Topic starter
16/01/2026 3:23 pm
TL;DR: SaaS security remains fragmented across vendors, with inconsistent controls, limited telemetry, and broad OAuth integrations creating blind spots that can amplify data exposure and incident response delays, according to Obsidian Security. The governance problem is no longer just configuration drift, but unmanaged trust across connected apps, agents, and downstream identity paths.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “An Open Letter to the SaaS Industry: Make Security the Default”.
By the numbers:
- Obsidian Security says 90% of AI agents are over-permissioned in SaaS.
Key questions
Q: How do security teams govern SaaS applications with inconsistent security defaults?
A: Start by defining a minimum control baseline for logging, configuration visibility, access scope, and revocation across every critical application.
Q: Why do OAuth tokens and SaaS integrations create outsized breach risk in connected environments?
A: OAuth tokens can grant persistent, authorized access that looks normal to security controls.
Q: What breaks when SaaS vendors do not expose enough telemetry?
A: Investigation slows because teams cannot quickly reconstruct what changed, which account acted, or which data moved.
Practitioner guidance
- Establish a SaaS security baseline Define the minimum logging, configuration visibility, access control, and API exposure requirements every critical SaaS app must meet before approval.
- Inventory OAuth-connected applications Map every delegated SaaS integration to its scopes, business owner, and data reach so you can see which grants behave like standing access.
- Classify AI agents as governed identities Treat autonomous SaaS agents as access-bearing actors and review whether each one can read, write, export, or chain actions across multiple environments.
Bottom line: SaaS security defaults are no longer just a configuration issue because inconsistent controls and limited telemetry create governance gaps across connected applications.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:55 pm
SaaS security defaults are now an identity governance problem: When vendors expose inconsistent controls, the real gap is no longer just hardening. It is the inability to govern access, telemetry, and accountability across a distributed identity surface. Security teams can no longer assume that one control model fits every application, because the control plane itself is fragmented. The practical conclusion is that SaaS must be governed as part of IAM, not treated as a separate admin concern.
A few things that frame the scale:
- 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.
A question worth separating out:
Q: Should organisations treat AI agents and service accounts differently in SaaS governance?
A: They should govern them with the same relationship-aware discipline but not the same assumptions. Service accounts usually have more stable ownership and scope, while AI agents can chain access across workflows and integrations in ways that change during execution. That means both need inventory, lifecycle control, and blast-radius analysis, but agent behaviour deserves closer runtime scrutiny.
👉 Read our full editorial: SaaS security defaults are becoming an identity governance problem