Topic starter
02/02/2026 9:56 pm
TL;DR: SaaS adoption expands the attack surface through misconfigurations, overly permissive sharing, unmanaged integrations, and shadow IAM, according to Valence Security. The control problem is not just visibility; it is governance across connected apps, identities, and data paths that traditional IAM alone does not cover.
Editorial analysis by NHI Mgmt Group, based on content published by Valence Security: “SaaS Security Best Practices and Strategies for 2025”.
Key questions
Q: What breaks when SaaS apps are used outside SSO and central IAM?
A: The main failure is lifecycle control.
Q: Why do tenant-wide SaaS integrations create a higher security risk than limited app connections?
A: Tenant-wide integrations expand blast radius because a third party can reach email, calendars, files, and account controls across the environment.
Q: Why do SaaS sharing controls fail so often?
A: They fail because many organisations rely on policy, not enforcement.
Practitioner guidance
- Audit shadow IAM paths Find local SaaS accounts, alternate login methods and unsanctioned app connections, then map each one back to an owner and a business purpose.
- Review external shares and guest access Check inactive links, permissive folder sharing and external collaborators across the highest-value SaaS applications, then revoke access that no longer matches current need.
- Treat integrations as governed identities Maintain an inventory of OAuth tokens, API keys, webhooks and automation links, with explicit approval, scope review and revocation ownership.
Bottom line: SaaS risk in 2025 is driven by governance gaps across sharing, integrations and local accounts, not by a single control failure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:03 pm
SaaS security is no longer an application problem, it is a governance problem across identities, integrations and data paths. The article’s real lesson is that control ownership is fragmented across the SaaS stack, while risk behaves like a connected graph. That means the operating model for IAM, IGA and security must shift from app-by-app review to cross-app governance.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Why do SaaS sprawl and shadow IT create IAM risk?
A: They create IAM risk because each unmanaged application introduces another identity system, another set of privileges, and another place where access can persist after need changes. Without central visibility, teams cannot reliably enforce least privilege, review entitlements, or revoke access consistently across the SaaS estate.
👉 Read our full editorial: SaaS security best practices for 2025: the governance gap