The rapid adoption of Software-as-a-Service solutions has redefined how organizations operate, granting flexibility and accessibility that were unimaginable a decade ago. SaaS tools have become vital to modern workflows, especially as businesses shifted to remote work during the pandemic. However, as these tools proliferate, so too do the security challenges that accompany them. Today, identity management has emerged as the new security frontier, replacing traditional network perimeters with digital boundaries defined by who accesses what, when, and how.
This shift requires a fundamental rethinking of security strategies, with organizations needing to adopt a decentralized approach to identity management. Guy Guzner, CEO of Savvy Security, highlighted the importance of identity in the SaaS era in a recent podcast: “Identity has effectively become the gateway to SaaS and the gateway to a lot of sensitive data and mission-critical systems.”
To secure this new frontier, organizations must embrace visibility, automation, and identity hygiene—three pillars critical for safeguarding today’s dynamic SaaS environments.
The Expanding Attack Surface
As companies embrace digital transformation, SaaS tools have gone from useful conveniences to essential infrastructure. Businesses rely on tools like Microsoft 365, Salesforce, and thousands of other SaaS applications to streamline operations, manage remote teams, and improve customer interactions. However, with this increased reliance comes an expanded attack surface. Each new application brings potential vulnerabilities that hackers can exploit.
Moreover, the rise of shadow IT—when employees independently adopt SaaS tools without IT’s knowledge—has introduced blind spots into corporate networks. These unmanaged accounts leave sensitive data exposed. Without full visibility into what SaaS apps are in use, IT teams are often unaware of the security risks that accompany them.
Mark Jones, CEO of BlackLake Security, explains, “We are finding that 53% of organizations we are working with daily go around IT for SaaS purchases. Of that amount half are not configured correctly and using their domain and password for personal use. The dark web captures these and this is where some of the largest breaches are coming from today.”
Organizations must gain visibility into these shadow IT environments. It’s not just about managing known applications but uncovering those lurking in the background, often without formal approval. Discovery tools can scan for unsanctioned apps and provide a comprehensive view of the full SaaS landscape, enabling security teams to address vulnerabilities before they become a larger problem.
Why Traditional Security Platforms Fall Short
The explosion of SaaS has led many companies to consider adopting consolidated security platforms. The idea is enticing: a one-stop shop that covers all security needs, from endpoint protection to identity management. However, while consolidated platforms can offer ease of management, they often fall short in the face of the evolving threat landscape and the growing complexity of SaaS environments.
Cybersecurity needs vary widely across industries and use cases, which makes relying solely on a monolithic security solution problematic. The landscape is constantly changing, and even the best platforms today may not cover all the new attack vectors that emerge tomorrow. Guzner explains, “There will always be a need for startups to come along with unique solutions that address gaps in your platform.”
Rather than betting on a single platform, organizations must adopt a layered approach to cybersecurity. Point solutions designed to tackle specific threats should complement broader platforms, providing flexibility to adapt to new challenges as they arise. This allows businesses to stay agile, responding quickly to emerging threats without the constraints of legacy security infrastructure.
Identity Hygiene: The New Frontier of SaaS Security
With SaaS applications outside the traditional network perimeter, identity has become the most critical control point. Identity is the gateway to SaaS, and securing it requires strong identity hygiene practices. Identity hygiene refers to the regular management and auditing of user identities, credentials, and permissions to minimize vulnerabilities.
One of the most common problems organizations face is poor password hygiene. Many users reuse passwords across multiple services or fail to rotate them regularly. “We see from our install base that around 65% of users have some kind of hygiene violation,” Guzner shares, underscoring the scale of the issue. These violations make it easier for attackers to gain access through compromised credentials, especially if those credentials have been leaked in previous data breaches.
But identity hygiene goes beyond password management. Organizations must ensure that SaaS accounts are monitored for suspicious activity, like dormant accounts or excessive permissions. A dormant account, left unmanaged, can be exploited as a backdoor into sensitive systems, as seen in breaches like the Colonial Pipeline attack, where a forgotten VPN account was used to execute a ransomware attack.
By implementing regular audits, enforcing multi-factor authentication, and monitoring account activity, organizations can mitigate these risks. Advanced identity management tools can automate much of this process, identifying weak points and enabling IT teams to act swiftly.
Balancing Security and Usability
One of the perennial challenges in cybersecurity is balancing protection with usability. In the past, security tools that were too cumbersome led users to find workarounds, weakening overall security posture. This is a concern that continues in the SaaS world, where flexibility and accessibility are paramount.
An all-or-nothing approach to security simply doesn’t work. Instead of locking down systems entirely, organizations should adopt flexible guardrails that allow users to work freely while maintaining necessary protections.
This could involve setting conditional access policies where users are required to meet certain criteria—such as using MFA or accessing applications from a trusted device—before gaining access. These guardrails enable productivity while ensuring that the business remains secure.
The Role of Automation in SaaS Identity Management
As the number of SaaS tools continues to rise, managing them manually is no longer feasible. Automation plays a crucial role in addressing the complexity of today’s SaaS environments, enabling IT teams to discover unmanaged apps, monitor access, and take action on risky accounts without drowning in manual tasks.
Automated identity management tools can help identify toxic combinations of permissions—where users have access to more data or systems than they should—and mitigate these risks. This approach allows IT teams to prioritize high-risk areas and take action quickly.
Furthermore, automation can provide continuous monitoring of identity activity, sending alerts when suspicious behavior is detected and even revoking access when certain conditions are met. This reduces the burden on IT staff while improving overall security.
Looking Ahead: What’s on the Horizon for SaaS Identity Management
The future of identity management in a SaaS-driven world will depend heavily on visibility and automation. Organizations will need to embrace these tools to keep up with the pace of SaaS adoption and ensure that security measures scale alongside business growth.
Guzner offers a key insight: “The big challenge is going to be about visibility—how do you know about those things that are happening—and then how do you effectively manage this through automation and remediation?” In the coming years, companies will need to invest in advanced tools that provide comprehensive visibility into their SaaS environments while automating the tedious, manual processes that have historically bogged down IT teams.
Embracing Change with Confidence
SaaS is here to stay, and with it comes a new set of challenges for identity management and security. Organizations that embrace this shift, prioritizing visibility, automation, and flexible identity hygiene solutions, will be well-positioned to thrive in a decentralized world. As the SaaS landscape continues to evolve, businesses must take proactive steps to secure their environments without sacrificing productivity.
The tools and strategies are available—but the key lies in execution. By adopting a layered approach to security, balancing usability with protection, and leveraging automation, organizations can confidently navigate the complexities of SaaS identity management.
