SaaS incidents now start with an identity, a token or a trusted integration far more often than with a software flaw, yet most SaaS security statistics come from vendor surveys that measure confidence rather than compromise. This page collects SaaS security figures from the publishers' own pages: the Google Cloud Threat Horizons Report and Mandiant investigations, the Verizon Data Breach Investigations Report (DBIR), the Cloud Security Alliance (CSA), AppOmni and Okta's Businesses at Work report. Each figure carries the publisher, report and period in the same sentence or table row, and single-vendor surveys are marked as such. It is written for SaaS security, identity and third-party risk teams, and for leaders who need sourced numbers for an SSPM, integration governance or OAuth risk business case. Last reviewed: November 2026.
Key takeaways
- Identity is the way in. The Google Cloud Threat Horizons Report H1 2026 says threat actors exploited identity issues for initial access in 83% of Mandiant incidents involving major cloud and SaaS-hosted environments in the second half of 2025.
- Integrations are the new supply chain. The same report attributes 21% of H2 2025 cases to compromised trusted relationships with third parties, and the Verizon 2025 DBIR found third-party involvement in breaches doubled to 30%.
- Confidence outruns reality. AppOmni's State of SaaS Security 2025 found 91% of organisations confident in their SaaS posture while 75% had a SaaS-related incident in the past year, and 89% of compromised organisations believed they had appropriate visibility.
- Permissions cause more incidents than settings. AppOmni attributes 41% of SaaS incidents to permission issues and 29% to misconfiguration, and CSA's 2025 survey found 58% struggle to enforce proper privilege levels.
- Non-human access is the blind spot. CSA's State of SaaS Security Report 2025 found 46% struggle to monitor non-human identities and 56% are concerned about over-privileged API access, the pattern behind the Snowflake, Salesloft Drift and Gainsight campaigns.
Headline statistics
The table gives the SaaS security figures most often requested, each from the latest edition we could read on the publisher's own site in November 2026.
| Statistic | Figure | Source, publisher and period |
|---|---|---|
| Cloud and SaaS incidents where identity issues gave initial access | 83% | Cloud Threat Horizons Report H1 2026, Google Cloud (Mandiant, H2 2025) |
| Cases involving compromised trusted relationships with third parties | 21% | Cloud Threat Horizons Report H1 2026, Google Cloud (H2 2025) |
| Cases using stolen human and non-human identities | 21% | Cloud Threat Horizons Report H1 2026, Google Cloud (H2 2025) |
| Breaches with third-party involvement | 30%, double the prior year | 2025 Data Breach Investigations Report, Verizon (12,195 breaches) |
| Organisations with a SaaS-related security incident in the past year | 75%, up 33% on 2024 | State of SaaS Security 2025, AppOmni (800+ leaders) |
| Organisations confident in their SaaS security posture | 91% | State of SaaS Security 2025, AppOmni |
| Organisations using a dedicated SSPM tool | 13% | State of SaaS Security 2025, AppOmni |
| Organisations struggling to monitor non-human identities in SaaS | 46% | State of SaaS Security Report 2025, Cloud Security Alliance (420 respondents) |
| Employees adopting SaaS without security involvement | Reported by 55% | State of SaaS Security Report 2025, Cloud Security Alliance |
| Average number of apps per company | 101 | Businesses at Work 2025, Okta (Okta Integration Network customers) |
Statistics by theme
How SaaS environments are breached
The Google Cloud Threat Horizons Report H1 2026 gives the clearest primary breakdown of initial access for cloud and SaaS incidents. All figures below are Mandiant incident response and threat defence cases from July to December 2025, platform agnostic.
| Initial access vector | Share of cases (H2 2025) | MITRE ATT&CK |
|---|---|---|
| Compromised trusted relationships with third parties | 21% | T1199 Trusted Relationship |
| Stolen human and non-human identities | 21% | T1078.004 Cloud Accounts |
| Voice-based social engineering (vishing) | 17% | T1078 Valid Accounts (outcome) |
| Email phishing | 12% | T1078 Valid Accounts (outcome) |
| Malicious insiders | 7% | Not technique-specific |
| Misconfigured application and infrastructure assets | 7% | Not technique-specific |
| Software supply chain compromise | 3% | T1199 Trusted Relationship |
| Vulnerability exploitation | 2% | T1190 Exploit Public-Facing Application |
- Google Cloud subset: in Google Cloud's own H2 2025 data, third-party software became the leading entry point at 44.5%, up from 2.9% in H1 2025, while weak or absent credentials fell from 47.1% to 27.2%. Google says this subset may not represent all customers.
- Misconfiguration trend: misconfiguration fell from 29.4% of Google Cloud incidents in H1 2025 to 21% in H2, and exposed sensitive interfaces or APIs from 11.8% to 4.9%.
- Breach-wide view: the Verizon 2025 DBIR, covering more than 22,000 incidents and 12,195 confirmed breaches, found credential abuse the leading initial vector at 22% and third-party involvement doubled to 30%.
OAuth tokens and integration campaigns
The largest SaaS data theft campaigns of 2024 and 2025 used valid credentials or tokens, not exploits. The figures come from the investigating teams' own write-ups.
| Campaign | Key figures | Source |
|---|---|---|
| UNC5537 against Snowflake customers (2024) | About 165 potentially exposed organisations notified; at least 79.7% of accounts used had prior credential exposure; earliest infostealer infection November 2020; some credentials unrotated for up to four years; affected accounts had no MFA | Mandiant, Google Cloud blog, 10 June 2024 |
| UNC6395 via Salesloft Drift (2025) | Compromised Drift OAuth tokens used against Salesforce instances from 8 to at least 18 August 2025; the actor searched exported data for AWS access keys, passwords and Snowflake tokens; all Drift tokens revoked on 20 August | Google Threat Intelligence Group, 26 August 2025 (updated 28 August) |
The Snowflake breach shows the cost of single-factor service and user logins, the Salesloft Drift breach how one integration's tokens can reach hundreds of tenants, and the Gainsight Salesforce breach how long-lived OAuth tokens repeated the pattern three months later. See the OAuth and SaaS integration breaches guide.
Posture, permissions and misconfiguration
- Incident causes: AppOmni's State of SaaS Security 2025 attributes 41% of SaaS incidents to permission issues and 29% to misconfiguration.
- Privilege: 58% of respondents to CSA's State of SaaS Security Report 2025 said enforcing proper privilege levels was difficult, and 56% named poor access control as a top concern alongside data oversharing at 63%.
- Lifecycle: 54% of CSA respondents lacked automation for SaaS access lifecycle management, and 57% described fragmented SaaS security administration.
- Tools in use: CSA found 69% rely on vendor-native tools, 46% on manual audits and 43% on general-purpose CASBs. AppOmni found 13% use a dedicated SSPM tool, and nearly a third say they need one.
Sprawl and shadow SaaS
- App count: Okta's Businesses at Work 2025 reports that the average number of apps per company reached 101, based on anonymised data from Okta Integration Network customers. This counts apps connected to Okta, so the real number including unmanaged SaaS is higher.
- Adoption without security: 55% of CSA's 2025 respondents said employees adopt SaaS tools without security's involvement.
- Visibility versus control: 89% of organisations in AppOmni's 2025 survey that suffered a SaaS compromise believed they had appropriate visibility before it happened.
Non-human identities and API access
- Monitoring gap: 46% of CSA's 2025 respondents struggle to monitor non-human identities in SaaS, and 56% are concerned about over-privileged API access.
- Stolen identities: the Google Cloud Threat Horizons Report H1 2026 counts human and non-human identities together in its 21% stolen-identity figure, so it cannot be split.
- Secrets in SaaS data: Google's UNC6395 advisory recommends scanning Salesforce objects for strings such as AKIA, snowflakecomputing.com, password and secret, because exported CRM data held cloud keys.
See the Non-Human Identity and Secrets Statistics Guide and the NHI Discovery Guide.
What the published figures do not measure
No primary source we could read publishes a population-wide rate for SaaS compromises, the share of OAuth grants that are unused, or the median age of integration tokens. These are the numbers a SaaS programme most needs, and they have to come from your own tenants.
- Token age and scope: the Snowflake campaign used credentials unrotated for up to four years, and the Drift and Gainsight campaigns used long-lived OAuth tokens, but neither investigation gives an industry baseline. Export grant and token dates from each platform's admin console or API and track the distribution.
- Integration owners: no survey we found measures how many integrations have a named business owner. Treat any integration without one as a candidate for removal.
- Data held in SaaS: the UNC6395 advisory shows CRM records holding cloud keys and passwords. Few organisations measure this; a periodic secrets scan of SaaS objects gives you a figure to trend.
Publishing your own figures for these three measures next to the industry statistics above makes a far stronger case to a board than survey averages alone.
What the numbers mean for defenders
The primary incident data and the surveys point the same way: SaaS risk is concentrated in who and what can log in, and with which scopes. The table maps each finding to controls.
| Finding | Control that answers it | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | MITRE ATT&CK |
|---|---|---|---|---|
| Identity issues in 83% of cloud and SaaS incidents (Google, H2 2025) | Phishing-resistant MFA, SSO enforcement, disable local logins | IA-2, AC-2 | PR.AA-01 | T1078.004 Cloud Accounts |
| Third-party trusted relationships in 21% of cases (Google, H2 2025) | Integration inventory, scope limits, supplier review | SA-9, SR-6 | GV.SC-07 | T1199 Trusted Relationship |
| Stolen OAuth tokens (Salesloft Drift, 2025) | Short token lifetimes, IP restrictions on connected apps, revocation playbook | AC-6, SI-4 | DE.CM-01 | T1528, T1550.001 Application Access Token |
| Permission issues in 41% of incidents (AppOmni 2025) | Least privilege, regular entitlement reviews | AC-6 | PR.AA-05 | T1078 Valid Accounts |
| Misconfiguration in 29% of incidents (AppOmni 2025) | Secure baselines and continuous posture checks | CM-7, CA-7 | PR.PS-01 | Not technique-specific |
| 55% see SaaS adopted without security (CSA 2025) | SaaS discovery and an approved-app register | CM-7 | ID.AM-02 | Not technique-specific |
In CIS Controls v8.1, see Control 5 (Account Management), Control 6 (Access Control Management) and Control 15 (Service Provider Management). In ISO/IEC 27001:2022 Annex A, see A.5.23 Information security for use of cloud services and A.5.19 to A.5.22 on supplier relationships. CISA's Secure Cloud Business Applications (SCuBA) project publishes secure configuration baselines for Microsoft 365 services such as Exchange Online, SharePoint Online and Teams.
Turning the statistics into a programme
- Inventory first: list every SaaS application, connected app, OAuth grant, API key and integration user, with an owner. See the Salesforce connected apps review and the Google Workspace OAuth inventory.
- Close direct logins: enforce SSO with phishing-resistant MFA and disable local passwords for human users; move service users to key-pair or certificate authentication.
- Cut integration scope: remove broad scopes such as Salesforce "full", enforce IP restrictions on connected apps, and remove "API Enabled" from profiles, granting it only through permission sets, as Google's UNC6395 advisory recommends.
- Baseline configuration in audit mode: run posture checks against a baseline (CISA SCuBA for Microsoft 365, vendor hardening guides elsewhere) and review findings for two weeks before auto-remediating.
- Monitor tokens and exports: alert on large API queries, new user agents and logins from unexpected networks; Google pointed to Salesforce Event Monitoring UniqueQuery events.
- Rehearse revocation: keep a tested runbook to revoke an integration's tokens and rotate any secrets stored in SaaS records, with a business owner who approves the outage. See the OAuth Token Theft Incident Playbook.
Small and large organisations
A small organisation with a few core SaaS platforms can get most of the benefit from SSO with MFA, native admin consoles and a quarterly review of connected apps. A large one with hundreds of apps, where CSA found native tools and manual audits still dominate, usually needs dedicated SaaS posture management or ITDR coverage and a central integration register. See the SaaS Security Buyer's Guide.
Metrics worth tracking
- SSO coverage: percentage of SaaS apps behind SSO with MFA, and the number still allowing local logins.
- Integration hygiene: OAuth grants and connected apps without an owner, and tokens older than 90 days.
- Scope: integrations holding admin or full-access scopes, trending down.
- Posture drift: high-severity configuration findings open longer than 30 days.
- Revocation speed: median time to revoke a compromised integration's tokens in exercises.
Common failure patterns when using SaaS statistics
- Treating confidence as posture: AppOmni's 91% confidence figure sits next to its 75% incident figure. Survey confidence is not evidence.
- Merging cloud and SaaS figures: Google's 83% covers "major cloud and SaaS-hosted environments" together. Do not quote it as a SaaS-only figure.
- Reading the Google Cloud subset as the market: the 44.5% third-party figure is Google Cloud's own data, which Google says may not represent all customers.
- Counting apps from one directory: Okta's 101 apps counts apps connected to Okta, so it understates unmanaged and shadow SaaS.
- Leaving integrations out of reviews: human access reviews miss OAuth grants, which is how the Midnight Blizzard breach used a forgotten test tenant and an OAuth application to reach executive mailboxes.
Methodology notes and caveats
| Source | What it measures | Sample and period | Caveat |
|---|---|---|---|
| Google Cloud Threat Horizons Report H1 2026 | Initial access in Mandiant cases and Google Cloud incidents | H2 2025 | No case counts; cloud and SaaS combined |
| Verizon 2025 DBIR | Confirmed breaches | 22,000+ incidents, 12,195 breaches | Not SaaS-specific; third-party figure covers all supplier types |
| AppOmni State of SaaS Security 2025 | Incidents, confidence, causes, SSPM use | 800+ security leaders in five countries, released July 2025 | Single vendor survey; sponsor sells SSPM |
| CSA State of SaaS Security Report 2025 | Priorities, gaps, tools | 420 respondents, January 2025 | Commissioned by Valence Security |
| Okta Businesses at Work 2025 | App adoption among Okta customers | Okta Integration Network data | Counts managed apps only |
| Mandiant UNC5537 and GTIG UNC6395 write-ups | Specific campaigns | 2024 and August 2025 | Campaign facts, not rates |
Practitioner checklist
- State whether a figure covers SaaS alone or cloud and SaaS together.
- Name the sponsor and sample for every survey figure (AppOmni, CSA with Valence, Okta).
- Pair a survey figure with an incident figure from Google Cloud, Mandiant or Verizon.
- Measure your own SSO coverage, OAuth grant count and integration owner coverage.
- Review connected apps and integration users at least quarterly and remove unused grants.
- Scan SaaS records for stored secrets and rotate anything found.
- Test a token revocation runbook for your three most connected SaaS platforms.
- Recheck these sources each year; the Threat Horizons Report is published twice a year.
Standards and references
- Google Cloud: Cloud Threat Horizons Report H1 2026
- Google Threat Intelligence Group: Widespread Data Theft Targets Salesforce Instances via Salesloft Drift
- Mandiant: UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion
- Verizon: 2025 Data Breach Investigations Report announcement
- CISA: Secure Cloud Business Applications (SCuBA) Project
- Cloud Security Alliance: State of SaaS Security Report 2025 announcement
- AppOmni: State of SaaS Security 2025 announcement
- Okta: Businesses at Work 2025
Related NHI Mgmt Group resources: SaaS Security Guide · Top 10 SaaS Security Risks · Cloud Security Statistics Guide · Zero Trust Adoption Statistics.