AppOmni has published The State of SaaS Security 2024 Report, the company’s second annual examination of this critical area of cyber resilience.
Based on a survey of security decision makers at 644 organizations — and encompassing key findings, ongoing conversations, illustrative anecdotes and analyses of the regulatory environment — the report finds that while software-as-a-service security is finally getting the attention it deserves, there’s still a major gap between intent and implementation. In particular, there are still ad hoc strategies and other practices that fall short of a robust security program. The move toward decentralization has generated confusion over responsibilities, and many organizations remain unaware of which SaaS applications are used, by whom, and what is risky.
Key findings include:
A downside to dispersed domains: SaaS apps are easy to adopt, and they have empowered departments to independently deploy solutions that meet their particular needs. However, the benefits of decentralized operations are accompanied by a blurring of responsibilities between the CISO, line-of-business heads, and the cybersecurity team. Changes required for comprehensive SaaS security often take a backseat to business goals, even as business unit heads lack the knowledge to implement security controls.
Adoption without awareness: SaaS apps are being widely deployed without sufficient knowledge of related risks. When organizations implement SaaS apps, they see a surge in third-party integrations that deliver extended functionalities, automated workflows, and unified data access, etc. However, most organizations lack visibility into their entire SaaS-to-SaaS connection footprint.
Policies without enforcement: 90% of respondents have policies in place to ensure the use of only sanctioned apps, but 34% admit that those rules are not strictly enforced. This percentage actually spiked by 12 points since 2023. The problem is that SaaS apps don’t undergo the same security vetting as those deployed by IT teams, and greatly broaden the potential attack surface. In this environment, organizations need to enforce baseline policies for all business-critical SaaS apps and identify who has access to what data in those apps.
Respondents were from six countries: the US, the UK, France, Germany, Japan and Australia.
