2025年SaaS安全现状调查报告

© 2025 Cloud Security Alliance – All Rights Reserved. You may download, store, display on yourcomputer, view, print, and link to the Cloud Security Alliance athttps://cloudsecurityalliance.orgsubject to the following: (a) the draft may be used solely for your personal, informational, non-commercial use; (b) the draft may not be modified or altered in any way; (c) the draft may not beredistributed; and (d) the trademark, copyright or other notices may not be removed. You may quoteportions of the draft as permitted by the Fair Use provisions of the United States Copyright Act,provided that you attribute the portions to the Cloud Security Alliance. Acknowledgments Lead Author Hillary Baron Contributors Marina BregkouJosh BukerRyan GiffordAlex KaluzaJohn Yeoh Graphic Design Claire LehnertStephen Lumpe About the Sponsor Valence finds and fixes SaaS risks. The Valence platform discovers, protects, and defendsSaaS applications by monitoring shadow IT, misconfigurations, and identity activities throughunparalleled SaaS discovery, SSPM, and ITDR capabilities. Recent high-profile breaches highlighthow decentralized SaaS adoption creates significant security challenges. With Valence, securityteams can control SaaS sprawl, protect their data, and detect suspicious activities from human andnon-human identities. Valence goes beyond visibility by enabling security teams to remediate risksthrough one-click remediation, automated workflows, and business user collaboration. Trusted byleading organizations, Valence ensures secure SaaS adoption while mitigating today’s most criticalSaaS security risks. https://www.valencesecurity.com Table of Contents Acknowledgments...............................................................................................................................3Lead Author...................................................................................................................................3Contributors..................................................................................................................................3Graphic Design..............................................................................................................................3About the Sponsor........................................................................................................................3Executive Summary.............................................................................................................................5Key Findings........................................................................................................................................6SaaS Security Is a Growing Priority as Organizations Ramp Up Investment..................................6Sensitive Data in SaaS Is at Risk Due to Poor Visibility and Weak Access Controls........................8The Rise (and Risks) of Decentralized SaaS Adoption and Management........................................9Human Identity Management in SaaS Remains a Persistent and Expanding Security Challenge..11Non-Human Identities & SaaS-to-SaaS Integrations Are an Expanding Security Blind Spot.........13Overconfidence in Current SaaS Security Strategy Masks Gaps..................................................14Conclusion: SaaS Security Is a Work in Progress................................................................................17Full Survey Results.............................................................................................................................18Overview.....................................................................................................................................18SaaS Security Program.................................................................................................................19Priorities and Challenges.............................................................................................................21SaaS Discovery............................................................................................................................23SaaS Security Incidents................................................................................................................24SaaS Detection and Response.....................................................................................................26Demographics...................................................................................................................................27Survey Methodology and Creation....................................................................................................28Goals of the Study.......................................................................................................................28 Executive Summary Software-as-a-Service (SaaS) applications have become foundational to business operations, andorganizations are responding with greater investment and attention. Yet, the 2025