CSA has published its SaaS Security Report 2025, based on a survey commissioned by Valence Security. This shows that while software-as-a-service (SaaS) applications have become foundational to modern business operations, organizations are also ‘facing a rising tide of security challenges’, including visibility gaps, shadow IT, over-privileged access, and unchecked third-party integrations.
The survey, conducted in January 2025 and receiving 420 responses from IT and security professionals, reveals that despite clear progress, most organizations are still relying on tools and strategies not built for the realities of SaaS. They are working with incomplete coverage and inconsistent enforcement.
Key findings in the report include:
- SaaS security is now a high priority for 86% of organizations, with 76% increasing budgets. The focus is on key areas like threat detection and posture management.
- 63% of organizations report external data oversharing and 56% say employees upload sensitive data to unauthorized SaaS apps, often without sufficient visibility or enforcement.
- With 55% of employees adopting SaaS without security’s involvement and 57% reporting fragmented administration, many organizations struggle to maintain consistent oversight.
- Identity and access management remains a challenge, with 58% of organizations struggling to enforce privileges and 54% lacking automation for lifecycle management.
- GenAI tools and SaaS-to-SaaS integrations are expanding the attack surface. 46% of organizations struggle to monitor non-human identities and 56% report concerns about overprivileged API access.
- Despite confidence, many organizations rely on vendor-native tools and manual audits. These fragmented strategies leave critical gaps across the SaaS environment.
