Download Publication
State of SaaS Security Report 2025
Release Date: 04/21/2025
Software-as-a-Service (SaaS) applications have become foundational to modern business operations. However, organizations are also facing a rising tide of security challenges, including visibility gaps, shadow IT, over-privileged access, and unchecked third-party integrations. Considering these conditions, Valence Security commissioned CSA to develop a survey and report to better understand the current state of SaaS security. CSA conducted the survey in January 2025 and received 420 responses from IT and security professionals.
The main goals of the study were to:
- Understand who is responsible for SaaS security management, along with what tools they use and how security is enforced
- Identify top SaaS security risks and challenges
- Evaluate how organizations prioritize SaaS security, allocate budgets, and adopt security solutions
- Examine the impact of emerging threats, including AI-driven integrations, SaaS-to-SaaS connections, and non-human identities
The survey findings reveal that SaaS security continues to be an afterthought. Despite clear progress, most organizations are still relying on tools and strategies not built for the realities of SaaS. They are working with incomplete coverage and inconsistent enforcement. To keep pace with the speed of SaaS and AI innovation, organizations must act now. They must embrace proactive risk reduction and understand what tools and strategies best support SaaS security as a connected ecosystem.
Key Findings:
- SaaS security is now a high priority for 86% of organizations, with 76% increasing budgets. The focus is on key areas like threat detection and posture management.
- 63% of organizations report external data oversharing and 56% say employees upload sensitive data to unauthorized SaaS apps, often without sufficient visibility or enforcement.
- With 55% of employees adopting SaaS without security’s involvement and 57% reporting fragmented administration, many organizations struggle to maintain consistent oversight.
- Identity and Access Management remains a challenge, with 58% of organizations struggling to enforce privileges and 54% lacking automation for lifecycle management.
- GenAI tools and SaaS-to-SaaS integrations are expanding the attack surface. 46% of organizations struggle to monitor non-human identities and 56% report concerns about overprivileged API access.
- Despite confidence, many organizations rely on vendor-native tools and manual audits. These fragmented strategies leave critical gaps across the SaaS environment.
Download this Resource
Share
Related resources
Related Resources
.png)
.png)
Acknowledgements
Hillary Baron
Senior Technical Director - Research, CSA
Hillary Baron
Senior Technical Director - Research, CSA
Marina Bregkou
Principal Research Analyst, Associate VP
Marina Bregkou
Principal Research Analyst, Associate VP
John Yeoh
Global Vice President of Research, CSA
John Yeoh
Global Vice President of Research, CSA
With over 15 years of experience in research and technology, John excels at executive-level leadership, relationship management, and strategy development. He is a published author, technologist, and researcher with areas of expertise in cybersecurity, cloud computing, information security, and next generation technology (IoT, Big Data, SecaaS, Quantum). John specializes in risk management, third party assessment, GRC, data protection, incid...
Josh Buker
Research Analyst, CSA
Josh Buker
Research Analyst, CSA
Ryan Gifford
Research Analyst, CSA
Ryan Gifford
Research Analyst, CSA
Alex Kaluza
Research Analyst, CSA
Alex Kaluza
Research Analyst, CSA
Are you a research volunteer? Request to have your profile displayed on the website here.
Interested in helping develop research with CSA?
Related Certificates & Training
Learn the core concepts, best practices and recommendation for securing an organization on the cloud regardless of the provider or platform. Covering all 14 domains from the CSA Security Guidance v4, recommendations from ENISA, and the Cloud Controls Matrix, you will come away understanding how to leverage information from CSA's vendor-neutral research to keep data secure on the cloud.
Learn more
Learn more