Survey: 70 Percent of Organizations Have Established Dedicated SaaS Security Teams

Seventy percent of organizations have prioritized investment in SaaS security, establishing dedicated SaaS security teams, despite economic uncertainty and workforce reductions. This was a key finding in the fourth Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities released today by the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment.

Commissioned by Adaptive Shield, the leader in SaaS security, the survey found that 39% of organizations are increasing SaaS cybersecurity budgets compared to last year.

"Coming off a year in which economic uncertainty and layoffs were making headlines, these results speak volumes to organizations’ realization that even the most secure systems are vulnerable to increasingly inventive threat actors,” said Hillary Baron, lead author and Senior Technical Director for Research, Cloud Security Alliance.

Additional key findings include:

  • SaaS security dedicated teams are established. For the first time, the survey identified the existence of SaaS-specific security roles: 57% of respondents have a SaaS security team of at least two dedicated full-time employees and another 13% have allocated a dedicated full-time employee.
  • Organizations managed to improve their key SaaS security capabilities. Full visibility into the SaaS stack has nearly doubled since last year, leaving companies in much better positions when it comes to preventing breaches and detecting threats. Seventy percent of organizations report having moderate to full visibility into their SaaS applications.
  • SaaS security challenges stem from using the wrong tool. Organizations are still struggling to manage misconfigurations, connected apps, and visibility into security risks. The most difficult areas to manage in SaaS security, according to the respondents, are achieving visibility into business-critical apps (73%); tracking and monitoring security risks from third-party connected apps (65%); locating and fixing SaaS misconfigurations (65%); ensuring data governance and privacy (63%); and aligning SaaS application settings with compliance standards (61%). These challenges stem from using tools such as CASB and Manual Audits. Companies that have adopted SaaS Security Posture Management (SSPM) are more than twice as likely to have full visibility into their SaaS stack — 62% of these organizations are able to oversee over 75% of their SaaS environment compared to those that utilize other tools and manual processes in their strategy (31%).
  • Despite challenges, SaaS security investment is paying off. The challenges presented clearly demonstrate that organizations are taking SaaS security seriously. In fact, the survey identified a positive trend: 25% of respondents experienced a SaaS security incident in the past two years, compared with 53% last year. The most common security incidents reported were data breaches (52%) and data leakage (50%), followed by unauthorized access (44%) and malicious applications (38%).

“To be well-equipped to tackle today’s most sophisticated threats, large enterprises now understand that investments in preventative methods are the right approach. Organizations have accumulated a wide range of tools that cover single use cases, leaving them exposed from new attack surfaces, and forcing them to manage many different solutions,” said Maor Bin, CEO and co-founder, Adaptive Shield.

“I am not surprised to see the major leap in SaaS maturity, this is 100% aligned with the exponential and rapidly growing demand we identify in the market. Just like Cloud Security Posture Management (CSPM) covers any security use case in Cloud Infrastructures, SaaS Security Posture Management (SSPM) is all about consolidation of SaaS security attack surfaces.”

The survey was conducted online by CSA in January 2024 and received 478 responses from IT and security professionals representing large organizations in various industries and locations. CSA’s research analysts performed the data analysis and interpretation for this report. Sponsors are CSA Corporate Members who support the research project’s findings but have no added influence on the content development or editing rights of CSA research.

Review the complete Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities.

Featured

  • New Report Reveals Top Trends Transforming Access Controller Technology

    Mercury Security, a provider in access control hardware and open platform solutions, has published its Trends in Access Controllers Report, based on a survey of over 450 security professionals across North America and Europe. The findings highlight the controller’s vital role in a physical access control system (PACS), where the device not only enforces access policies but also connects with readers to verify user credentials—ranging from ID badges to biometrics and mobile identities. With 72% of respondents identifying the controller as a critical or important factor in PACS design, the report underscores how the choice of controller platform has become a strategic decision for today’s security leaders. Read Now

  • Overwhelming Majority of CISOs Anticipate Surge in Cyber Attacks Over the Next Three Years

    An overwhelming 98% of chief information security officers (CISOs) expect a surge in cyber attacks over the next three years as organizations face an increasingly complex and artificial intelligence (AI)-driven digital threat landscape. This is according to new research conducted among 300 CISOs, chief information officers (CIOs), and senior IT professionals by CSC1, the leading provider of enterprise-class domain and domain name system (DNS) security. Read Now

  • ASIS International Introduces New ANSI-Approved Investigations Standard

    • Guard Services
  • Cloud Security Alliance Brings AI-Assisted Auditing to Cloud Computing

    The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today introduced an innovative addition to its suite of Security, Trust, Assurance and Risk (STAR) Registry assessments with the launch of Valid-AI-ted, an AI-powered, automated validation system. The new tool provides an automated quality check of assurance information of STAR Level 1 self-assessments using state-of-the-art LLM technology. Read Now

  • Report: Nearly 1 in 5 Healthcare Leaders Say Cyberattacks Have Impacted Patient Care

    Omega Systems, a provider of managed IT and security services, today released new research that reveals the growing impact of cybersecurity challenges on leading healthcare organizations and patient safety. According to the 2025 Healthcare IT Landscape Report, 19% of healthcare leaders say a cyberattack has already disrupted patient care, and more than half (52%) believe a fatal cyber-related incident is inevitable within the next five years. Read Now

New Products

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.”

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities