes smaller organizations toward weaker defaults out of budget necessity, not risk tolerance.⁵ The tax isn't abstract. It's the literal price difference between a company that can afford to be secure and one that can't.

Tax #3: The architecture tax

Here's what should bother security teams more than the price gate: the SSO you're paying extra for runs on architecture that keeps breaking. SAML relies on signed XML assertions, and XML parsing has produced a steady stream of critical vulnerabilities. In a single stretch spanning late 2025 into early 2026, researchers and vendors disclosed five serious SAML flaws in four months, including a Citrix NetScaler memory-disclosure bug rated CVSS 9.3 that was actively exploited in the wild by late March 2026, and an authentik assertion-injection bug rated 8.8.⁶

The pattern is a class problem, not a vendor problem. PortSwigger researchers documented a signature-wrapping technique they called "Fragile Lock" affecting Ruby and PHP SAML libraries.⁶ The same flaw showed up independently in samlify, a widely used Node.js SAML library, tracked as CVE-2025-47949, letting attackers inject unsigned assertions into a legitimately signed SAML document and impersonate any user, including admins.⁷ Five critical bugs, five different codebases, one structural weakness: XML signature validation is genuinely hard to get right, and the industry keeps proving it.

Tax #4: The third-party trust tax

Renting software means inheriting the security posture of every vendor and every OAuth-connected integration in your stack, audited or not. In October 2023, a threat actor spent nearly three weeks inside Okta's own customer support system, stealing session tokens embedded in uploaded HAR files from 134 customers and hijacking active sessions for at least five of them.⁸ Okta is the identity vendor other companies pay to be more secure. The breach happened anyway, and it happened on the vendor's side of the relationship, not the customer's.

Two years later, the blast radius got bigger. The August 2025 Salesloft/Drift breach compromised OAuth refresh tokens from a trusted third-party integration, and attackers used those stolen tokens to quietly query Salesforce, Google Workspace, and Slack data across more than 700 organizations, none of which had their own systems compromised.⁹ The activity looked legitimate because it used pre-approved app permissions. That's the trust tax: you can lock down your own perimeter perfectly and still get breached through a connector you approved eighteen months ago and forgot about.

Tax #5: The shelfware tax

Some of this tax is simpler: you're just paying for software nobody uses. Zylo's 2026 index put average license utilization at 54%, up from 47% the year before, but still meaning roughly $19.8 million a year in wasted license spend at the average large organization.¹ That's real progress and still a rounding error away from "half the money did nothing."

Layer on the resilience gap and it gets worse. HYCU's 2025 State of SaaS Resilience survey of 500 IT decision-makers found 65% of organizations suffered a SaaS-related breach in the prior year, with average downtime costing $405,770 a day, or $2.3 million over a five-day recovery.¹⁰ Sixty-six percent of those same organizations wrongly believe their SaaS vendor is solely responsible for protecting their data.¹⁰ That assumption gap is its own tax: you're paying for a safety net that, contractually, mostly isn't there. For a fuller accounting of where the wasted dollar goes, see the 2026 breakdown of SaaS budget waste.

Tax #6: The renewal and pricing-mechanics tax

The last tax is structural: costs move after you sign, and they move one direction. Zylo found that 61% of organizations were forced to cut projects or initiatives specifically because of unplanned SaaS cost increases.¹ Renewals, not new purchases, account for 87% of total software spend.¹ That number should reframe how finance teams think about SaaS negotiation: the fight that matters isn't the initial deal. It's the one you have every year after, usually with less leverage than you started with, against a vendor that knows your switching costs have compounded since the last renewal.

How does ownership eliminate these six taxes?

Every tax above has the same root cause: someone else controls the terms, the architecture, or the access. Ownership changes who holds each lever.

• Cancellation friction disappears when there's no subscription to cancel. You retire owned infrastructure on your own schedule.
• The SSO tax disappears because SSO stops being a vendor upsell and becomes an identity decision you make once, across your own systems.
• The SAML architecture tax shrinks when your identity stack isn't a patchwork of every SaaS vendor's individual SAML implementation, each one an independent chance to ship a signature-wrapping bug.
• The third-party trust tax shrinks because your blast radius stops scaling with every integration a vendor adds on their end. Fewer inherited OAuth relationships means fewer inherited breaches.
• The shelfware tax disappears when there are no per-seat licenses sitting unused. You built the capability once; nobody's paying for a login nobody uses.
• The renewal tax disappears because there's no renewal. The cost curve you're on is the one you built, not the one a vendor priced into their next fiscal year.

This is the same logic behind why open-core SaaS traps you in enterprise hell even when the product claims to be open: the branding doesn't matter if you don't own the code and the deployment. Tools built for teams that want to own their internal workflows outright, like Remy, exist precisely because these six taxes are avoidable, not inevitable.

How do you audit your own stack for these hidden costs?

You don't need a security team to find these taxes. Run this checklist against your current contracts:

1. SSO tier check. Pull up your vendor's pricing page. If SSO is gated behind an "Enterprise" tier with no public price, that's the SSO tax in real time.
2. Cancellation flow test. Actually attempt to cancel a low-stakes subscription. Count the steps, retention offers, and support tickets required. Under the FTC's rule, it should take roughly the same effort it took to sign up.²
3. OAuth scope audit. List every third-party app with standing OAuth access to your core systems (Salesforce, Google Workspace, Slack). Ask when each was last reviewed.
4. License utilization check. Pull login logs for your top ten SaaS tools by spend. Anything under 50% active use is a shelfware tax candidate.
5. Renewal terms review. Check whether your contract locks in pricing or allows consumption-based increases mid-term. If it's the latter, budget for the surprise now, not at renewal.

None of this requires new tooling. It requires someone willing to read the contract and the login logs, and to ask, line by line, who actually controls the terms you're paying under.