The CISO's Definitive Guide to

SaaS 
 Security

Table of Contents

01 Executive

Summary

02 The SaaS Visibility Gap:

What You Don't See Can Hurt You

03 Why Now: The Forces Expanding Your SaaS

Attack Surface

04 Common SaaS Breach

and Attack Vectors

05 The Case for Unified

SaaS Security

06 SaaS Security Evaluation Criteria:

What to Demand

07 How Check Point

SaaS Security Helps

08 Next

Steps

Executive Summary

The average organization uses about 220 SaaS applications1,

and SaaS spending was forecast to approach $300 billion in

2025, representing the largest segment of a $723 billion

worldwide public cloud market.2 But the applications you know

about are only part of the story. Check Point research shows

that IT teams are typically aware of just 20% of the SaaS

applications in use. The remaining 80%— shadow SaaS, third-

party plugins, OAuth integrations, and connected APIs—operate

outside your security controls, potentially exposing sensitive

data and creating entry points for attackers. This guide helps

CISOs and security leaders understand the full scope of SaaS

risk, evaluate what a complete SaaS security approach requires,

and take practical steps to close the gaps that fragmented or

incomplete tooling leaves open.

The SaaS Visibility Gap: 
 What You Don't See Can Hurt You

Most organizations secure the SaaS applications they know

about. The real risk lies in what they don't: shadow SaaS,

unvetted plugins, stale API tokens, and SaaS-to-SaaS

integrations that no one monitors.

The CISO's Definitive Guide to SaaS Security  02

The scale of the problem:

81% of organizations have experienced data exposure

through SaaS applications.3

41% of SaaS breaches have been traced to permission drift,

with another 29% linked directly to misconfigurations.4

62% of large organizations experienced at least one third-

party compromise in the past year, and interconnected SaaS

supply chains continue to amplify this exposure.5

These applications are complex to secure, hold sensitive data—

personal records, payment information, source code, customer

data—and present multiple threat vectors. Excessive OAuth

permissions, exposed API keys, and insufficient authentication

controls all create openings. Hybrid work compounds the

challenge: employee activity increasingly takes place outside

the enterprise network, with limited or no monitoring.

Productiv, "State of SaaS 2024," 2024,  https://productiv.com/state-of-saas/

Gartner, “Gartner Forecasts Worldwide Public Cloud End-User Spending to Total

$723 Billion in 2025,” 2024, https://www.gartner.com/en/newsroom/press-

releases/2024-11-19-gartner-forecasts-worldwide-public-cloud-end-user-spending-

to-total-723-billion-dollars-in-2025

FinancesOnline, “Top 6 SaaS Security Risks and How To Avoid Them,” 2025, https://

financesonline.com/top-saas-security-risks-and-how-to-avoid-them/

AppOmni, “2025 State of SaaS Security Report,” 2025, https://appomni.com/reports/

state-of-saas-security/

ENISA, "Supply Chain Cybersecurity Report," 2025; as cited in Check Point, "Cyber

Security Report 2026," 2026, https://www.checkpoint.com/security-report/

The CISO's Definitive Guide to SaaS Security  03

https://productiv.com/state-of-saas/ https://www.gartner.com/en/newsroom/press-releases/2024-11-19-gartner-forecasts-worldwide-public-cloud-end-user-spending-to-total-723-billion-dollars-in-2025 https://www.gartner.com/en/newsroom/press-releases/2024-11-19-gartner-forecasts-worldwide-public-cloud-end-user-spending-to-total-723-billion-dollars-in-2025 https://www.gartner.com/en/newsroom/press-releases/2024-11-19-gartner-forecasts-worldwide-public-cloud-end-user-spending-to-total-723-billion-dollars-in-2025 https://financesonline.com/top-saas-security-risks-and-how-to-avoid-them/ https://financesonline.com/top-saas-security-risks-and-how-to-avoid-them/ https://appomni.com/reports/state-of-saas-security/ https://appomni.com/reports/state-of-saas-security/ https://www.checkpoint.com/security-report/

Why Now: The Forces Expanding Your SaaS Attack Surface

Three converging trends are accelerating SaaS risk:

Multi-cloud and SaaS proliferation. 89% of organizations

use two or more public cloud services. Each one adds SaaS

integrations and data flows that expand the attack surface.

Hybrid work is the norm. 88% of organizations support

hybrid work models, pushing more activity and SaaS

adoption beyond traditional network controls.

AI-powered tools are everywhere. 75% of global knowledge

workers use AI in their jobs, often through SaaS-based tools

that access enterprise data with minimal security oversight.

Each trend multiplies unmanaged SaaS connections, making it

harder to maintain visibility, enforce policy, and prevent data

exposure.

The CISO's Definitive Guide to SaaS Security  04

Common SaaS Breach and Attack Vectors

SaaS breaches follow predictable patterns. Understanding them

is the first step toward prevention.

Supply Chain and Fourth-Party Attacks

When a SaaS vendor you rely on is breached, the attacker gains

access to everything that vendor connects to. The risk extends

beyond direct integrations: a plugin connected to a tool connected to

your enterprise platform creates a chain of exposure that is difficult

to detect and hard to contain.

Even seemingly low-risk tools can become vectors. A SaaS service

that manages meeting scheduling has access to your calendar. A

grammar-improvement tool has access to your email. These

services are not typically thought of as security risks because

they don't hold much sensitive data directly—but once breached, the

attacker obtains access to calendars, emails, and other resources of

the system they were connected to. Similarly, a breached AI

presentation tool can expose every slide deck—and the proprietary

data within them—that employees have created. In fourth-party

attacks, the chain extends further: a plugin or API connected to a

SaaS tool in your ecosystem is itself breached. The attack path runs

from the breached plugin, through the connected SaaS tool, into

your enterprise platform—with each link in the chain invisible to

traditional security controls.

Enterprise User Enterprise

SaaS Platform Minor SaaS Tool Breached Plugin/API

The CISO's Definitive Guide to SaaS Security  05

Abandoned and Legacy Applications

SaaS services that are no longer maintained still hold active

connections to your data. Many of these connections rely

on webhooks—-automated triggers that send data from one

service to another whenever an event occurs. When a connected

service is abandoned, those webhooks keep firing.

Consider a real-world scenario: a company integrates GitHub

with a third-party service. Whenever code changes are

committed, a webhook automatically sends repository data to

the third-party service's URL. The company behind that service

goes out of business, but the webhook remains configured.

Worse, the defunct company lets its domain registration lapse.

Anyone can now purchase that domain, stand up a receiver at

the webhook URL, and begin collecting every code update the

organization pushes—without the organization ever knowing.

This is not a theoretical risk. Abandoned applications with active

integrations, expired domains, and unpatched vulnerabilities

turn forgotten services into open doors. Webhooks, API tokens,

and integrations continue sending information long after

anyone is watching.

Stale API Tokens and Inactive Users

When employees leave, their API tokens often remain active.

Administrators typically revoke login credentials but rarely audit

the API connections those employees established. A webhook

may still be transferring data from an internal application to an

external one—-for example, sending text messages each time a

message is posted on a collaboration channel.

The result: the account is stale, the user can no longer log in,

but the API token is still active, creating an entry point that a

threat actor can find and exploit. Many recent high-profile

breaches were carried out by abusing a stale API token or

forgotten user account. And when a dormant account is

hijacked, it takes far longer to detect than an active one—an

active user would notice something is off far sooner.

The CISO's Definitive Guide to SaaS Security  06

Malicious Applications

Some applications behave maliciously by design. In one

documented case, a midsize company experienced persistent

spear-phishing emails that appeared to originate from two

specific employees. The security team replaced their laptops

and changed their passwords, but the phishing continued.

Only after mapping the company's SaaS-to-SaaS connections did

the security team discover the real source: a malicious

newsletter mailing tool that had been installed on the employees'

accounts. The app functioned as advertised-—it

managed newsletters-—but it also contained a backdoor that was

being used to send phishing emails on behalf of the employees.

Because these emails were sent from one company employee to

another, they were not inspected by the email security gateway,

making them far harder to identify as malicious.

Using SaaS-specific threat intelligence, the app was identified as

malicious elsewhere and was immediately disconnected from the

enterprise's mail exchange server. Without SaaS-to-SaaS

connection visibility, the attack would have continued indefinitely.

The CISO's Definitive Guide to SaaS Security  07

The Case for Unified SaaS Security

Securing SaaS requires multiple capabilities working together. Each

addresses a different layer of risk-and each is incomplete on its own.

Inline controls (delivered through CASBs and Secure Service

Edge) protect the path between users and applications. They

enforce access policies, discover shadow SaaS through log

analysis, and inspect traffic in transit for threats and data loss.

These are essential capabilities. But they operate on traffic

flowing through the network: they don't see what happens

inside SaaS environments after data has been uploaded,

shared, or connected to other services.

SaaS Security Posture Management (SSPM) assesses

application configurations, discovers SaaS-to-SaaS connections,

and identifies misconfigurations and compliance gaps. It gives

security teams the visibility they need to understand their SaaS

attack surface and remediate weak settings. But posture

management alone does not scan data at rest for sensitive

content or malware, and historically most SSPM tools have

detected risky connections without blocking them in real time.

API-based data protection scans files, messages, and records

already stored in SaaS platforms, which is content that inline

controls never see. It detects sensitive data exposure through

DLP, identifies malware at rest, and automates remediation of

policy violations. It also extends protection to activity from

unmanaged devices and SaaS-to-SaaS data transfers that

bypass the network entirely.

Behavior-based threat prevention uses machine learning to

baseline how SaaS services behave—both within your

organization and across organizations—and flags or blocks

anomalous activity in real time: data exfiltration attempts,

account takeovers, privilege escalation, and supply chain

attacks through compromised integrations.

The challenge is that most organizations

have acquired these capabilities piecemeal—a CASB from one

vendor, an SSPM from another, a standalone DLP tool layered

on top. The result is fragmented visibility, inconsistent policy

enforcement, and gaps between tools that attackers exploit.

What a unified platform changes:

When inline controls, posture management, API-based data

protection, and behavioral threat prevention operate within a

single platform, they share context. Discovery findings inform

policy. Posture assessments feed risk scores that drive

automated enforcement. Anomaly detection draws on both

inline traffic patterns and API-level SaaS activity. Remediation

happens from a single console, with a single policy framework,

and a unified view of risk.

The CISO's Definitive Guide to SaaS Security  08

Security Layer

Inline controls (CASB/SSE)

What It Protects

User-to-app traffic: access, data in

transit, shadow IT

Risk Without It

No policy enforcement on SaaS access

or traffic-borne threats

SaaS Security Posture Management  Configurations, permissions, SaaS-to-

SaaS connections, compliance

Misconfigurations, excessive

permissions, and abandoned

integrations go undetected

API-based data protection (DLP +

Threat Prevention)

Data at rest: files, messages, records

inside SaaS apps

Sensitive data exposure and malware

in stored content are invisible

SaaS-to-SaaS activity: anomalous

behavior, account takeover, supply

chain attacks

SaaS-to-SaaS activity: anomalous

behavior, account takeover, supply

chain attacks

Behavior-based threat prevention

The question for CISOs is not which of these layers to invest in but whether they work together or in isolation.

The CISO's Definitive Guide to SaaS Security  09

SaaS Security Evaluation Criteria: What to Look For

When evaluating a SaaS security solution, look for these capabilities:

1. Rapid SaaS Discovery

Native API integration with key SaaS platforms for discovery in

minutes. A comprehensive application catalog (100,000+ apps)

with risk scores, compliance certifications, and publisher

details for every service in your environment.

2. SaaS-to-SaaS Connection Visibility

Discovery of every API, plugin, and third-party integration

connected to your sanctioned platforms including shadow SaaS,

deprecated services, and abandoned applications with active

tokens.

The CISO's Definitive Guide to SaaS Security  10

3. Configuration Risk, Posture Management, and Compliance

Continuous monitoring of SaaS configurations for

misconfigurations, excessive permissions, stale credentials,

and compliance drift, with single-click remediation. Posture

assessments aligned with frameworks such as NIST, mapping

to HIPAA, SOC 2, and GDPR requirements. Alerts when vendors

lose or fail to renew compliance certifications.

4. API-Based Data Loss Prevention

Out-of-band scanning of data at rest across SaaS platforms. AI-

powered classification across 800+ predefined data types (PII,

financial, credentials, source code) plus custom types.

Automated remediation of risky sharing and policy violations.

5. API-Based Threat Prevention

Scanning of data at rest for known and unknown malware, with

automated response. This extends protection to content

uploaded outside inline controls such as unmanaged devices,

SaaS-to-SaaS transfers, or in-app activity.

The CISO's Definitive Guide to SaaS Security  11

6. Behavior-Based Anomaly Detection

Machine learning that baselines SaaS service behavior within

and across organizations, and automatically flags or blocks

anomalous activity: unusual access patterns, privilege

escalation, or suspicious API calls.

Hacker Unsanctioned

SaaS App

User’s Microsoft Account

Email

Files

Calendars

Corporate Directory

7. Attribute-Based SaaS Risk Assessment

Beyond behavioral analysis, evaluate the inherent risk of every

connected application based on its attributes: whether the app

is deprecated or abandoned, whether it holds current

compliance certifications, its source country, the reputation and

track record of its publisher, and user popularity indicators such

as customer count and peer review ratings. These attributes

should feed into a standardized risk score for every service in

your environment, enabling prioritized remediation.

The CISO's Definitive Guide to SaaS Security  12

8. Zero Trust for App-to-App Access

Organizations have invested heavily in Zero Trust for user

access—enforcing least-privilege controls when employees

access company resources. But when it comes to application-

to-application or SaaS-to-SaaS access, Zero Trust is rarely

implemented. The result: SaaS tools, shadow IT, APIs, and

plugins have access to far more sensitive data than

they actually require to function.

Demand a solution that can identify applications with overly broad

permissions, flag services that request access they don't use,

and enforce least-privilege at the app-to-app level—extending

your Zero Trust architecture across your SaaS ecosystem.

9. Fast Deployment and Intuitive Management

SaaS-native, agentless deployment with insights in minutes.

Flexible enforcement—read-only alerting, approval-based

workflows, or fully automated prevention.

The CISO's Definitive Guide to SaaS Security  13

How Check Point SaaS Security Helps

Check Point SaaS Security combines API-based data protection, threat prevention, full SaaS Security Posture Management (SSPM), and

SaaS-to-SaaS visibility in a single platform, fully integrated into the Check Point Portal.

Discover your SaaS ecosystem.

Rapid discovery of all SaaS services, APIs, plugins, and third-party integrations. A catalog of more than 100,000

applications delivers risk assessments, certifications, and operational details for every service.

Prevent sensitive data exposure.

API-based DLP scans data at rest across Google Workspace, Microsoft (OneDrive, SharePoint, Teams), Slack, Jira,

Salesforce, Box, Dropbox, and GitHub. AI/ML-driven classification covers 800+ predefined data types with custom type

support. Automated remediation revokes risky sharing permissions and resolves policy violations.

Detect and stop malware.

Out-of-band threat prevention scans data at rest for known and unknown threats using Check Point malware engines

and ThreatCloud AI, with policy-driven automated response.

The CISO's Definitive Guide to SaaS Security  14

Block risky SaaS connections.

Machine learning engines baseline SaaS-to-SaaS connection behavior both within your organization and across

organizations to detect and stop anomalous activity preventing data theft, account takeover, and supply chain attacks

before they spread. Attribute-based risk scoring evaluates every connected service for deprecated status, expired

certifications, abandoned development, and other inherent risk indicators.

Harden your SaaS posture with built-in SSPM.

SaaS Security includes full SaaS Security Posture Management. Continuously monitor SaaS configurations across 26

supported applications--such as Google Workspace, Microsoft (OneDrive, SharePoint, Teams), Salesforce, Slack, Jira,

GitHub, Okta, OneLogin, Ping Identity, AWS, and more—-for misconfigurations, excessive permissions, stale

credentials, and compliance gaps. Manage identity permissions, disable unused credentials, and eliminate redundant

API clients from a single console. Single-click remediation fixes gaps directly from the Check Point Portal.

Compliance assessments aligned with NIST map to HIPAA, SOC 2, and GDPR, with continuous monitoring of vendor

certification status so you know immediately if a connected service loses or fails to renew a compliance certificate.

Enforce Zero Trust for app-to-app access.

Identify applications with permissions they don't use, revoke excessive access, and enforce least-privilege across

SaaS-to-SaaS connections—extending your Zero Trust architecture to cover the integrations that traditional controls

miss.

The CISO's Definitive Guide to SaaS Security  15

Extend protection beyond managed devices.

API-based controls protect activity within SaaS applications—including content changes made in the cloud with no

agent required.

Deploy in minutes.

100% cloud, no agents, no hardware. Insights and policies available within minutes of installation. Flexible

enforcement options—-read-only alerting, approval-based workflows, or fully automated prevention-—let you match

the solution to your operational model.

Next Steps

SaaS security gaps grow with every new application, integration, and user. Closing them requires visibility into your full SaaS ecosystem,

continuous posture management, and protection that extends beyond inline traffic to the data and connections living inside your SaaS platforms.

Get insights in minutes with a deployment that takes just a few clicks.

Talk to a Check Point SaaS Security expert and see your SaaS risk firsthand.

Book a Demo

www.checkpoint.com  © 2026 Check Point Software Technologies Ltd. All rights reserved.

https://pages.checkpoint.com/harmony-saas-demo.html https://www.checkpoint.com