Survey: 70 Percent of Organizations Have Established Dedicated SaaS Security Teams

  • Jun 11, 2024

Seventy percent of organizations have prioritized investment in SaaS security, establishing dedicated SaaS security teams, despite economic uncertainty and workforce reductions. This was a key finding in the fourth Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities released today by the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment.

Commissioned by Adaptive Shield, the leader in SaaS security, the survey found that 39% of organizations are increasing SaaS cybersecurity budgets compared to last year.

"Coming off a year in which economic uncertainty and layoffs were making headlines, these results speak volumes to organizations’ realization that even the most secure systems are vulnerable to increasingly inventive threat actors,” said Hillary Baron, lead author and Senior Technical Director for Research, Cloud Security Alliance.

Additional key findings include:

  • SaaS security dedicated teams are established. For the first time, the survey identified the existence of SaaS-specific security roles: 57% of respondents have a SaaS security team of at least two dedicated full-time employees and another 13% have allocated a dedicated full-time employee.
  • Organizations managed to improve their key SaaS security capabilities. Full visibility into the SaaS stack has nearly doubled since last year, leaving companies in much better positions when it comes to preventing breaches and detecting threats. Seventy percent of organizations report having moderate to full visibility into their SaaS applications.
  • SaaS security challenges stem from using the wrong tool. Organizations are still struggling to manage misconfigurations, connected apps, and visibility into security risks. The most difficult areas to manage in SaaS security, according to the respondents, are achieving visibility into business-critical apps (73%); tracking and monitoring security risks from third-party connected apps (65%); locating and fixing SaaS misconfigurations (65%); ensuring data governance and privacy (63%); and aligning SaaS application settings with compliance standards (61%). These challenges stem from using tools such as CASB and Manual Audits. Companies that have adopted SaaS Security Posture Management (SSPM) are more than twice as likely to have full visibility into their SaaS stack — 62% of these organizations are able to oversee over 75% of their SaaS environment compared to those that utilize other tools and manual processes in their strategy (31%).
  • Despite challenges, SaaS security investment is paying off. The challenges presented clearly demonstrate that organizations are taking SaaS security seriously. In fact, the survey identified a positive trend: 25% of respondents experienced a SaaS security incident in the past two years, compared with 53% last year. The most common security incidents reported were data breaches (52%) and data leakage (50%), followed by unauthorized access (44%) and malicious applications (38%).

“To be well-equipped to tackle today’s most sophisticated threats, large enterprises now understand that investments in preventative methods are the right approach. Organizations have accumulated a wide range of tools that cover single use cases, leaving them exposed from new attack surfaces, and forcing them to manage many different solutions,” said Maor Bin, CEO and co-founder, Adaptive Shield.

“I am not surprised to see the major leap in SaaS maturity, this is 100% aligned with the exponential and rapidly growing demand we identify in the market. Just like Cloud Security Posture Management (CSPM) covers any security use case in Cloud Infrastructures, SaaS Security Posture Management (SSPM) is all about consolidation of SaaS security attack surfaces.”

The survey was conducted online by CSA in January 2024 and received 478 responses from IT and security professionals representing large organizations in various industries and locations. CSA’s research analysts performed the data analysis and interpretation for this report. Sponsors are CSA Corporate Members who support the research project’s findings but have no added influence on the content development or editing rights of CSA research.

Review the complete Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities.

Featured

  • Paving the Way to Smart Buildings

    In today's rapidly evolving security landscape, the convergence of on-prem, edge and cloud technologies are critical. The physical security landscape is undergoing a profound transformation, driven by the rapid digitalization of buildings and the evolving needs of modern organizations. As the buildings sector pivots towards smart, AI and data-driven operations, the integration of both edge and cloud technology has become crucial. Read Now

  • The Cybersecurity Time Bomb

    If you work in physical security, you have probably seen it: a camera, access control system, or intrusion detection device installed years ago, humming along without a single update. It is a common scenario that security professionals have come to accept as "normal." But here is the reality: this mindset is actively putting organizations at risk. Read Now

  • Deploying in a Hybrid, Cloud Environment

    The way organizations manage access control is evolving. Traditional on-premises systems come with high IT and server requirements. At the same time, fully cloud-based solutions may not meet the needs of every facility. Read Now

  • Facing Facts for Facilities

    Despite the proliferation of constantly evolving security solutions, there remains a troubling trend among many facility operators who often neglect the most important security assets within their organization. Keys and shared devices like radios, laptops and tablets are crucial to successful operations, yet many operators are managing them haphazardly through outdated storage systems like pegboards and notebooks. Read Now

  • Report Reveals Security Training Reduces Global Phishing Click Rates by 86%

    KnowBe4, the cybersecurity platform that comprehensively addresses human risk management, today launched its “Phishing by Industry Benchmarking Report 2025” which measures an organization’s Phish-prone Percentage (PPP) — the percentage of employees likely to fall for social engineering or phishing attacks, indicating the organization’s overall susceptibility to phishing threats. This year’s report found a global average baseline PPP of 33.1%, meaning a third of employees interact with phishing simulations before taking part in best-practice security awareness training (SAT).COVER 2025-PIB-NA-Report_EN-US Read Now

Most   Popular

New Products

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.