The Average Company Uses 130 SaaS Apps — And Secures Maybe Half

When I audited a mid-size financial services firm last year, they believed they had about 40 SaaS applications in production. The real number was 187. Over half were adopted by individual departments without IT's knowledge. Three of them had admin credentials shared in a Slack channel. That's not an outlier — that's typical. And it's why SaaS security best practices aren't optional anymore. They're the difference between a controlled environment and a breach waiting to happen.

The 2024 Verizon Data Breach Investigations Report found that stolen credentials were involved in over 40% of breaches, and SaaS platforms are where those credentials live. If your organization runs on cloud applications — and it does — this post gives you the specific, actionable practices I recommend to every client.

Why SaaS Environments Are a Threat Actor's Favorite Target

Traditional perimeter security assumed your data lived inside your network. SaaS blew that apart. Your CRM, HR platform, file storage, and email all sit in someone else's infrastructure now. Every one of them is a potential entry point for a threat actor.

Here's what makes SaaS uniquely risky:

  • Credential sprawl. Employees reuse passwords across dozens of apps. One breach on any platform can cascade.
  • Shadow IT. Departments sign up for tools without security review. You can't protect what you don't know exists.
  • Misconfiguration. Default settings in SaaS platforms are designed for ease of use, not security. Most companies never change them.
  • Third-party integrations. Every OAuth connection and API key expands your attack surface.

The 2023 breach of Okta's support system — where a threat actor used stolen credentials to access customer support tickets containing session tokens — showed exactly how SaaS supply chain risk plays out. One compromised platform can expose dozens of downstream organizations.

SaaS Security Best Practices That Actually Reduce Risk

I've distilled years of assessments, incident responses, and security architecture reviews into the practices that move the needle most. These aren't theoretical. They're what I tell CISOs to prioritize on Monday morning.

1. Enforce Multi-Factor Authentication Everywhere

This is non-negotiable. Every SaaS application that supports multi-factor authentication should have it enforced — not just enabled, enforced. That means users can't opt out.

Prioritize phishing-resistant MFA like FIDO2 security keys or platform authenticators. SMS-based MFA is better than nothing, but SIM-swapping attacks have made it the weakest option. CISA's guidance on implementing phishing-resistant MFA is worth reading and sharing with your IT team.

2. Conduct a Full SaaS Inventory — Then Keep It Current

You cannot secure applications you don't know about. Run a discovery process using your identity provider logs, SSO records, expense reports (look for recurring software charges), and browser extension audits.

Once you have your inventory, classify each app by data sensitivity. A project management tool with no customer data is different from a CRM holding PII on 50,000 contacts. Allocate security resources accordingly.

3. Adopt a Zero Trust Approach

Zero trust means no implicit trust based on network location, device, or previous authentication. Every access request gets verified. For SaaS environments, this translates to:

  • Conditional access policies that check device compliance, location, and risk signals before granting access.
  • Least-privilege access — users get the minimum permissions needed, not admin by default.
  • Continuous session monitoring, not just authentication at login.

Zero trust isn't a product you buy. It's an architecture principle you apply across every SaaS platform in your stack.

4. Lock Down Configuration Settings

Default SaaS configurations are almost always too permissive. I've seen Salesforce orgs with public-facing guest user profiles that exposed internal records. I've seen Microsoft 365 tenants with external sharing enabled globally.

Build a configuration baseline for each critical SaaS app. Review settings quarterly. Use SaaS Security Posture Management (SSPM) tools if your budget allows, but even a manual checklist reviewed each quarter beats ignoring it entirely.

5. Audit Third-Party Integrations and OAuth Grants

Every time an employee clicks "Connect with Google" or grants an app access to their Microsoft 365 account, they're creating an OAuth token that may persist indefinitely. These tokens often have broad permissions and rarely get reviewed.

Audit all OAuth grants quarterly. Revoke anything that's no longer in use. Restrict which third-party apps can request OAuth access in the first place through your identity provider's admin console.

6. Train Your People — Especially on Social Engineering

The best technical controls fail when someone hands over their credentials to a convincing phishing email. Security awareness training has to be continuous, realistic, and specific to the SaaS tools your people actually use.

Phishing simulation is essential. Your employees need to experience realistic credential theft attempts targeting their SaaS logins — not just generic "click the link" exercises. Our phishing awareness training for organizations is built around exactly this kind of real-world scenario targeting.

Beyond phishing, train on social engineering tactics like pretexting, business email compromise, and callback phishing (vishing). A comprehensive cybersecurity awareness training program covers these vectors and keeps your workforce sharp against evolving threats.

What Are the Most Important SaaS Security Best Practices?

The most important SaaS security best practices are: enforcing phishing-resistant multi-factor authentication on all applications, maintaining a complete inventory of SaaS tools including shadow IT, applying zero trust principles with least-privilege access, hardening default configurations, auditing third-party OAuth integrations, and running continuous security awareness training with phishing simulations. These six practices address the most common attack vectors — credential theft, misconfiguration, and social engineering — that lead to SaaS-related data breaches.

The Data Breach Cost You Can Actually Prevent

IBM's 2024 Cost of a Data Breach Report pegged the global average at $4.88 million. Organizations with high levels of security training and zero trust deployment saw costs significantly below that average. The math isn't complicated — investing in SaaS security best practices costs a fraction of a breach.

And the regulatory landscape keeps tightening. The FTC has taken action against companies for failing to implement reasonable security measures, including inadequate access controls and poor credential management. "We didn't know about that app" is not a defense that holds up under scrutiny.

Build a SaaS Security Review Cadence

One-time audits don't work. SaaS environments change constantly — new apps, new integrations, new users, departed employees with lingering access. Here's the cadence I recommend:

  • Weekly: Review access logs for anomalies. Check for new OAuth grants.
  • Monthly: Verify that offboarded employees have been deprovisioned from all SaaS platforms — not just email.
  • Quarterly: Full configuration review of critical SaaS apps. Audit third-party integrations. Run phishing simulations.
  • Annually: Complete SaaS inventory refresh. Update your risk classification. Review vendor security certifications (SOC 2, ISO 27001).

Automate what you can. But don't assume automation catches everything. Human review still matters.

Ransomware, SaaS, and the New Kill Chain

Ransomware gangs have adapted to SaaS. They're not just encrypting on-premise servers anymore. Threat actors target SaaS admin accounts, export data, delete backups stored in cloud platforms, and then make their demands. The kill chain starts with credential theft — often through phishing — and ends with data exfiltration from your cloud apps.

This is why credential theft prevention, MFA, and phishing awareness aren't separate initiatives. They're all links in the same chain. Break any one of them and you dramatically reduce your ransomware exposure.

Stop Treating SaaS Security as an Afterthought

Your SaaS stack is your business infrastructure. It holds your customer data, your financial records, your intellectual property, and your employee PII. Treating it with less rigor than your on-premise systems is a decision with real, measurable consequences.

Start with the six practices outlined above. Build the review cadence into your operations. Invest in training that reflects how your people actually work — in SaaS applications, every day, from everywhere.

The threat actors already know your stack is in the cloud. Make sure your security posture reflects that reality.