Source control
A GitHub organisation without enforced two-factor authentication or branch protection is a path into your source, and from there into the build that produces your images.
Coming soon
Strengthen the security
of your SaaS estate.
Bring SaaS configuration, identity and access risks into one view. Focus your team on risky settings, excessive permissions and the applications that matter most.
SaaS tenant
Application settings
Identity configuration
Access policy
Investigation context
01 / Scope the tenant
Agree which applications to evaluate.
- Application scope
- Connector requirements
Discuss connector coverage and the tenant settings relevant to your organisation.
02 / Review drift
A setting should explain the concern.
- Configuration setting
- Benchmark mapping
The planned workflow links a changed setting to its benchmark and owner.
03 / Plan follow-up
Define the correction and recheck.
- Responsible team
- Evaluation criteria
Evaluate how configuration evidence would support your remediation workflow.
SaaS
Admin-API connectors
Productivity, CRM, chat and source control.
Rules
Declarative checks
One setting, one expected value, one fix.
CIS
Benchmark mapping
CIS and NIST references planned for every check.
Graph
Correlated risk
SaaS settings beside identities and code.
The category
What is SSPM?
Much of an organisation's sensitive work now happens inside SaaS applications that the security team neither hosts nor routinely configures. Each one exposes a long tail of settings — sign-in policy, sharing defaults, admin roles, connected apps, audit logging — and each tenant drifts as administrators change them. SSPM connects to those applications through their administrative APIs, reads the live configuration and compares it with a benchmark. Done well, it reports the precise setting, the expected value, why it matters and how to fix it, rather than an unexplained score.
Connected tenant
Define the SaaS environment under review.
Access and configuration
Inspect permissions and security settings.
Responsible owner
Keep the affected service linked to its team.
Designed workflow: validate connector and analysis availability before evaluation.
Where it fits
How does SSPM differ from CSPM and a hardening checklist?
Three ways to answer "are our systems configured safely?", each with a different scope.
| Area | SSPM | CSPM | Hardening checklist |
|---|---|---|---|
| Checks | SaaS tenants you subscribe to | Cloud accounts you run | Whatever the document lists |
| Source of truth | Provider admin APIs, on every run | Cloud provider APIs, on every run | A manual review, once |
| Typical owner | IT and SaaS administrators | Cloud and platform teams | Whoever ran the review |
| Drift | Detected on re-check; remediation follows policy | Detected on re-check; remediation follows policy | Invisible until the next review |
| In SecurityVault | Discuss rollout | Available today | Not applicable |
Correlation
Why does a SaaS setting matter more on a graph?
A SaaS misconfiguration rarely matters on its own. It matters because of who it lets in and what they can reach next. SecurityVault is designed to place SaaS posture in the same graph that already connects code, artefacts, cloud and identity.
01
02
Sign-in policy
A Microsoft 365 tenant that still allows legacy authentication weakens every identity that also holds cloud roles. On one graph, the setting and the privileged account behind it read as one story.
03
Real exposure
Linked to the workloads and data you already scan, a SaaS weakness will be ranked by what it actually exposes, not by a benchmark's default severity.
The design
What will SecurityVault's SSPM check, and how?
Connectors
Will read security configuration from Microsoft 365, Google Workspace, Salesforce, Slack, Zoom and GitHub through each provider's administrative API.
Declarative rules
Will express every check as data: a setting path, the expected value, a severity and a remediation hint, so benchmark packs and your own policies compose from the same parts.
Benchmarks
Will carry CIS and NIST mappings under a stable rule identifier, with per-rule overrides and documented exceptions for settings your organisation has deliberately chosen.
Posture grade
Will give each connected application a posture score and a letter grade, so administrators can see which tenant needs attention first.
Lifecycle
Will refresh findings on every run rather than duplicating them. A control that stops failing will close automatically, and a finding a person has taken ownership of will never be overwritten by a scan.
Where results go
SaaS findings will sit in the unified findings queue with an owner and a remediation deadline, feed continuous compliance evidence, and be subject to human-only risk acceptance with a mandatory reason code.
FAQ
SSPM questions.
- What is the difference between SSPM and CSPM?
- Cloud security posture management (CSPM) checks the infrastructure you run, such as AWS, Azure and Google Cloud accounts. SSPM checks the SaaS applications you subscribe to, such as Microsoft 365 or Salesforce. The questions are similar; the APIs, the settings and the owners are different. SecurityVault ships cloud security posture management today.
- Which SaaS applications is SecurityVault's SSPM designed to cover?
- Microsoft 365, Google Workspace, Salesforce, Slack, Zoom and GitHub, with benchmark checks for Okta also planned. Tell us which applications matter most to you when you register interest.
- How is SSPM different from a SaaS hardening checklist?
- A checklist is a point-in-time document. SecurityVault's SSPM is designed to read the live configuration on every run, name the exact setting that drifted, and close the finding when the setting is fixed, so the record will match the tenant.
- Will SSPM findings count as compliance evidence?
- That is the design. Each check will carry its benchmark mapping, so a passing or failing SaaS control becomes evidence for the controls that ask for secure configuration, through the same framework cross-walk you use today.
- When will SSPM be available?
- SSPM is in development. Tell us which SaaS tenants and configuration risks matter to your organisation when discussing availability.
Available today: cloud security posture management · identity and entitlements (CIEM) · secrets detection. Related offerings: data security posture management. Built for security engineering and GRC and audit teams.
Discuss your requirements
Tell us which SaaS estate matters most.
Start with the SaaS applications, tenant configurations and identity permissions you need to review.