SaaS AI-Risk for Mid-Market Organizations Survey Report
Released: 01/27/2025
Mid-market organizations are struggling to manage expanding Software as a Service (SaaS) environments. To better understand this challenge, Wing Security asked CSA to develop a survey report on the current state of SaaS security. Focusing on middle-market companies, this report explores misconfigurations, AI-driven threats, strategy gaps, and much more. CSA conducted the survey online in October 2024 and received 406 responses.
The survey results show that mid-market organizations are making progress in recognizing and addressing SaaS security risks. However, significant gaps remain. Organizations should prioritize adopting specialized technologies that enhance visibility. They should also work on automating processes and addressing critical security gaps, such as sensitive data leaks to third parties. By following this guidance and other insights covered in the report, mid-market businesses will have an easier time navigating the evolving SaaS landscape.
Key Findings:
- Many mid-market organizations struggle to manage the sheer volume of SaaS applications. Only about ⅔ of companies (69%) report having 50 or fewer sanctioned applications. A similar number of organizations (68%) report 50 or fewer unsanctioned ones.
- The majority of organizations (66%) plan to prioritize configuration management for critical applications like Microsoft 365, Google Workspace, and Salesforce. However, not many (28%) plan to automate configuration management across all applications.
- The majority of organizations (75%) show a moderate to high level of concern about AI-related risks in SaaS. However, a concerning number of them (33%) either lack a dedicated role or are unsure who holds responsibility for AI risk management.
- Currently, several organizations (48%) rely on manual processes to manage SaaS risks. Many others (48%) utilize Cloud Access Security Brokers (CASBs).
- Hardly any organizations (3%) report having a dedicated budget for SaaS security. Instead, most of them (89%) integrate SaaS security into broader initiatives like risk management, compliance, and identity posture.
