What is SaaS security, and how does it boost sales?

If the last couple of years have taught us anything, they have taught us that security incidents are becoming ever more frequent.

One recent incident that serves as a lesson is the SolarWinds compromise. This security breach affected more than 250 companies and government organizations like Microsoft, Intel, The Pentagon, The Justice Department, and The Department of Energy. More recently, hackers breached the FBI’s email servers and sent out fake emails to about 100,000 recipients before being flagged as fraudulent.

Nothing seems sacred, and nothing seems impenetrable—including software-as-a-service (SaaS) apps.

But not all is lost because you can take steps to build security around using SaaS apps today. In this article, I’ll show you six areas to address with best practices to implement for boosting your SaaS security.

Note: Because SaaS solutions inherently reside in the cloud, I won’t be talking about security on-premises.

How does SaaS security affect customers, sales, and business?

SaaS security describes the system that protects the software-as-a-service application and the sensitive data it stores and uses. Both the app and its data are almost always hosted on the public cloud, increasing exposure to potential security breaches.

Poor security policies, or no policies, can lead to data breaches, leading to unhappy customers and significant financial losses. According to IBM’s annual Cost of a Data Breach Report, featuring research by the Ponemon Institute, the average cost of a data breach is 4.24 million dollars.

The better the cloud security framework and the company’s security policies, the safer the data. The safer the data, the happier the customer. And the happier the customer, the more money they spend.

SaaS security and privacy: What are the biggest risks?

SaaS apps are generally secure—assuming service providers adhere to compliance and regulatory guidelines (more on this later). Because of the inherent SaaS application security, the data it stores at rest is also protected.

Data in transit

When data is in transit—meaning it’s accessed, modified, or shared by someone— its security grade is only as strong as the weakest link in the transit chain. The people likely accessing, modifying, and sharing the data are your team—or chain links. This situation means that each member of your team is a potential security risk.

Multiplying apps and team members

Multiply data-in-transit transactions by the number of apps your company uses and the number of users in your company. If you’re doing the math in your head, you’ve probably figured out that the number is a lot. It’s a problem because every transaction is an opening to cyber threats

Shadow IT

Shadow IT is when team members provision SaaS products and integrate them into their workflows without company approval. These apps are an excellent example of “what you don’t know can hurt you.” In addition to adding vulnerable transactions to your growing SaaS stack, these transactions are unknown to you and your IT security team.

Poor security practices

The convenience of using SaaS software can sometimes make companies overlook how exposed cloud solutions make them. Ignoring potential SaaS risks could lead to compliance issues or, worse, costly data breaches.

What about SaaS security in cloud computing?

According to a 2025 Gartner forecast, 99% of cloud security failures will be the users’ (your employees’) fault. In other words, cloud services and SaaS applications residing on the cloud are secure. Cloud providers and cloud infrastructure providers have realized this level of security because they adhere to compliance standards and regulations.

SaaS applications and the data they use require additional security measures, standards, and regulations. One example of a security standard for SaaS vendors is System and Organization Control (SOC 2). SOC 2 is an auditing process that ensures SaaS providers comply with specific criteria when working with sensitive customer information, like business-to-business services. In other words, it checks that a data protection system is in place. To attain SOC 2 certification, you must build and follow strict information security policies and trust service criteria.

Assess SaaS security for your business

In large part, SaaS security depends on two primary metrics: the number of apps your company uses and the number of users your apps have. On average, small to midsize companies use about 100 SaaS apps—your company might be using more or less—scattering your company’s data across 100 different servers on the cloud.

Consider every person-to-app relationship for SaaS security

Your team and their relationships with your company’s SaaS apps make up a thing we call The SaaS Graph™.

If you look at the number of SaaS apps per company, the numbers seem manageable at face value. For instance, a mid-market company (101-999 employees) might use 185 apps, while an enterprise company (1,000+ employees) might use 288. Simple, right?

But when you consider app-to-person connections, that number of relationships expands to 4,406 for mid-market and 21,580 for enterprise companies, respectively. So, the bigger a company becomes, the more complex app-to-person connections become, as the graph shows. And as more complex app-to-person connections become, the more vulnerable your company becomes to cyber attacks.

Six SaaS security areas to address and best practices

Many companies undertake security on an as-it-comes basis. Unfortunately, this approach means they aren’t thinking about security until something bad happens. Further adding to the problem, ad hoc or absent security policies can open up to a world of vulnerabilities.

On the other hand, some organizations employ arcane security practices, like forcing users to change their passwords regularly for no real reason. These practices aren’t user-friendly and are often skirted by employees.

Here are our recommended six areas to apply security practices or tools:

1. Apply multi-factor authentication

The single best thing you can do to improve your organization’s cloud security is to turn on and enforce multi-factor authentication (MFA). This practice is especially true for your primary email and collaboration platforms because it reduces the harm an attacker can cause with stolen credentials.

2. Implement secure web browser settings

We use Chrome, so our Chrome administrator applies security settings at the account level. This way, no matter what device a team member signs in from, they’re protected. And because these settings can be applied across several devices and the Chrome browser, they can enforce cybersecurity without a ton of extra effort from our teammates or IT department.

3. Use cloud storage

Shared spaces for teams like G Suite Team Drives are good ways to contain data in secure spaces. For instance, Team Drives lets you add new members, and you can decide whether you want to give them full access to upload, edit, and delete files or whether you want to restrict them to specific activities at the user level. You can also set and change member permissions and remove members as needed.

Related: G Suite Security Checklist

4. Employ SaaS security monitoring

SaaS security monitoring is a crucial layer of security for your SaaS stack. It enables you to manage employee access to your required SaaS apps by department, consolidate licenses, and give you unprecedented visibility into your SaaS stack. Vendr is an excellent example of a platform that can do all three and more; it’s a key SaaS security element when putting your IT stack together. On top of SaaS security monitoring, a SaaS Security Posture Management tool can help companies tighten up their security even more.

5. Manage SaaS access and passwords

Don’t rely on a web browser’s password manager. Instead, we recommend using security tools like TeamsID or LastPass because they offer various password management security solutions for organizations large and small. For example, the best feature of TeamsID is its ability to link to Google’s SSO. This feature means you can enforce strong passwords and multi-factor authentication on G Suite, which will unlock your shared passwords in TeamsID.

6. Deploy a unified identity and access management (IAM) solution

When your company grows to 100-200 employees, you should start thinking about deploying a security service like a unified IAM solution. They work by authenticating a user once and then unlocking all apps for them, rather than users having to sign in to each app individually. A unified IAM streamlines the end user’s (your teammate’s) experience and protects your entire company from cyber threats, like malware, ransomware, and phishing.

Bonus: Ensure SaaS security compliance in your company

Because every employee’s SaaS account is a potential point for a cyberattack and data loss, security is everybody’s business, from C-level executives to your newest recruit.

However, the human resources department has a critical role in protecting data security as your company’s gatekeepers. Their job starts when—or even before—an employee’s first day at your company. And it continues even after the employee leaves.

By collaborating with IT, HR can guarantee the security of your SaaS environment, as well as org-wide compliance with security regulations and rules.

Here are a few HR tips to improve your SaaS security today:

1. Create a SaaS governance policy
2. Enforce a company-wide SaaS workflow adoption
3. Start with employee onboarding
4. Continue through employee offboarding
5. Educate new and existing employees on security developments
6. Build an environment that encourages cooperation in promoting security and compliance

For a deeper dive into SaaS security at the HR level, check out “SaaS Security and Compliance for HR” and “What HR Needs to Know About SaaS Security.”

Automate and streamline your SaaS security

When it comes to SaaS security monitoring, Vendr is an integral part of a SaaS security stack. You get:

• Access to an always up-to-date list of the SaaS vendors and cloud applications in use and subscriptions across your company—including “shadow” and unsanctioned applications
• A way to easily audit what permissions users in your organization give to which applications and get updates on all new additions or misconfigurations.
• Dashboard views to see adoption trends for your whole organization, including details by department and products
• The ability to manage employee access to your required SaaS apps by department and to consolidate licenses