A recent survey, unveiled this month by the Cloud Security Alliance (CSA), reveals that 70% of businesses are now focusing on enhancing SaaS security by forming specialized teams to safeguard SaaS applications. This demonstrates a rising trend in cybersecurity maturity within organizations.
Despite financial uncertainties and significant workforce reductions in 2023, enterprises significantly boosted their investments in SaaS security. The survey highlights a substantial increase in headcount dedicated to SaaS security in 2023, with a 56% rise in SaaS security personnel, along with a 39% surge in budgets.
 |
| Figure 1: Evolution of SaaS security investments from 2022 to 2023 |
The “2025 CISO Plans and Priorities” report, a comprehensive examination of SaaS security, was carried out by the CSA in association with SaaS security expert Adaptive Shield. The survey, which involved 478 cybersecurity professionals worldwide across diverse sectors, offers insights into the successes and hurdles in SaaS security as Chief Information Security Officers (CISOs) look to define their goals for 2025.
Access the comprehensive SaaS security survey report
Principal Discoveries:
Enhanced Significance of SaaS Security
The study emphasizes the escalating significance of SaaS security for businesses utilizing SaaS applications to oversee operations and retain vital information.
“For a long period, SaaS security was not a primary focus. Nonetheless, the current survey scenario portrays a notably different picture, with SaaS security now at the forefront of corporate priority lists,” stated the CSA in its report.
According to the survey, 80% of organizations are currently prioritizing SaaS security, with 41% considering it a high priority and 39% viewing it as moderately critical.
 |
| Figure 2: Evaluation of the prioritization of SaaS security in organizations by security professionals |
70% of Entities Have Formed Specialized SaaS Security Teams
For the first time, the annual survey identified the introduction of SaaS-specific security roles, with over 70% confirming the establishment of dedicated teams: 57% reported teams comprising at least two full-time members for SaaS security, while an additional 13% revealed the presence of one individual solely devoted to securing SaaS applications.
“Dedicated SaaS security teams are logical in corporate environments. The domain of SaaS security is broad and overlaps several realms that typically aren’t covered by a single team. These teams engage in identity security, risk management, endpoint security, and threat identification due to the nature of SaaS,” stated the CSA in the report.
Enhanced SaaS Security Capabilities
Compared to the prior year, organizations have significantly elevated key SaaS security capabilities, with 62% now rating their SaaS security maturity as moderately to highly developed.
 |
| Figure 3: Perception of SaaS security maturity by organizations |
Thanks to advancements in SaaS security capabilities, the visibility into the SaaS environment has improved significantly. Presently, 70% of entities possess moderate (47%) to complete visibility (23%) into their SaaS applications, with the number attaining full visibility more than doubling in the past year, as indicated in the report.
This escalated oversight is crucial for efficient configuration and user administration, as well as for identifying inadvertently or undesirably shared public data resources like documents and repositories.
Classification of MFA attack detection capabilities has also witnessed enhancements.
There has been a notable increase to 62% from 47% compared to a year ago concerning threat detection. In the realm of threat detection, 62% of respondents now express an enhanced ability to identify abnormal user behavior, a significant rise from 44% witnessed last year.
Challenges Persist for Organizations in Securing SaaS
While strides have been made in SaaS security oversight by organizations, 73% of those surveyed have pointed out that gaining visibility into business-critical applications remains their primary hurdle.
As indicated by respondents, the top 10 most challenging applications to secure encompass critical business apps like Microsoft 365, GitHub, Microsoft Teams, Jira, Salesforce, and Google Workspace.
 |
| Figure 4: Top 10 most challenging applications to manage from a security perspective |
Additional obstacles include monitoring and tracking security risks associated with third-party connected apps (65%); pinpointing and rectifying misconfigurations in SaaS environments (65%); ensuring data governance and privacy (63%); and aligning SaaS app configurations with regulatory standards (61%).
 |
| Figure 5: Security professionals rate the biggest challenges in SaaS security |
Positive Outcomes Emerge from SaaS Security Investment
The survey reveals a clear commitment to SaaS security within organizations. Notably, 25% of respondents encountered a SaaS security incident in the past two years, down from 53% in the previous year, indicating a positive trend.
Most commonly reported security incidents included data breaches (52%) and data leaks (50%), followed by unauthorized access (44%) and malicious applications (38%).
 |
| Figure 6: Thanks to investment in SaaS security, incidents have decreased over the past year |
SSPM Enhances Ability to Tackle SaaS Security Challenges
Organizations leveraging SaaS Security Posture Management (SSPM) are faring better than those relying on other tools like CASB and manual audits to secure their SaaS stack.
SSPM users are over twice as likely to have a comprehensive view of their SaaS environment — 62% of these entities can oversee more than 75% of their SaaS landscape, in contrast to the 31% seen in organizations using other tools and manual methods in their approach.
Users of SSPM also find key SaaS security tasks to be more manageable, as opposed to non-SSPM users who struggle with these tasks.
The survey reflects a positive upswing in SaaS security strategies. From establishing dedicated teams to implementing new processes and tools for SaaS security, organizations are prioritizing actions in strengthening SaaS security overall. The integration of SSPM emerges as a pivotal factor in augmenting an organization’s SaaS security posture. The survey underscores the significance of reevaluating and refining SaaS security measures within organizations to incorporate tools that specifically cater to SaaS security, aiding in addressing current challenges and security gaps, thereby reducing the likelihood of future SaaS security incidents.
Explore the full SaaS security survey report now
About Author
