Companies underestimate number of SaaS applications in their environment
A new research study focused on SaaS usage among enterprises across the USA, UK, and Europe, highlights a striking difference between consumption and security of SaaS applications. In fact, the majority of respondents (74%) reported more than half of their applications are now SaaS-based, and 70% of organizations in the UK reported spending more on SaaS applications today than a year ago.
But amid rising adoption and increasing costs, most organizations reported SaaS security lagged in urgency and priority. Of the UK organizations surveyed, 62% ranked SaaS security fourth or lower on their list of current security priorities, and only 32% cited being worried about the costs associated with rising SaaS-based app usage.
“The biggest concern with SaaS adoption right now is that most organizations are underestimating the number of SaaS applications that exist within their environment,” said Dean Sysman, CEO of Axonius. “SaaS offers numerous benefits, including more flexibility, accessibility, productivity gains, and more – anyone can register for a SaaS app and connect it to work data. But that also presents an enormous risk. IT and security teams already struggle to identify the assets that exist within their organizations. SaaS apps further complicate their ability to gain visibility into data and interconnectivity, manage configurations, and close security gaps, as well as track licensing, usage, and spend.”
79% of UK respondents surveyed did admit the increase in SaaS applications has resulted in more complexity and increased security risk in their organizations. But when asked why security isn’t more of a concern, UK respondents pointed to limited time and resources (38%), staffing shortages (23%), and pressure to focus on other issues from the C-Suite (15%).
“The appetite for SaaS will only continue to grow, further exacerbating data sprawl and security implications,” said Jerich Beason, Commercial Bank CISO and Axonius advisor. “These risks are no longer hypothetical, and without full visibility into the SaaS application landscape, organizations will continue to find themselves vulnerable to data loss from shadow SaaS, non-compliance with federal and industry regulators, and financial strain from lack of insight into organizational spend. Businesses can no longer wait to rein in SaaS complexity.”
In the UK, 77% of respondents said knowing the amount of sensitive data being held in SaaS applications will most likely influence them to prioritize SaaS security in the future. Only 62% of U.S. organizations stated the same. Additionally, 39% of UK organizations said data loss was their biggest concern when it came to SaaS application risks.
We’re already witnessing the consequences of insecure SaaS environments and potential data loss. In March, Okta announced that its platform has been the victim of a targeted security attack. In April, GitHub Security announced an investigation into abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI. To address SaaS security risks, it’s become clear that organisations need to rethink their priorities and adopt a different approach to SaaS security.