Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Using SaaS Security Posture Management
Transcript
- Lucas: If these conversations are useful for what you're building or running, you should know we keep the show intentionally ad-free. Luna: No sponsors, no mid-roll interruptions. Just the real conversation. Lucas: If you want to support that approach, the link is buy me a coffee dot com slash fexingo. That's it. No tiers, no perks—just helps us keep the lights on. Luna: Right. And it lets us stay focused on the topic at hand, which today is a pretty fast-moving area: SaaS Security Posture Management. Lucas: SSPM for short. It's become one of the fastest-growing categories in enterprise security over the past two years. And the reason is straightforward: companies have hundreds of SaaS apps, and they're often configured wrong. Luna: I've seen the stats. The Cloud Security Alliance put out a report late last year — 68% of organizations had a SaaS-related security incident in the prior twelve months. That's huge. Lucas: It is. And the vast majority of those incidents trace back to misconfiguration, not a vulnerability in the SaaS provider's code. Someone leaves a Slack token exposed, or a Salesforce permission set is too broad, or a Google Drive sharing link is set to 'anyone with the link' when it shouldn't be. Luna: So SSPM is essentially a tool that continuously scans your SaaS environments for those misconfigurations? Lucas: Exactly. It connects via API to apps like Salesforce, Slack, Microsoft 365, Google Workspace, ServiceNow, and hundreds more. It reads the configuration state — who has admin roles, which external sharing is enabled, whether multi-factor authentication is enforced — and then flags deviations from your security policy. Luna: And it does that continuously, not just during a quarterly audit. Lucas: Right. That's the key difference. Traditional audits are point-in-time. SSPM gives you a live view. And it's not just detection — many platforms can auto-remediate. If an admin accidentally opens a Slack channel to external collaborators, the tool can close it within minutes. Luna: How does this differ from Cloud Access Security Brokers — CASBs? That's a category we've talked about before. Lucas: Good question. CASBs were originally designed to sit between users and cloud apps, acting as a proxy or using api based discovery. They focus more on data loss prevention and shadow IT discovery. SSPM is narrower — it's purely about the configuration of the SaaS app itself. Think of CASB as looking at how data flows, and SSPM as looking at how the app is set up. Luna: And they're starting to converge. I've seen vendors like Netskope and Microsoft adding SSPM capabilities into their broader security platforms. Lucas: Absolutely. In fact, Gartner predicted that by 2026 — which is now this year — 40% of legacy CASB features will be absorbed into SSPM or cloud security posture management tools. The market is consolidating. But standalone SSPM startups like Adaptive Shield and Wing Security have grown fast because they offer deep integrations. Luna: Deep integrations meaning they support more apps, or richer checks? Lucas: Both. A platform like Adaptive Shield supports over 150 SaaS apps and does thousands of configuration checks per app. For example, in Salesforce, it can check if 'allow external email sharing' is off, or if the password policies meet your internal standards. In Slack, it can verify that guest accounts have expiry dates. These are checks your IT team would have to do manually otherwise. Luna: And the scale is tough. The average enterprise uses over 200 SaaS apps. No one has a dedicated security person for each app. Lucas: Right. And the real risk isn't just one misconfiguration — it's the chain. An attacker might go after a less-monitored app like a collaboration tool, get a foothold, then pivot to a more critical system. There's a well-known incident from a couple years ago where a misconfigured Slack token in a third-party integration exposed the company's entire GitHub repository. That's the kind of blast radius SSPM is designed to reduce. Luna: So what does a typical deployment look like? How does a company get started? Lucas: Usually you start with a discovery phase — the SSPM tool connects via OAuth or API keys to the apps you authorize. It does an initial deep scan, often revealing dozens or hundreds of misconfigurations. Then the security team prioritizes based on risk: critical severity gets fixed immediately, medium goes on a backlog. Then you set up continuous monitoring and alerting. Luna: And the tool itself becomes a single pane of glass for SaaS security posture. Lucas: Exactly. The biggest challenge we're seeing is governance. Who owns the remediation? The security team can detect it, but fixing a Salesforce permission often requires the Salesforce admin's involvement. SSPM tools help by assigning tickets or integrating with workflow tools like Jira or ServiceNow. Luna: So it's as much a process change as a technology one. Lucas: It is. And that's why the most successful deployments have a clear owner — often a SaaS security engineer who works across both security and IT. Some companies are even creating a new role: SaaS Security Architect. Luna: Interesting. And where are we on the adoption curve? Is SSPM mainstream now? Lucas: I'd say it's in the early majority phase among large enterprises. The Cloud Security Alliance survey showed about 35% of organizations have deployed an SSPM tool, with another 40% evaluating. So there's still a lot of room to grow. Mid-market is slower because of budget and complexity, but I expect that to change as vendors offer simpler pricing. Luna: What about the open-source alternatives? Are there any? Lucas: A few, but nothing that covers the breadth of commercial tools. There's a project called SaaS Inspector that does basic scanning for Microsoft 365 and Google Workspace, but it's not enterprise-grade. The challenge is that each SaaS API is different, so building connectors is labor-intensive. That's the moat for commercial SSPM vendors — they've built and maintained hundreds of API integrations. Luna: And the market is seeing consolidation. Palo Alto Networks bought Dig Security, and CrowdStrike acquired SecureCircle. Both are adding sspm like capabilities. Lucas: Yeah. And we're also seeing cloud security posture management vendors like Wiz and Orca extend into SaaS. The lines are blurring. For the buyer, that's good — more options, more integrated solutions. But it also means you need to be careful about what 'SSPM' actually covers in a specific product. Some are really just CASB with a new label. Luna: So what's the one thing you'd tell a security leader who's thinking about SSPM? Lucas: Start with a discovery project. Don't buy a tool and expect it to solve everything overnight. Map your SaaS footprint, identify the highest-risk apps, and then pilot an SSPM on those. Most vendors offer a free trial. The key is to tie it to a clear remediation workflow from day one. Otherwise, you'll just generate a lot of alerts that nobody acts on. Luna: And for companies that already have a CASB, what's the right approach? Lucas: Evaluate whether your CASB already offers SSPM capabilities. Microsoft Defender for Cloud Apps, for example, has some configuration checks for Office 365. But for deeper coverage across hundreds of apps, you may still need a dedicated SSPM. It's not either-or — you can run both, with SSPM handling configuration and CASB handling data protection. Luna: That makes sense. It's almost like having a specialist vs. a generalist. Lucas: Exactly. And as the attack surface grows — with more SaaS apps, more integrations, more shadow IT — that specialist becomes increasingly valuable. The cost of one significant misconfiguration can run into millions. SSPM is cheap insurance.