Built for cybersecurity and security software teams, from public regulatory sources and our own anonymised discovery data. How this works

Discover every app, expense, and identity in your stack

Torii discovers every SaaS and AI application your teams sign up for, including the ones bought on a card or running a free tier. For a company that sells trust, shadow IT and unmanaged AI are the gap you can least afford. Torii finds 878 apps on average, 58% of them shadow IT.

See what's actually running

Read-only. Two weeks. No endpoint agent.

*Torii internal discovery data, January to December 2025. Methodology.

AI spend overview

Last 30 days · all teams · all models

Spend by model

Top users

Trust: Top companies trust Torii

“Once we integrated Torii, it blew our minds. We found apps we didn’t even know we were using – or paying for.” Mark Samuelson
SaaS & IT Manager, AppsFlyer

See how AppsFlyer brought 300+ applications under management with Torii →

Where your money actually goes

Three places, and only one of them shows up in your spend report.

Licenses nobody used

You pay for entitlements collecting dust. Too many licenses go untouched, but without usage data, that waste stays hidden.

Source: Torii 2026 SaaS Benchmark, annual report

AI nobody budgeted

AI consumption cost is the expense you never saw coming. Now you're scrambling to build a plan without data.

Source: Torii 2026 SaaS Benchmark, year-over-year AI spend

Seats nobody offboarded

Every departure should close every account. It rarely does. You keep paying for the seats, and the access stays open behind them.

2.5% of licence seats are still assigned to people who have left the company.

Source: Torii 2026 SaaS Benchmark, annual report

Your customers audit you before they buy. The evidence starts with one list.

Your auditor

Annually, then at every renewal. Trust Services Criteria, the point of focus under CC6.1: The entity identifies, inventories, classifies, and manages information assets (for example, infrastructure, software, and data).

Primary source →

Your contract

Continuous · 30 days’ notice. Standard Contractual Clauses, Module Two, Clause 9(a), Option 2: the importer has general authorisation to engage sub-processors from an agreed list.

Primary source →

Your buyer’s AI programme

Every enterprise deal. Microsoft’s Supplier Data Protection Requirements v12, March 2026, devotes Section K, requirements 51 to 63, to AI systems.

Primary source →

What they all actually ask for

Shared by all of them: a complete, current list of every third-party application and service in use, and what regulated or customer data each one touches.

Your auditor adds an owner and a data classification per asset.
Your contract adds a subprocessor list you must keep current.
Your buyer’s AI programme adds every AI system and its subprocessors.

Torii produces and maintains that list. It gives you the inventory those artefacts are built from, with an owner and a data classification per application.

Torii’s discovery finds what others miss

878 apps the all-industry average number of applications per company.

190% AI spend the all-industry rate at which AI spend grew year over year.

26 of the top 50 of the most widely adopted shadow applications are pure-play AI tools.

403 days median time an unauthorized AI tool runs before anyone detects it.

Start with discovery, not policy

1. Two weeks: Read-only discovery across browser activity, OAuth grants and direct sign-ups.
2. One week: You get the inventory with an owner and a data classification per application, plus the overlap map.
3. Then decide: Sanction, consolidate or retire — with the register as the input to that decision.

You’re in control of the process

Start a free pilot project

We’ll get you up and running with a pilot project so you can verify results before signing a contract.

Stop the pilot at any point

Two weeks, read-only, no endpoint agent, no change to user-facing systems.

Exit terms in writing, up front

Data deletion certified on termination, the same standard your own customers hold you to in a vendor security review.

A security pack that you can trust

Linked here:

• SOC 2 Type II →
• Subprocessor list →
• DPA →
• Privacy notice →

What we typically find at your size

FY26 model

AI spend — not counted in the figure above. How the number is built.

1. Headcount × a typical attach rate per application.
2. Costed at published list price.
3. Grossed up for the long tail.
4. Cloud and AI are excluded from the recovery figure.
5. A recovery rate per application.

Find your actual number in two weeks

Book a 30-minute discovery review

Pick your company size and drop your work email.

Rachel Castan Account Executive

Here’s what’s next

1. You pick a time that works for you.
2. You have a 30-minute call with Rachel — get every question answered, see if it’s a good fit, and if so, map out a plan together.
3. Initiate a pilot project on your terms.

Book a 30-minute review