What is SaaS security
SaaS security is the combination of policies, processes and technical controls used to protect cloud-based software, user identities, business data, configurations, integrations and application availability.
SaaS stands for Software as a Service. A provider hosts the application, and customers access it over the internet. Examples include Salesforce, Microsoft 365, Google Workspace, Slack, Zoom and Shopify.
NIST's SP 800-145, published on, describes SaaS as the use of provider-hosted cloud applications through a web browser or program interface, without customers managing the underlying servers, networks or operating systems.
SaaS security covers 2 connected responsibilities:
- The SaaS provider secures the application and its underlying environment.
- The customer secures its users, data, configurations and connections to the application.
SaaS Security at a Glance
| Area | What SaaS security protects |
|---|---|
| Identity and access | User accounts, administrator privileges, authentication and sessions |
| Data security | Business data stored in and transferred through the SaaS application |
| Configuration security | Sharing settings, permissions, policies and administrative controls |
| Application security | Software vulnerabilities, secure development and tenant isolation |
| Integration security | APIs, OAuth applications, plugins and SaaS-to-SaaS connections |
| Monitoring | Audit logs, suspicious activity, security alerts and incident detection |
| Resilience | Backups, service availability, recovery and incident response |
| Vendor risk | The provider's security controls, compliance evidence and subcontractors |
Why Is SaaS Security Important?
SaaS security matters because SaaS applications often contain customer records, financial data, employee information, intellectual property and internal communications. A compromised account, broad sharing setting or malicious third-party integration can expose that information without an attacker gaining access to the company's physical network.
SaaS also changes the security boundary. The provider manages most of the infrastructure and application operation, while the customer controls important decisions about users, permissions, data sharing and integrations.
CISA notes that SaaS providers generally control the technology stack, but customers and providers must both secure application and API connections.
What Are the Main SaaS Security Risks?
The main SaaS security risks include account takeover, excessive permissions, misconfiguration, unsafe integrations, shadow SaaS, non-human identity weaknesses and cross-tenant data exposure.
1. Account Takeover
Attackers can steal passwords, session tokens or authentication cookies to access a legitimate SaaS account. A compromised administrator account creates greater risk because it may allow an attacker to change settings, create users, export data or approve integrations.
Useful controls include:
- Multi-factor authentication
- Single sign-on through a trusted identity provider
- Conditional access policies
- Strong session management
- Automated removal of former employees
- Alerts for unusual login activity
2. Excessive Permissions
Users, service accounts and integrations may receive more access than they need. Excessive privileges increase the impact of stolen credentials and make accidental data exposure more likely.
Role-based access control, least-privilege policies and regular access reviews help limit this risk.
3. Misconfiguration and Data Oversharing
Common examples include:
- Publicly accessible files
- Links that allow unrestricted access
- External users with excessive permissions
- Weak administrator settings
- Unrestricted exports or downloads
- Sensitive data stored in the wrong workspace
Configuration management belongs in the SaaS security program. Teams should define approved settings, check for changes and correct risky configurations.
4. Unsafe Third-Party Integrations
SaaS applications often connect to other services through APIs, OAuth permissions, plugins and marketplace applications. A connected application may be able to read, modify or delete data.
Security teams should review:
- Which applications are connected
- What permissions each integration has
- Which user or service account authorized it
- Whether the integration is still necessary
- Whether access tokens can be revoked centrally
5. Shadow SaaS
Shadow SaaS occurs when employees adopt applications without approval or security review. Unapproved services can create unknown data stores, unmanaged accounts and hidden connections to other systems.
A SaaS inventory should identify each application's owner, users, data types, integrations and business importance.
6. API and Non-Human Identity Risk
Automation accounts, API keys, service accounts and access tokens can retain access without a human actively logging in. Poorly managed non-human identities can become an overlooked route into business systems.
Organizations should assign owners to service accounts, limit token permissions, rotate secrets and monitor API activity.
7. Cross-Tenant Data Exposure
Many SaaS applications use multi-tenant architecture, where multiple customers share parts of the provider's infrastructure. A vulnerability or authorization failure could expose one customer's data to another.
OWASP identifies broken tenant isolation, cross-tenant data leakage and tenant impersonation as key risks in multi-tenant applications.
How Does the Shared Responsibility Model Work?
The shared responsibility model divides SaaS security duties between the provider and the customer, although the exact division varies by provider and contract.
| Responsibility | Usually handled by the SaaS provider | Usually handled by the customer |
|---|---|---|
| Physical data centers | Yes | No |
| Cloud infrastructure | Yes | No |
| Core application security | Yes | Partly |
| Vulnerability management | Yes | Partly, especially integrations and usage |
| User accounts and permissions | Shared | Yes |
| Data classification and sharing | Shared | Yes |
| Connected applications and APIs | Shared | Yes |
| Security settings | Shared | Yes |
| Audit logs and monitoring | Provider supplies capabilities | Customer reviews and responds |
| Backup and recovery | Provider provides service-level capabilities | Customer verifies recovery needs and options |
NIST states that SaaS providers generally assume more responsibility for security and privacy controls than customers because the provider operates the application and its underlying environment. Customers still need to assess the service, define requirements and establish enforceable security expectations with the provider.
What Controls Should a SaaS Security Program Include?
A SaaS security program should combine application discovery, identity controls, configuration management, integration oversight, monitoring, data protection, vendor assessment and incident response.
SaaS discovery and inventory Maintain a current list of applications, owners, users, data categories and integrations.
Centralized identity management Use single sign-on, multi-factor authentication and automated user provisioning where supported.
Least-privilege access Give users, administrators and integrations only the access they need.
Secure configuration baselines Standardize settings for sharing, external access, downloads, administrator roles and data retention.
Integration governance Approve applications before connection, limit OAuth scopes and remove unused integrations.
Continuous monitoring Collect audit logs, monitor administrator actions and investigate unusual access or data exports.
Data protection Use encryption, data loss prevention, retention controls and suitable backup or export processes.
Vendor and third-party assessment Review the provider's security documentation, incident history, resilience, access controls and subcontractors.
Incident response Define what happens if an account is compromised, data is exposed, an integration is abused or the provider becomes unavailable.
The Cloud Security Alliance's SaaS Security Capability Framework provides customer-facing security controls that organizations can use for SaaS vendor assessments and security program design.
What Is the Difference Between SaaS Security and Cloud Security?
Cloud security is the broader discipline covering cloud infrastructure, platforms, applications, identities, networks and data.
SaaS security focuses specifically on cloud-hosted applications and how organizations use them. It places particular emphasis on:
- Application configuration
- User and administrator access
- Data sharing
- SaaS integrations
- API permissions
- Tenant isolation
- Provider transparency
- Application audit logs
SaaS security is part of cloud security, but traditional network and infrastructure controls do not fully protect SaaS applications.
What Is SSPM?
SaaS Security Posture Management, or SSPM, is a category of security tooling that helps organizations discover SaaS applications, assess configuration weaknesses, monitor permissions and identify risky integrations.
SSPM can help when an organization has many SaaS applications or cannot manually review every configuration. It does not replace identity management, vendor assessment, secure application development or incident response.
How Should a Business Start Improving SaaS Security?
Start with these 5 actions:
- Create an inventory of every SaaS application in use.
- Enable multi-factor authentication and single sign-on.
- Review administrator accounts and remove unnecessary privileges.
- Audit external sharing and third-party integrations.
- Confirm that important SaaS data can be recovered if an account or service is compromised.