Kaseya has released its 2026 SaaS Security Report, which found that trust is the primary source of risk within modern IT environments. The report claims that threat actors have abandoned perimeter attacks and turned to softer targets like identities, OAuth integrations, and collaboration workflows, leaving an unnoticed and unaddressed trust gap.
The report analysed more than 27.6 billion SaaS security events across over 50,000 SMB environments, including 5,400 MSP partners and 6.2 million end-user accounts. The data highlights a critical reality: as SaaS ecosystems expand, everyday operational conveniences like unmanaged guest accounts – which now make up 69% of all monitored accounts (4.3 million vs 1.9 million licensed users) – persistent third-party access, and externally shared data are creating ‘massive security liabilities’.
Today’s AI-emboldened threat actors see one interconnected attack environment, whereas most organizations defend their infrastructure in pieces. The most resilient organizations will be those that embrace continuous monitoring, identity governance, and automated response as foundational requirements.
Jim Lippie, Chief Product Officer, Kaseya
Other key findings include:
The rise of machine identities and AI-driven exploitation
The rush to adopt AI has triggered a sprawl of third-party OAuth integrations that use persistent tokens instead of credentials, granting attackers permanent data access even after password resets. Consequently, non-human service principal logins now account for 20% of critical security alerts. Simultaneously, attackers use AI-driven automation to instantly locate and exploit dormant guest accounts, weaponising these forgotten entry points faster than manual defences can react.
Hiding in plain sight: the failure of legacy controls
Legacy controls like geolocation blocks are also failing as attackers route traffic through trusted cloud hosts and VPNs. Outside North America, 44% of unauthorised logins originated from trusted infrastructure and outsourced hubs – led by India (14%), the Philippines (10%), Germany (seven%), the UK (seven%), and the Netherlands (six%) – allowing intruders to blend into normal business traffic. Once inside, attackers exploit massive identity gaps: 56% of accounts lacked active MFA, and only 27% of small and medium-sized organizations enforced organization-wide MFA. This exposure, combined with a rise of file sharing, allows attackers to silently exfiltrate data from within the network.
Microsoft 365 exposure
Data leakage remains exceptionally high in productivity environments; in Microsoft 365, nearly half (45%) of all shared files were sent outside the organization.
Severe alert fatigue
In 2025, 98.9% of security events SaaS Alerts monitored were classified as low severity, but organizations still faced more than 278 million medium- and critical-severity alerts requiring investigation.
Closing the gap
To counter these evolving threats, organizations must transition from rigid perimeter defences to active, identity-first governance frameworks. Bridging the modern trust gap requires businesses to move away from static event tracking and instead prioritise automated behavioural monitoring that can flag anomalous activity inside trusted accounts. By aggressively consolidating security stacks, enforcing organization-wide MFA, and continuously auditing machine identities and external sharing permissions, organizations can eliminate critical visibility silos and systematically neutralise attacker persistence before a breach occurs.
