A mere 21 per cent of IT executives can safely say they will be able to identify all the cloud-based applications running on their infrastructure, showcasing how much vulnerable information is continuously extracted from an organisation's database via both human and machine users.
Manual saas security posture management processes will not secure an enterprise technology stack that fails to have visibility into both API connections and OAuth grants.
The $8.7 Billion Market for SaaS Security Posture Management
The saas security posture management industry is in rapid growth, going from a current valuation of $1.3B to an expected valuation of $8.7B in 2034 due to the extreme lack of manual oversight.
The average data breach is expected to cost companies $4.44M on average. A significant portion of the financial impact resulting from this breach results from having a disjointed set of software tools, thus exposing the organisation's critical data to unauthenticated users.
The marketplace has shifted from pure visibility to one where functionalities that can provide corrective actions have been increasing rapidly.
There is a vendor that has recorded an astounding 490% growth rate due to the company's capability for providing automated corrections. The marketplace has matured beyond just providing another dashboard full of alerts; now, the marketplace is demanding a solution that takes action to correct the problem immediately.
The Rise of Machine Identities
Another shift that has occurred recently in the marketplace, which will define the market, is the increase in the number of machine identities.
Automated coding agents and machines performing machine-to-machine transactions can now operate much further away from the traditional working patterns of humans.
Most legacy systems will track only a basic set of OAuth transactions, but will fail to monitor the terminal sessions, managed service provider (MSP) instances, and database direct queries that occur via machine identities.
To minimize the risk of your most valuable data in the cloud being exposed to automated extraction, you must also implement machine identity management processes with your existing saas security posture management policies.
The Seven-Step Process for SaaS Security Posture Management
Your security team's ability to respond to alerts will decrease, as will their effectiveness, unless you have a clearly defined and implemented process in place for responding to the alerts generated by your scanning tool.
The ability to reduce the amount of time you will spend responding to the overwhelming volume of cloud alerts you will receive from your scanning tool requires the establishment of a well-defined operating model.
This operating model contains a specific sequence of processes – the Seven-Step Execution Standard – with an established order of response to each alert received from your tool.
You must implement this operating model to provide your organisation with the means to respond to alerts generated by your scanning tools and achieve compliance with internal and external regulations.
The Seven-Step Execution Standard is made up of the following specific stages of activity: Detect; Triage; Ticket; Owner; Fix; Verify; and Report.
When an organisation detects that there has been a drift setting on a system (e.g., a manager causing a public database to become publicly available), the platform will triage the drift setting based upon the organisation's established standards using the NIST Cybersecurity Framework.
After triaging the drift setting, the platform will generate an alert to the business owner of the application, without going through the IT help desk.
The business owner must be held responsible and accountable for fixing any issues with the system and must be given strict timelines to respond.
After the business owner fixes the drift setting, the platform should perform an auto-verification check to ensure the database is still locked. The platform will also send a credible status report to the organisation's continuous compliance dashboard.
By employing this series of responsibilities, your organisation removes ambiguities regarding ownership of alerts and relieves central security teams of the need to respond manually to each cloud error.
Top 23 SaaS Security Posture Management Tools
1. DoControl
The DoControl platform is designed to be able to enforce the policies of granular data access governance at a very detailed level on the most frequently used applications (i.e., Google Workspace; Microsoft 365; Box; Slack) on a day-to-day basis. Many of the most dangerous mistakes that employees make while sharing company data come from the decision to not verify that each person involved has cleared it.
Most companies cannot hire a small number of employees to go through every document shared outside the company, which would be very time-consuming and expensive for that company.
Therefore, DoControl provides their customers a no-code automated remediation process for when a document is shared with people outside the company, by automatically sending the same notification to the owner of the document asking them to confirm the shared access setting of that document with the intention of removing the document from outside access.
This method forces the actual owner of the document to review that shared access setting to ensure it is what the owner intended before it is shared.
If the owner does not take any action to confirm that the shared access setting is correct, DoControl will automatically revoke access to the document, significantly reducing the heavy operational burden on the IT department to review every single shared document.
2. Reco
The Reco approach to secure cloud applications is to map who a person is to which cloud application's data, rather than to just scan for application settings.
The primary advantage of the Reco approach is quick onboarding to new applications at the customer's request. This means that the security team can bundle many unique applications that are used by employees without taking long to complete the initial configurations and allow for seamless integration into the existing cloud security platform.
In addition to giving security teams the option to automatically configure all of their applications for security monitoring right away, the Reco platform also presents artificial intelligence agent visibility to all monitored environments in real-time.
The importance of monitoring AI-driven automation, just as much as human-generated content, is growing rapidly as automated scripts and AI jobs become commonplace in many organizations.
3. AppOmni
AppOmni specializes in highly specific and in-depth evaluations of the security of large enterprises and large organizations, such as Salesforce and ServiceNow, with complex systems.
AppOmni can help determine how securely a company is using a service by performing a detailed analysis of all the various services in actual use, creating a detailed recommendation list on how to improve the overall level of security.
Most standard scanning systems only check for the presence of an application on the network. AppOmni provides the most thorough investigations, going beyond what other companies provide by doing an item-by-item breakdown of all possible access to your corporate information stored in the cloud.
It also allows administrators to see exactly where they left data exposed to the internet due to a mistake (for example, if they mistakenly set a global sharing setting).
Additionally, by giving security engineers access to all of the complicated backend information about how large and significantly altered enterprise applications are configured, they can more easily secure their larger infrastructures as well as larger individual applications.
4. Valence Security
Valence Security focuses on the entire security architecture surrounding your organization's SaaS (software as a service) supply chain, including all third-party integrations with SaaS applications (such as OAuth grants), API (application programming interface) connections and service accounts that connect multiple instances of different cloud-based applications together.
Supply chain attacks typically occur after a hacker compromises one of many seemingly innocent cloud-based applications and can spread via one of many third-party API connections.
Valence maps out these "hidden channels" of communication between applications.
Valence has extended its security architecture to include AI (artificial intelligence) saas security posture management tools to monitor machine learning models' permissions and limit any unnecessary access to cloud-based applications, preventing hackers from using a third-party token to penetrate your core storage infrastructure.
5. Grip Security
Grip specializes in finding and managing identity-based governance in very large environments. As such, it is particularly useful for large organizations that have acquired multiple competitors or that have gone through some form of merger or acquisition.
After a company acquires another, the newly appointed IT manager inherits a mountain of unknown cloud tenants and unregulated software installations.
Grip provides users with a service to discover and manage cloud applications through the identities that users have created on the web and how they interact with those applications. It enables organisations to view all parts of their network, identify and eliminate rogue accounts, and determine their true technical debt before merging their active directory.
6. Obsidian Security
Obsidian combines traditional posture assessment with active (and real-time) threat detection. It does not simply identify poor static settings but monitors activity to identify ongoing attacks.
The company specifically governs AI agents and non-human entities operating within 3rd party applications. It implements stringent runtime controls to mitigate privilege escalation attacks, which could happen if a compromised service account granted itself global admin rights in Workday without proper checks.
Therefore, Obsidian can detect this behavior change immediately, blocking such action and taking defence to a much deeper level than simple audit checklists.
7. CrowdStrike Falcon Shield
The former Adaptive Shield module is designed to secure over 150 different cloud-based business-critical applications. This module places heavy emphasis on hard compliance, application hardening, and integration with endpoint protection.
The core technical capability is derived from the integration of extensive amount of telemetry data. Falcon Shield leverages both cloud application posture and real-time data from endpoint devices, user identities, and cloud workload to correlate endpoints with the risk of an employee being able to access those applications.
When an employee's laptop is infected with malware, Falcon Shield will immediately flag the endpoint risk associated with an employee's cloud access.
This enables Falcon Shield to immediately revoke an employee's rights to download sensitive files from SharePoint until the specific laptop has been wiped clean and properly verified.
8. Spin.ai
Spin has built its entire posture management architecture around the concept of having a backup-and-recovery centre of gravity. For Spin, complete data protection is its primary goal. Unlike many other service providers, Spin has a unique focus that complements its online posture checking with automated "recoverability" features (i.e., "how to recover from a bad configuration").
If you happen to be a victim of a ransomware attack that successfully encrypts your cloud-based storage, Spin will ensure that you have a clean, fully-contained backup, ready to go, to recover from that event.
It utilizes a mix of proactive saas security posture management, plus robust reactive recovery capabilities.
9. Nudge Security
Instead of relying on onsite device agents or proxies to monitor for and discover shadow applications and shadow AI, Nudge Security uses email metadata analysis to quickly identify these applications and tools as well as when employees sign up for them.
By analyzing organizational email flow data (or metadata) using its agentless deployment model, Nudge Security can very rapidly discover employee usage of new shadow apps and tools.
The license required to perform such analyses is minimal compared to that required to install tracking software on every company device.
As well, by directly sampling email flow data (metadata), Nudge Security completely removes the need to install any additional software on employees' devices.
10. Netskope / Zscaler SSPM
This is a category that has undergone significant consolidation of posture management into secure-service-edge environments.
Current customers of large enterprise network security suite vendors, such as Netskope or Zscaler, are able to take advantage of a natural opportunity to have posture management capabilities integrated into existing solutions.
If your organization is already using one or more of the above tools (CASB, secure web gateway, or zero-trust network access), you can expect to save significantly on integration costs; and, you will also benefit by being able to manage your organization's individual application settings from the same dashboard that you use to block malicious websites and monitor general network traffic.
This direct consolidation means that your security analysts will experience a greatly reduced level of tool fatigue on a daily basis.
11. Wing Security
The security company named 'Wing' is well-known worldwide, and they provide complete cloud coverage to their customers, covering any and all applications that are available in the cloud.
Instead of focusing only on a few highly customized applications, Wing provides its customers with a foundation of security that can be applied across hundreds of different applications.
By using Wing, companies may quickly assess their company's overall risk score, identify their most vulnerable open permissions, and determine their total software footprint without needing months of customization or rule writing.
12. Fortinet
Fortinet incorporates PaaS capabilities directly into their extensive network security portfolio; as such, they have created a seamless integration of their established physical firewall and defense products into the cloud.
For teams already utilizing Fortinet's hardware and software framework, adding PaaS capabilities will enable them to quickly implement the organization's strong network rules into their cloud infrastructure.
It also simplifies daily reporting and allows customers to consolidate all their defense strategies into one vendor contract, making it easier for IT directors to submit budget requests, open support tickets, and manage vendors.
13. Palo Alto Networks
Palo Alto Networks offers an integrated suite of security services under one roof; in addition, Palo Alto also provides enterprises with an enterprise-class solution for monitoring configuration settings.
Palo Alto, like Fortinet, focuses heavily on large security teams that want a "single pane of glass" for all security operations.
Posture management integrates feed directly into global threat intelligence networks, allowing for real-time network visibility. An open storage bucket or a credential policy that is weak would be flagged not just as an easily fixable setting error but as a recognizable attack type from malicious global actors.
14. Microsoft
Microsoft has an extensive number of security and compliance tools under their 365 Office umbrella, and they have an additional tool set focused on posture management.
If an organization is primarily utilizing the Microsoft stack (i.e., Azure, Windows, and Office), then the Microsoft tools will typically provide them with more visibility than any other vendor and have the best integration to Microsoft's Graph OAuth 2.0 authentication protocols.
This allows for the ability to manage SharePoint files, channels on Teams, and Exchange routing settings natively, without using a third-party API connector to convert the unstructured data into a format.
15. ManageEngine
ManageEngine has created several individual products aimed specifically at meeting the needs of IT operations staff managing enterprise applications, as it is focused heavily on application monitoring, compliance, and producing audit reports.
This is particularly appealing to IT operations teams within mid-sized organizations, as the ManageEngine platform provides businesses with the ability to pass audits and obtain certification without the need to build out multi-million dollar custom security operations centers.
The reporting generated from the platform allows compliance officers to quickly demonstrate to their auditors that they have completed all required user access reviews and locked all potentially dangerous application settings.
16. Proofpoint
Proofpoint has also acquired posture management capabilities through their cloud and email security solutions and has developed a perspective of cloud-related threats entirely through the lens of human communication and targeted attacks.
Most breaches to the cloud begin with highly targeted phishing emails. Proofpoint monitors how these email threats directly affect the permissions associated with the cloud. If a company executive is targeted by a large number of attackers utilizing email as their method of attack, Proofpoint automatically tightens down his or her access rights to cloud storage applications, thereby greatly reducing the potential blast radius should the executive's primary account be compromised.
17. Check Point Software Technologies
Check Point Software Technologies combines software posture within its cloud infrastructure management capabilities within the larger context of its security portfolio.
By utilizing both approaches, Check Point provides engineering teams with the capability to manage both the server settings at the backend of a cloud server (CSPM) and the permissions for front-end applications (SSPM) all from a single location.
This allows Check Point to actively block an attacker from finding a small vulnerability within a public web application and using it to gain access to the core of the cloud server where the actual customer database is located.
18. Cisco Systems
Cisco Systems employs adjacent posture management tools within its extensive, global stack of cloud and network security.
Cisco's tactical goal is to provide full visibility into all parts of the cloud environment from the endpoint to the cloud. Cisco connects the cloud application settings back to hard network routing rules and endpoint access logs.
If a cloud application begins exhibiting unusual behaviour or exporting large amounts of data, Cisco can isolate that application on the network and cut off its communications before any data breaches the corporate perimeter.
19. Orca Security
Orca Security has developed a comprehensive agentless cloud security platform, positioning security posture management as an integral part of that platform, along with the extensive use of educational material to instruct security teams on how to utilise Orca Security's tools. Orca examines platforms without needing to install agents on the actual physical servers.
By using an alternative approach, Orca can identify vulnerabilities (misconfigurations), weak passwords, and exposed data across both cloud infrastructure and services layers (infrastructure and application).
This guide provides an overview of how Orca is helping to improve productivity within cloud environments, providing the benefit of a detailed, comprehensive audit without impacting the performance of currently running cloud apps.
20. SentinelOne
SentinelOne has provided a broad technical comparison of the differences between traditional cloud perimeter protection (cloud access security brokers) and posture protective measures.
Then, they’ve successfully integrated the protective measures within their endpoint defense solution and have put into practice that protecting the endpoint in the physical world and protecting the same cloud application is the same set of technical problems.
By strictly controlling what a physical device is allowed to do and controlling what a cloud application allows, SentinelOne has created a unified secure perimeter for protecting cloud data.
If an employee inadvertently clicks on a malicious link while working from home, SentinelOne’s unified secure perimeter blocks any potential data theft.
21. Wiz
Wiz has built a large unified risk graph representing current cloud infrastructure and current cloud applications (including AI) using a single layer of visual presentation.
Their presence as a trusted service provider has rapidly spread, exposing approximately 54% of all cloud environments currently exposing virtual machines with a direct connection to sensitive data, thanks to their extensive research.
Wiz has also created an integration to commonly used frameworks that allows security operations centers (SOCs) leads to instantly represent their current level of compliance with SOC 2 policies and procedures.
An example would include Siemens’ increase in cloud visibility from 20% to 100% after integrating Wiz into their compliance processes, which is equivalent to a 400% increase in total cloud coverage.
22. Swfte Nexus
Swfte Nexus has focused its business on finding and identifying the technical aspect of the future, as it relates to AI agent governance and deep system observability.
Unlike traditional tools that only account for basic OAuth grants, Swfte actively tracks the real-time activity of machine accounts, active terminal sessions, and managed cloud platforms, which are many times not using software application programming interfaces.
When platform teams use automatic coding agents for building software, Swfte retains a complete historical record of the activities of all non-human accountability agents.
Swfte is, therefore, the missing layer of protection in a standard saas security posture management structure because Swfte is concerned with monitoring, mitigating, and closing automated pathways, which are frequently exploited by malicious actors.
23. Onam Security
Onam has built its platform on concrete, measurable benchmark mapping. There are no generalized rules across Onam’s platform, and there are no “soft” compliance checks.
Onam tracks moving forward, exactly 433 CIS Benchmark rules for 6 major software products, and uses a unique technology to connect to the software products, such as Google Admin SDK service account authorization and private key JWT tokens from Snowflake.
This level of extreme, technical detail is evidence of the major implementation feasibility of Onam, enabling rigorous compliance managers to assign exact responsibility for exact failures of compliance with total certainty.
How to Test Your Security Tools
We must focus on testing security tools in live environments and require vendors to map to a live (production) application containing real-world, live user data.
If a security tool does not automatically identify an open permission drift, forfeit, and correct such drift by generating a remediation ticket to the responsible business owner within one hour of discovery, it is not a security tool, it is just a dashboard!
