The prevalence of SaaS applications has skyrocketed in the past decade. The average organization currently uses 130 different SaaS apps, up from only eight apps in 2015. Unfortunately, the popularity of SaaS applications isn’t restricted to the organizations who appreciate how they facilitate employee productivity. They are also an increasingly tempting target for cyber attackers. Bad actors are drawn by the growing bulk of sensitive data held in SaaS systems, SaaS’ decentralized structure, and its interconnectedness with external SaaS applications. In a 2023 survey of over 3000 IT professionals on cloud security, SaaS applications were voted the top target for attackers.

This makes SaaS security a topic that is on the minds of most organizations. It’s certainly on the minds of regulators, such as the United States Cybersecurity and Infrastructure Security Agency (CISA). In the past two years, CISA has issued and updated its Cloud Security Technical Reference Architecture to guide government agencies’ adoption of cloud technology and piloted the Secure Cloud Business Applications (SCuBA) project to help secure agencies’ cloud business application environments (like Microsoft 365 and Google Workspace) and protect information created, accessed, shared and stored in those environments.