Survey: 70 Percent of Organizations Have Established Dedicated SaaS Security Teams

  • Jun 11, 2024

Seventy percent of organizations have prioritized investment in SaaS security, establishing dedicated SaaS security teams, despite economic uncertainty and workforce reductions. This was a key finding in the fourth Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities released today by the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment.

Commissioned by Adaptive Shield, the leader in SaaS security, the survey found that 39% of organizations are increasing SaaS cybersecurity budgets compared to last year.

"Coming off a year in which economic uncertainty and layoffs were making headlines, these results speak volumes to organizations’ realization that even the most secure systems are vulnerable to increasingly inventive threat actors,” said Hillary Baron, lead author and Senior Technical Director for Research, Cloud Security Alliance.

Additional key findings include:

  • SaaS security dedicated teams are established. For the first time, the survey identified the existence of SaaS-specific security roles: 57% of respondents have a SaaS security team of at least two dedicated full-time employees and another 13% have allocated a dedicated full-time employee.
  • Organizations managed to improve their key SaaS security capabilities. Full visibility into the SaaS stack has nearly doubled since last year, leaving companies in much better positions when it comes to preventing breaches and detecting threats. Seventy percent of organizations report having moderate to full visibility into their SaaS applications.
  • SaaS security challenges stem from using the wrong tool. Organizations are still struggling to manage misconfigurations, connected apps, and visibility into security risks. The most difficult areas to manage in SaaS security, according to the respondents, are achieving visibility into business-critical apps (73%); tracking and monitoring security risks from third-party connected apps (65%); locating and fixing SaaS misconfigurations (65%); ensuring data governance and privacy (63%); and aligning SaaS application settings with compliance standards (61%). These challenges stem from using tools such as CASB and Manual Audits. Companies that have adopted SaaS Security Posture Management (SSPM) are more than twice as likely to have full visibility into their SaaS stack — 62% of these organizations are able to oversee over 75% of their SaaS environment compared to those that utilize other tools and manual processes in their strategy (31%).
  • Despite challenges, SaaS security investment is paying off. The challenges presented clearly demonstrate that organizations are taking SaaS security seriously. In fact, the survey identified a positive trend: 25% of respondents experienced a SaaS security incident in the past two years, compared with 53% last year. The most common security incidents reported were data breaches (52%) and data leakage (50%), followed by unauthorized access (44%) and malicious applications (38%).

“To be well-equipped to tackle today’s most sophisticated threats, large enterprises now understand that investments in preventative methods are the right approach. Organizations have accumulated a wide range of tools that cover single use cases, leaving them exposed from new attack surfaces, and forcing them to manage many different solutions,” said Maor Bin, CEO and co-founder, Adaptive Shield.

“I am not surprised to see the major leap in SaaS maturity, this is 100% aligned with the exponential and rapidly growing demand we identify in the market. Just like Cloud Security Posture Management (CSPM) covers any security use case in Cloud Infrastructures, SaaS Security Posture Management (SSPM) is all about consolidation of SaaS security attack surfaces.”

The survey was conducted online by CSA in January 2024 and received 478 responses from IT and security professionals representing large organizations in various industries and locations. CSA’s research analysts performed the data analysis and interpretation for this report. Sponsors are CSA Corporate Members who support the research project’s findings but have no added influence on the content development or editing rights of CSA research.

Review the complete Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities.

Featured

  • From Surveillance to Intelligence

    Years ago, it would have been significantly more expensive to run an analytic like that — requiring a custom-built solution with burdensome infrastructure demands — but modern edge devices have made it accessible to everyone. It also saves time, which is a critical factor if a missing child is involved. Video compression technology has played a critical role as well. Over the years, significant advancements have been made in video coding standards — including H.263, MPEG formats, and H.264—alongside compression optimization technologies developed by IP video manufacturers to improve efficiency without sacrificing quality. The open-source AV1 codec developed by the Alliance for Open Media—a consortium including Google, Netflix, Microsoft, Amazon and others — is already the preferred decoder for cloud-based applications, and is quickly becoming the standard for video compression of all types. Read Now

  • Cost: Reactive vs. Proactive Security

    Security breaches often happen despite the availability of tools to prevent them. To combat this problem, the industry is shifting from reactive correction to proactive protection. This article will examine why so many security leaders have realized they must “lead before the breach” – not after. Read Now

  • Achieving Clear Audio

    In today’s ever-changing world of security and risk management, effective communication via an intercom and door entry communication system is a critical communication tool to keep a facility’s staff, visitors and vendors safe. Read Now

  • Beyond Apps: Access Control for Today’s Residents

    The modern resident lives in an app-saturated world. From banking to grocery delivery, fitness tracking to ridesharing, nearly every service demands another download. But when it comes to accessing the place you live, most people do not want to clutter their phone with yet another app, especially if its only purpose is to open a door. Read Now

  • Survey: 48 Percent of Worshippers Feel Less Safe Attending In-Person Services

    Almost half (48%) of those who attend religious services say they feel less safe attending in-person due to rising acts of violence at places of worship. In fact, 39% report these safety concerns have led them to change how often they attend in-person services, according to new research from Verkada conducted online by The Harris Poll among 1,123 U.S. adults who attend a religious service or event at least once a month. Read Now

Most   Popular

New Products

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities