An approach to SaaS security that treats users, service accounts, OAuth grants, and AI-connected actors as the real control surface. It combines configuration visibility with continuous entitlement governance so teams can see what each identity can actually do across applications.
Expanded Definition
Identity-centric SaaS security treats the identity layer as the primary security boundary for SaaS applications, meaning administrators evaluate users, service accounts, OAuth grants, API tokens, and AI-connected actors as the real control surface. It goes beyond configuration review by asking what each identity can actually access, delegate, and automate across SaaS tenants.
This approach is closely aligned with modern identity governance and with the CSA Cloud Controls Matrix, but usage in the industry is still evolving. Some vendors use the term to mean SaaS posture management, while others include entitlement analysis, app-to-app trust, and identity threat detection in the same category. NHI Management Group treats the term more narrowly: visibility, control, and continuous review of identities that can act inside SaaS environments without human presence.
The most common misapplication is treating SaaS security as a settings checklist, which occurs when teams ignore delegated access paths and privilege drift inside connected identities.
Examples and Use Cases
Implementing identity-centric SaaS security rigorously often introduces more review overhead, requiring organisations to weigh continuous visibility against the operational cost of entitlement governance.
- Reviewing OAuth grants that let a third-party app read mailboxes, files, or CRM records, then revoking anything not tied to a documented business purpose.
- Cataloging service accounts and API keys used by SaaS automations, then checking whether the privileges match the job actually performed.
- Investigating a breach pattern similar to the Salesloft OAuth token breach, where delegated access rather than a stolen password becomes the entry point.
- Using the lessons from the Ultimate Guide to NHIs to enforce rotation, offboarding, and visibility for long-lived SaaS credentials.
- Evaluating SaaS integrations against the CSA Cloud Controls Matrix to ensure delegated access and third-party trust are formally governed.
These use cases matter because SaaS environments often hide the most dangerous access inside consented applications, bot users, and automation chains rather than in the primary human account.
Why It Matters in NHI Security
Identity-centric SaaS security matters because SaaS compromise frequently happens through the identity path, not through perimeter failure. When organisations lose track of who or what can operate inside SaaS, they also lose track of who can exfiltrate data, create persistence, or impersonate trusted automation. NHIMG research shows that only 5.7% of organisations have full visibility into their service accounts, and that visibility gap is a direct warning sign for SaaS environments where non-human access is multiplying faster than review processes can keep up.
This issue becomes more severe when organisations rely on OAuth consent, cross-app integrations, and shared administrative roles without continuous entitlement review. The broader NHI security picture described in the State of Non-Human Identity Security shows that visibility gaps and over-privileged access are already common causes of incidents, and the 52 NHI Breaches Analysis illustrates how often token exposure and delegated trust become the breach path.
Organisations typically encounter the damage only after a compromised integration starts moving data or issuing actions at scale, at which point identity-centric SaaS security becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Covers visibility and governance for non-human identities and delegated access. |
| OWASP Agentic AI Top 10 | A2 | AI-connected actors in SaaS extend agentic access and tool-use risk. |
| NIST CSF 2.0 | PR.AA | Identity proofing, access management, and authorization align to this concept. |
| NIST Zero Trust (SP 800-207) | 2.2 | Zero Trust requires explicit verification of each identity and session. |
| NIST AI RMF | AI-enabled SaaS actors introduce governance and risk-management requirements. |
Inventory SaaS identities, revoke excess grants, and continuously review non-human access paths.
Related resources from NHI Mgmt Group
- What is the difference between app visibility and identity visibility in SaaS security?
- Why do identity-centric attacks bypass traditional security controls so often?
- What is the difference between SaaS security posture and SaaS identity governance?
- What is the difference between posture management and identity governance in SaaS security?
