Topic starter
15/08/2026 6:07 pm
TL;DR: SaaS security has moved from CASB visibility and SSPM posture management toward control planes because identity, OAuth, service accounts, and AI-connected access now drive most SaaS risk, according to Grip Security. Its 2026 SaaS + AI Security Report says public SaaS and AI-related attacks rose nearly 490% year over year, a shift that makes continuous identity governance the real control surface.
Editorial analysis by NHI Mgmt Group, based on content published by Grip Security: “From CASB to SSPM to SSCP: The Evolution of SaaS Security”.
By the numbers:
- Public SaaS and AI-related attacks increased nearly 490% year over year, according to Grip Security's 2026 SaaS + AI Security Report.
Key questions
Q: What breaks when SaaS security stays focused on posture instead of identity control?
A: Teams miss the delegated access paths that actually move data and permissions across applications.
Q: Why do OAuth apps and service accounts create more risk than their user-facing setup suggests?
A: They create risk because the visible installation is usually less important than the permissions behind it.
Q: How can teams tell whether SaaS governance is actually working?
A: Look for evidence that discovered applications can be assigned an owner, tied to an access policy, and removed through an enforced workflow.
Practitioner guidance
- Map SaaS identity relationships Inventory OAuth grants, service accounts, AI-enabled integrations, and non-human identities across the SaaS estate, then trace which applications each one can reach.
- Separate posture from authority Use posture findings to flag misconfiguration, but require a second control that validates delegated access scope, token exposure, and cross-app reach.
- Adopt continuous revocation paths Build a process to revoke risky grants and disable stale connected identities as soon as they exceed the approved business purpose or lifecycle.
Bottom line: SaaS security risk is shifting from isolated application posture toward governance of the identities and delegated permissions that connect the environment.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:16 pm
SaaS security is now an identity governance problem, not a visibility problem. CASB answered which apps were in use, and SSPM answered whether those apps were configured safely. Neither model fully governs how access is delegated, reused, or extended across SaaS, which is where modern risk accumulates. The practitioner conclusion is that the primary control surface has moved to identity relationships.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams govern AI features embedded in SaaS applications?
A: Treat embedded AI as a machine identity problem with data access implications. Inventory the feature, map the connected permissions, define what data it may use, and monitor retention and sharing paths. If the AI feature can read corporate content, it needs explicit approval, logging, and periodic review like any other privileged integration.
👉 Read our full editorial: SaaS security is shifting from posture to identity control planes