CyberGlossary

Cloud Security

SSPM (SaaS Security Posture Management)

Also known as: SaaS posture management

Definition

A tooling category that continuously monitors SaaS application configurations, identities, and integrations to detect misconfigurations and risky behaviour.

SSPM platforms connect via API to SaaS apps such as Microsoft 365, Google Workspace, Salesforce, GitHub, Slack, Workday, ServiceNow, and Snowflake. They check tenant-level settings against best-practice baselines (admin MFA, external sharing, legacy auth, data residency), inventory OAuth grants and third-party app integrations, and detect unusual administrative actions or privilege creep. Unlike CASB, which inspects user traffic, SSPM acts on the SaaS control plane itself. SSPMs are crucial as organizations adopt dozens to hundreds of SaaS apps each with its own permission model and shadow-admin risks.

Examples

  • Adaptive Shield, Obsidian, Wing Security, or AppOmni reviewing Microsoft 365 admin roles.
  • Detecting an unsanctioned GitHub OAuth app with org-wide repo read access.

Related terms