Download Publication
SaaS AI-Risk for Mid-Market Organizations Survey Report
Release Date: 01/27/2025
Mid-market organizations are struggling to manage expanding Software as a Service (SaaS) environments. To better understand this challenge, Wing Security asked CSA to develop a survey report on the current state of SaaS security. Focusing on middle-market companies, this report explores misconfigurations, AI-driven threats, strategy gaps, and much more. CSA conducted the survey online in October 2024 and received 406 responses.
The survey results show that mid-market organizations are making progress in recognizing and addressing SaaS security risks. However, significant gaps remain. Organizations should prioritize adopting specialized technologies that enhance visibility. They should also work on automating processes and addressing critical security gaps, such as sensitive data leaks to third parties. By following this guidance and other insights covered in the report, mid-market businesses will have an easier time navigating the evolving SaaS landscape.
Key Findings:
- Many mid-market organizations struggle to manage the sheer volume of SaaS applications. Only about ⅔ of companies (69%) report having 50 or fewer sanctioned applications. A similar number of organizations (68%) report 50 or fewer unsanctioned ones.
- The majority of organizations (66%) plan to prioritize configuration management for critical applications like Microsoft 365, Google Workspace, and Salesforce. However, not many (28%) plan to automate configuration management across all applications.
- The majority of organizations (75%) show a moderate to high level of concern about AI-related risks in SaaS. However, a concerning number of them (33%) either lack a dedicated role or are unsure who holds responsibility for AI risk management.
- Currently, several organizations (48%) rely on manual processes to manage SaaS risks. Many others (48%) utilize Cloud Access Security Brokers (CASBs).
- Hardly any organizations (3%) report having a dedicated budget for SaaS security. Instead, most of them (89%) integrate SaaS security into broader initiatives like risk management, compliance, and identity posture.
Download this Resource
Share
Related resources
%20v1.0%20Control%20Framework%20-%20Thumbnail.png)
.jpeg)
.jpeg)
.jpeg)
.jpeg)
Acknowledgements
Hillary Baron
AVP of Research, CSA
Hillary Baron
AVP of Research, CSA
Are you a research volunteer? Request to have your profile displayed on the website here.
Interested in helping develop research with CSA?
Related Certificates & Training
Learn the core concepts, best practices and recommendation for securing an organization on the cloud regardless of the provider or platform. Covering all 14 domains from the CSA Security Guidance v4, recommendations from ENISA, and the Cloud Controls Matrix, you will come away understanding how to leverage information from CSA's vendor-neutral research to keep data secure on the cloud.
Learn more
Learn more