SaaS ideas your next customers are already looking for
100 SaaS startup ideas for the people who said they'd pay, from agency owners to dentists. Micro SaaS ideas, AI SaaS ideas and B2B SaaS ideas: find yours, build it, sign them up.
Popular:
| # | Idea |
|---|
No idea matches this filter.
Pain points in business: what people struggle with
Search the problems to solve, as people described them on Reddit and other platforms, in their own words.
Popular:
| # | Pain point |
|---|
No pain point matches this filter.
Access Governance Drift
Organizations lack a unified, automated way to track, review, and revoke user and service access across fragmented identity systems, causing drift, audit failures, and stale credentials.
In their words
We're past the point where an Excel sheet plus HR and ITSM tooling is enough.
About a third of our application estate never got onboarded, mostly older or vendor-managed apps that don't support the connectors our PAM tool expects.
our requirement is basic like user onboarding off boarding and access management.
it's been a mess of Azure AD groups, app specific roles, and random CSVs for joiner mover leaver that get touched once a quarter if we are lucky
If it is not dead simple, they ignore it and you have to chase them.
the NHI introduction with legitimately no comms to customers and pretty much increasing licenses costs for a PAM integration by 300% is truly unacceptable
most SaaS applications I come across are misconfigured to all hell
every server, every account, every password, one xlsx file, emailed around whenever someone new joins
It's one of those controls that feels boring until you find an account that should've been removed six months ago
every single dev just slaps s3:* or literal AdministratorAccess on their roles because they don't want to spend 5 minutes debugging permissions
Is there a saner way that doesnt involve me manually reconstructing what someone could have reached months ago?
We have no audit trail of API calls per workload. When the security review asked "does this workload actually need this level of access" the honest answer was we don't know.
it's difficult for me to recommend you to orgs that are scaling up. Compliance in particular was the biggest issue.
We use at least a couple of SaaS products where RBAC is severely limited in what it can govern or where API keys do not have any kind of governance so handing one out is basically handing out read/write on the entire system.
IT and security teams
Where they talk
- r/IdentityManagement
- r/sysadmin
- r/cybersecurity
- r/AskNetsec
- r/entra
- r/aws
- r/kubernetes
- r/AZURE
Tools they use today
- Microsoft Entra
- Active Directory
- IGA
- Okta
- SailPoint
- IdP
- PowerShell
- Saviynt
Why those fall short
- password manager not used or declined; LAPS undone; SSO not set up
- pen-testing didn't pick up storage integration and cross-account access issues
- Needed permissions only appear at runtime; logs lack the specific permission identifier
- reviews only catch offboarding failures after the fact; managers approve all
- Assessors reject JIT; self-updaters need elevation; users still need manual workarounds
Map of ideas
Drawing the map…