Although most businesses have encountered security breaches or incidents over the past year, the vast majority of organizations still express confidence in their SaaS security status.

This is based on the latest research released by AppOmni, which points out that SaaS is one of the most attacked targets in the enterprise's attack surface.

The study includes a survey of more than 800 leaders and policy makers in the security field, which the report warns is one of the most defensive areas in modern enterprises.

The risks faced by enterprises in this regard are increasing, and the SaaS market is also expanding. The number of applications that enterprises now use is dozens or even hundreds.

For example, the survey found that more than half of enterprises are using at least 50 SaaS solutions, while more than one-third have 100 or more SaaS applications.

It is worth noting that up to 75% of enterprises have experienced SaaS data breaches or security incidents in the past 12 months. However, the study also found that 89% of the companies believed that they had sufficient visibility into their SaaS environment.

AppOmni CEO Brendan O'Connor said the study revealed a growing disconnect between the threats facing companies and their ability to respond.

“The data shows a worrying 'control hallucination' that the vast majority of security leaders are confident about their SaaS security situation, although many of them are facing SaaS-related security incidents,” O'Connor said.

“SaaS risks today are not theoretical threats – they are real and are affecting the operations of enterprises.”

Important issues of SaaS security

According to AppOmni's survey, data security remains one of the most concerned issues for enterprises. 57% of respondents listed data breaches and intellectual property losses as their biggest concerns.

Meanwhile, slightly more than one-third (37%) of respondents expressed serious concerns about the leak of customer data.

Additionally, AppOmni warns that AI is changing the way security teams work, especially in governance. For example, nearly two-thirds (61%) of respondents said they expect AI to dominate the discussion on SaaS security in the coming year.

Respondents also pointed out that the regulatory demand for non-human identity and generative AI tool access in SaaS applications is rising.

In terms of tool support, the gap is still obvious. Although nearly one-third of respondents said they needed a dedicated SaaS security situation management (SSPM) solution, only 13% of enterprises currently use such tools.

Safety practice and risk management status

A key issue mentioned in AppOmni's research is the ongoing lack of basic security practices. For example, nearly half (41%) of security incidents are due to permission issues, while 29% are due to configuration errors.

AppOmni notes that this shows that there is still a lot of work to be done in improving overall safety awareness and best practices.

In addition, the research also pointed out that the risk management practices of enterprises still need to be improved. Only slightly more than half (52%) of businesses evaluate SaaS-related security risks only through regular reviews.

The company notes that this practice leads to critical vulnerabilities and threats that may be permanent and undetected. Currently only 43% of enterprises have achieved continuous or near real-time monitoring.

Problems of excessive trust in suppliers

The most worrying point in the survey is the complacency and overconfidence of enterprises in terms of SaaS security.

A little over half (53%) of respondents said they were relieved about the security situation in this area, but many of them were based on trust in SaaS vendors rather than their own verification.

Only 16% of respondents handed over SaaS security responsibility entirely to the security team, while 43% of companies handed over the responsibility to different business units.

"The key lesson that businesses need to understand is that visibility does not equal security, and trust in SaaS vendors cannot be considered a security policy," said O'Connor.

“We need to move from temporary, passive processes to mature, standardized approaches based on continuous monitoring and clear responsibilities.”

Be sure to follow php.cn's Google News for our latest news, analysis and comments.

The above is the detailed content of SaaS security is now a major blind spot for enterprises. For more information, please follow other related articles on the PHP Chinese website!