SaaS Security and AI Governance

SaaS Security Posture Management (SSPM) emerged to restore visibility and control as enterprises rapidly adopted both sanctioned and unsanctioned SaaS faster than IT and security teams could govern. Early SSPM focused on discovering unknown apps, improving configuration hygiene, identifying excessive permissions, and addressing identity and access weaknesses such as uneven controls and local accounts outside centralized identity systems. These capabilities remain necessary, but they no longer represent the full enterprise SaaS risk surface.

The market has expanded into a broader SaaS Security and AI Governance category because SaaS risk is now shaped by an interconnected control plane that includes embedded AI, shadow AI, AI agents, OAuth integrations, non-human identities, SaaS-to-SaaS connections, sensitive data exposure, and active threats. The central requirement is continuous visibility into which applications are in use, who or what can access them, what data is reachable, and where risk or threats are emerging. AI accelerates this shift because employees can adopt public AI tools, SaaS-native copilots, automation, and personal agents through decentralized pathways that bypass formal onboarding, centralized identity controls, and consistent reviews—making “shadow AI” the new shadow IT.

Identity becomes the organizing layer for managing this expanded surface, spanning employees, admins, contractors, partners, service accounts, connected apps, API tokens, workflows, and AI agents. AI agents heighten risk because they can act autonomously at machine speed with delegated authority across multiple systems and sensitive data. Effective solutions rely on multi-source discovery telemetry and map applications, identities, permissions, activity, and data sensitivity into an enterprise risk graph, while also supporting remediation, threat detection, OAuth risk management, and SaaS spend governance.

• SSPM emerged more than five years ago to address visibility and control gaps caused by rapid enterprise SaaS adoption.
• Early SSPM solutions focused on discovering unsanctioned applications, assessing configuration hygiene, and identifying excessive permissions.
• Employees can adopt public AI tools, SaaS-native copilots, and personal AI agents without formal IT onboarding or centralized identity controls.
• Cloud Security Alliance research released in April 2026 found 82% of organizations discovered unknown or shadow AI agents in the past year.
• Unknown AI agents were commonly discovered within internal automation systems, LLM platforms, SaaS applications, and developer-created workflows.
• Identity scope in enterprises includes human users, administrators, contractors, partners, service accounts, connected applications, API tokens, and AI agents.
• Identity providers can miss local SaaS accounts and direct browser-based application and AI usage.
• Purchasing data can reveal subscriptions but not actual application usage.
• Browser-level telemetry can expose SaaS and AI usage but raises privacy and compliance concerns, especially in Europe.
• The Klue security incident involved OAuth tokens tied to integrations with third-party SaaS applications, including Salesforce, enabling downstream customer data exposure.

• “The central requirement is continuous visibility into which applications are in use, who or what has access, what data is reachable, and where risk or threat activity is emerging.”
• “The latest ‘shadow IT’ is now shadow AI.”
• “Identity has become a key organizing layer for SaaS security and AI governance.”
• “AI agents can operate with delegated authority, interact with multiple systems, reach sensitive data, and act autonomously at machine speed.”
• “No single telemetry source can see the entire SaaS and AI environment.”
• “A connected application does not need to be malicious to be dangerous or a source of data leakage.”
• “Recent incidents involving trusted SaaS integrations and OAuth tokens have shown that this is not a theoretical issue.”
• “Sensitive data can be placed into prompts, summarized by copilots, retrieved by agents, or moved in unknown ways through automated workflows.”
• “Traditional SSPM remains necessary, but it has been absorbed into a broader SaaS Security and AI Governance solution market.”
• “Security teams need more than periodic configuration reviews or isolated visibility into individual applications.”