Two Steps Forward for SaaS Adoption, One Step Back for SaaS Security

Anna Sarnek, who leads strategic alliances at Valence Security, argues that SaaS adoption has outpaced SaaS security because procurement decentralized to individual business units while security tooling stayed focused on identity providers, CASBs and endpoint controls that cannot see application-to-application integrations. She walks through concrete failure patterns: OAuth tokens and integrations left active after a tool is decommissioned, local accounts created through 'sign in with Google' that identity providers never see and so never terminate, a single third-party integration with tenant-wide access becoming a full breach path (illustrated with the GitHub/Heroku/Travis CI and Drizzly incidents), files shared to personal Gmail accounts out of convenience, and gaps in MFA enforcement across unmanaged SaaS tools. Her six recommendations center on regularly auditing and off-boarding unused integrations and accounts, centralizing identity, applying data labels to prioritize audit effort, enabling native SaaS security controls rather than assuming defaults are safe, and studying emerging SaaS-to-cloud attack patterns. A Q&A clarifies what Valence Security's platform automates versus CSPM and CASB tools.