Why do traditional IAM controls fall short for SaaS data security?

Why This Matters for Security Teams

Traditional IAM tells security teams who authenticated and what they were entitled to at a point in time. SaaS data security fails elsewhere: in file sharing, delegated app access, API-connected workflows, and data that moves faster than access reviews. A user can be validly signed in and still expose sensitive records through permissive links, sync tools, or third-party integrations. Current guidance suggests identity governance must be paired with data visibility, not treated as a separate problem.

That gap shows up clearly in the field. NHIMG research on the State of Non-Human Identity Security reports that 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, which is a strong signal that identity controls alone do not reveal how SaaS data is actually being reached. The same pattern is visible in incidents like the Salesloft OAuth token breach, where access was valid but the resulting data exposure was not.

In practice, many security teams encounter SaaS overexposure only after a sharing path, token grant, or cross-app connection has already been abused.

How It Works in Practice

The practical answer is to extend IAM with controls that understand data location, sharing state, and application-to-application movement. Identity still matters, but it is only one signal. Security teams need to know which SaaS objects are sensitive, who can reach them, which connected apps can act on them, and whether that access is durable or time-bound. NIST’s Digital Identity Guidelines remain relevant for authentication assurance, but they do not by themselves solve oversharing or token sprawl.

In mature SaaS environments, this usually means combining:

• identity governance for joiner, mover, and leaver lifecycle control
• data classification so sensitive objects can be tracked across apps
• continuous entitlement review for shared drives, collaboration spaces, and OAuth grants
• logging that ties user activity to data movement, not just login events
• revocation workflows for stale tokens, service accounts, and third-party connectors

NHIMG’s Ultimate Guide to NHIs — Key Research and Survey Results shows that organisations are increasingly recognising this gap, especially where SaaS automation depends on delegated access and secrets. For SaaS security, the control point must follow the data, not stop at the login screen. That approach is reinforced by incident patterns such as the Snowflake breach, where access governance and downstream data handling both mattered.

These controls tend to break down in heavily integrated SaaS estates because app-to-app delegation creates access paths that are invisible to conventional IAM reviews.

Common Variations and Edge Cases

Tighter SaaS access control often increases operational overhead, requiring organisations to balance stronger containment against collaboration speed and administrative burden. That tradeoff is real, especially in environments where business users expect rapid sharing and automation. Current guidance suggests there is no universal standard for how deep SaaS data visibility must go, so maturity depends on risk appetite, data sensitivity, and the number of connected apps.

Edge cases usually appear in three places: guest access, delegated OAuth scopes, and sync or backup tools that replicate content outside the primary SaaS tenant. A file may be properly permissioned in one system but effectively exposed through another. The same is true for service accounts that are not human, but still move data between SaaS platforms. NHIMG reporting on the 2024 Non-Human Identity Security Report indicates that 59.8% of organisations see value in dynamic ephemeral credentials, which matters when short-lived access is safer than standing secrets. That is especially relevant in patterns like the BeyondTrust API key breach, where the problem was not only identity, but the persistence and reach of the credential itself.

For that reason, best practice is evolving toward continuous review of SaaS sharing paths and tokenised integrations, rather than periodic IAM attestation alone.

Related resources from NHI Mgmt Group

• Why do legacy network controls fall short for data security in AI environments?
• Why do traditional IAM controls fall short in multi-ERP environments?
• How should security teams prioritise data security investment across IAM and governance programmes?
• Why do AI security programs need both data controls and identity controls?