Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why CISOs Are Using SaaS-to-SaaS Backup Strategies
Transcript
- Lucas: Last month, a mid-sized financial services firm lost about 18,000 customer records from their Salesforce instance. Not a ransomware attack—an admin script went rogue during a data migration and the native recycle bin only retained the last 30 days. By the time they noticed, the window had closed. Luna: That's brutal. But isn't that what backups are for? I mean, they're in the cloud—doesn't Salesforce handle that? Lucas: That is the single biggest misconception in enterprise security right now. Under the shared responsibility model, Salesforce guarantees uptime and infrastructure security—not your data's recoverability from user error, sync corruption, or malicious deletion. Most SaaS platforms have a retention window, typically 30 to 90 days, and after that, the data is gone. Luna: So basically, if you assume your SaaS vendor has your back, you're making a bet that nothing will ever go wrong inside your own tenant? Lucas: Exactly. And that bet is getting riskier as companies pile more critical workflows onto SaaS. I'm talking about CRM, HRIS, ticketing systems, ERP modules running in the cloud. A few years ago, most backup strategies were on-prem—tape, disk, maybe a virtual machine snapshot. That mindset just doesn't translate when your data lives in someone else's API. Luna: So what's the alternative? A dedicated saas to saas backup tool that connects directly to the application's API? Lucas: Yes. And this is where we're seeing a real shift. Companies like Druva, Veeam, and Cohesity all have SaaS backup modules now. But there's also a newer crop—OwnBackup, which focuses on Salesforce and ServiceNow, and Leapwork for process automation backups. They all do roughly the same thing: they take frequent, incremental snapshots of your SaaS data and store them in an immutable object store—usually Amazon S3 or Azure Blob—so even if someone deletes records inside the app, you have a copy outside it. Luna: And 'immutable' meaning even an admin can't delete those snapshots once they're written? Lucas: Exactly. Immutable storage is write once read many, or WORM. So if an attacker compromises your Salesforce admin account and purges records, the backup snapshots from earlier that day are still intact. You can recover to the last known good state. Luna: That's reassuring. But doesn't this get expensive? You're essentially paying two vendors—the SaaS app and a backup tool—to store the same data. Lucas: It does add cost, but the calculus shifts when you run the numbers on data loss. Gartner estimated that the average cost of one hour of CRM downtime for a mid-market company is about $100,000. And that's just lost productivity—it doesn't include reputational damage or compliance penalties. If you're in a regulated industry like finance or healthcare, losing records can trigger regulatory fines under GDPR or HIPAA. Luna: So it's an insurance policy, basically. Pay a predictable premium to avoid a catastrophic loss. Lucas: That's exactly how most CISOs frame it. And the technology has matured enough that the backup tools are fairly seamless. You set up the connection once via API, define your retention policy—maybe daily snapshots for 90 days, weekly for a year—and then it runs automatically. Recovery is usually point and click. You can restore a single deleted contact or an entire org. Luna: I've also heard that some organizations use these backups not just for disaster recovery but for compliance e-discovery. If a legal hold comes in, they can search the backup archives instead of going back to the SaaS vendor. Lucas: Right. That's another use case that's growing. And it ties into something else: when you do a restore, you're testing your recovery process. A lot of companies never actually verify that their backup works until they need it. With these tools, you can do a sandbox restore every quarter and confirm the data is there and usable. Luna: Which is basically the whole point of a backup, but you'd be surprised how many skip that step. Lucas: Exactly. So the trend is clear: saas to saas backup is becoming a standard layer in enterprise security architecture. It's not just for the biggest firms anymore. Mid-market companies with 500 to 2000 employees are adopting it too, especially if they run on Microsoft 365 and Salesforce. Luna: And speaking of which—if this conversation is useful for what you're building or running, we keep this show ad-free, and we only exist because listeners like you chip in. Honestly, if today was worth a coffee to you, that's the link—buy me a coffee dot com slash fexingo. Lucas: It's a small way to keep these episodes going, and we appreciate every single contribution. Back to the backup conversation—one thing I want to highlight is that the shared responsibility model has a real blind spot when it comes to data inside SaaS apps. Microsoft 365 has its own retention policies, but they're designed for compliance and legal hold, not operational recovery. If a user accidentally deletes a mailbox folder, you might have 14 days to recover it via the native tool. After that, it's gone. Luna: Fourteen days is tight. Especially if you're a large organization and the deletion isn't noticed until a month later. Lucas: Exactly. And that's why dedicated backup tools are essential. They give you a much longer window and a more granular recovery. You can restore a single email from six months ago, or a whole SharePoint site. Luna: So let's talk about the vendors. Who are the main players in this space? Lucas: There are three categories. First, the established backup vendors like Veeam and Cohesity, which started with on-prem and virtual machine backup and have added SaaS connectors. Second, pure-play SaaS backup vendors like OwnBackup and Backupify. And third, the cloud infrastructure vendors themselves—AWS Backup and Azure Backup both support some SaaS applications, but the coverage is spotty. Luna: And how do you choose? Is it better to go with a specialist or a generalist? Lucas: It depends on your stack. If you're heavily invested in Salesforce and ServiceNow, OwnBackup is probably the most mature option. If you're a Microsoft shop, Veeam's Microsoft 365 backup is very strong. But many enterprises end up with multiple tools because no single vendor covers every SaaS app equally well. Luna: So you might end up with a backup tool for Salesforce, one for Microsoft 365, and maybe another for your HR system like Workday? Lucas: Exactly. And that's fine. The key is to have a documented recovery plan and test it. A lot of companies buy the tool, set it up, and then never check if the restore actually works. That's a false sense of security. Luna: Which is almost worse than having no backup at all. Lucas: I'd argue it's worse, because you think you're covered. So we're seeing CISOs incorporate SaaS backup testing into their regular incident response drills. They'll simulate a data loss scenario and measure how long it takes to restore critical records. Luna: And if the restore takes too long, they adjust the tooling or the retention policy. Lucas: Right. And one more thing—the regulatory environment is pushing this forward too. The SEC's new cyber incident disclosure rules don't directly mandate backups, but if you suffer a data loss event that affects material operations, you have to disclose it. Having a robust backup and recovery capability reduces the likelihood of a material event in the first place. Luna: So it's not just about IT hygiene; it's about risk management and compliance. Lucas: Exactly. And with more companies adopting a multi-SaaS strategy, the attack surface for data loss is expanding. Every app that stores business-critical data needs a backup plan. We're past the point where you can assume the vendor handles it. Luna: It sounds like saas to saas backup is where server backup was twenty years ago—a best practice that's quickly becoming an expectation. Lucas: That's a good way to put it. And the tools are getting easier to use and more affordable. The cost per user per month for a Microsoft 365 backup is often under two dollars. For most organizations, that's a no-brainer compared to the cost of losing data. Luna: Right. So if you're a security leader listening, what's the one takeaway? What should you do Monday morning? Lucas: Audit your SaaS stack. Identify which apps contain irreplaceable data—customer records, financial transactions, legal documents. Then check whether those apps have a backup solution that stores data outside the vendor's ecosystem. If they don't, start a pilot with a dedicated SaaS backup tool. And test a restore before you need one. Luna: That's a solid action plan. Lucas: And if you already have a tool in place, test it this quarter. You might be surprised at what you find.