Topic starter
07/06/2026 9:15 pm
TL;DR: SaaS apps now average more than 100 per organisation, and 75% of organisations plan to adopt DSPM in 2025 as data sprawl, oversharing, and compliance blind spots overwhelm perimeter-based security, according to Cyera Research. The real shift is that access control alone no longer answers where sensitive data lives, who can reach it, or how exposure changes across SaaS systems.
Editorial analysis by NHI Mgmt Group, based on content published by Cyera: “DSPM for SaaS (2025 Guide)”.
Key questions
Q: What should security teams do first when SaaS data visibility is limited?
A: Start by mapping where sensitive data lives across the SaaS stack and which identities can reach it.
Q: Why does SaaS sprawl create security risk as well as cost pressure?
A: SaaS sprawl increases the number of accounts, roles, permissions, and integrations that must be governed.
Q: What do security teams get wrong about SaaS classification?
A: They often rely on keyword scans or file names, which miss business context and generate false positives.
Practitioner guidance
- Inventory SaaS data locations Map where sensitive data resides across collaboration tools, CRM systems, productivity suites, and development platforms before you try to tune access policy.
- Replace keyword-only classification Use context-aware classification that accounts for application metadata, business use, and data flow so you can separate true exposure from false positives.
- Tie access reviews to data sensitivity Review who can reach high-value records, shared folders, chat histories, and developer assets, then compare that access to the actual sensitivity of the content.
Bottom line: SaaS environments have turned data location and sharing into the central security problem, because access decisions alone do not reveal where sensitive information ends up.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
08/06/2026 9:08 am
SaaS visibility is now a governance problem, not just a tooling gap: The core failure in SaaS-heavy environments is that identity teams can approve access without knowing where the protected data actually sits. When data spans Salesforce, Microsoft 365, Google Workspace, Slack, and developer tools, access decisions based only on app permissions no longer describe the real exposure surface. The implication is that governance must move from account-centric control to data-centric observability.
A few things that frame the scale:
- 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.
A question worth separating out:
Q: How should security teams govern access across SaaS sprawl?
A: Security teams should govern SaaS sprawl with one inventory, one policy model, and one review process that covers both human and non-human access. The practical goal is to connect application approval, entitlement review, and revocation to business ownership. Without that linkage, access governance becomes a manual cleanup exercise instead of a control system.
👉 Read our full editorial: DSPM for SaaS exposes the visibility gap in cloud data security
This post was modified 3 days ago by NHI Mgmt Group