[{"data":1,"prerenderedAt":1736},["ShallowReactive",2],{"application-flags":3,"navbar":7,"always-visible-banner":36,"navbar-about-highlight":108,"navbar-resource-highlight":182,"blog/embrace-saas-to-move-faster-than-your-competitors":226},[4],{"name":5,"enabled":6},"maintenanceMode",false,[8],{"createdDate":9,"id":10,"name":11,"modelId":12,"published":13,"query":14,"data":15,"variations":20,"lastUpdated":21,"firstPublished":22,"testRatio":23,"createdBy":24,"lastUpdatedBy":25,"folders":26,"meta":27,"rev":35},1742208588866,"1c7a4e423bf54ac1a328bb4063459ef2","Banner","1c6207a5f24948ab82d4a0b17f251193","published",[],{"type":16,"url":17,"text":18,"link":19},"web-banner","https://pushsecurity.com/resources/browser-attacks-report","Get our latest report analyzing browser attack techniques in 2026",{},{},1774258294825,1742208637545,1,"CydmZnOWU1XuAaLhEDCoYNM4Z8W2","jKjF9r5jcvXU8tzZEfFQm31Iyvr2",[],{"kind":28,"lastPreviewUrl":29,"breakpoints":30,"hasAutosaves":34},"data","",{"xsmall":31,"small":32,"medium":33},320,640,768,true,"ga0kpxjhh76",{"createdDate":37,"id":38,"name":39,"modelId":40,"published":13,"stageModifiedSincePublish":6,"query":41,"data":42,"variations":97,"lastUpdated":98,"firstPublished":99,"testRatio":23,"createdBy":100,"lastUpdatedBy":101,"folders":102,"meta":103,"rev":107},1774965361051,"fd266d0172cc47429be7ad10f48c99ad","always visible banner","0678d178ec8b41efb8a23c09dba7874d",[],{"ctaText":43,"text":44,"url":29,"blocks":45,"state":93},"ewrererw","testrfesssssssssss",[46,73,81],{"@type":47,"@version":48,"id":49,"component":50,"responsiveStyles":63},"@builder.io/sdk:Element",2,"builder-ca12c06a52de41d7b8743da53118cd38",{"name":51,"tag":51,"options":52,"isRSC":62},"TopBannerContent",{"text":53,"ctaText":54,"url":55,"mainText":56,"cta":59},"New Webinar Series: Join John Hammond, Troy Hunt, and Matt Johansen for the State of Browser Attacks","Save Your Spot","https://pushsecurity.com/webinar/state-of-browser-security",{"content":57,"fontSize":58},"\u003Cp>Meet Push's browser security experts at BlackHat 2026.\u003C/p>","text-base",{"content":60,"fontSize":58,"url":61},"\u003Cp>Book a meeting →\u003C/p>","https://pushsecurity.com/events/blackhat-2026-meeting",null,{"large":64},{"display":65,"flexDirection":66,"position":67,"flexShrink":68,"boxSizing":69,"marginTop":70,"marginBottom":70,"fontSize":71,"fontWeight":72},"flex","column","relative","0","border-box",".56rem","1.125rem","700",{"@type":47,"@version":48,"id":74,"component":75,"responsiveStyles":79},"builder-a2e1f4b9f30b464bb814d7f5de5b0aa7",{"name":76,"options":77,"isRSC":62},"Custom Code",{"code":78,"scriptsClientOnly":6},"\u003Cstyle>\n  .top-banner.bg-web-orange{background:rgb(114, 79, 255);}\n\u003C/style>\n",{"large":80},{"display":65,"flexDirection":66,"position":67,"flexShrink":68,"boxSizing":69},{"id":82,"@type":47,"tagName":83,"properties":84,"responsiveStyles":88},"builder-pixel-o503s4fpvk","img",{"src":85,"aria-hidden":86,"alt":29,"role":87,"width":68,"height":68},"https://cdn.builder.io/api/v1/pixel?apiKey=f3a1111ff5be48cdbb123cd9f5795a05","true","presentation",{"large":89},{"height":68,"width":68,"display":90,"opacity":68,"overflow":91,"pointerEvents":92},"block","hidden","none",{"deviceSize":94,"location":95},"large",{"path":29,"query":96},{},{},1783541846936,1774968080803,"ST0tXQM8slWpFrmioqKHmENB2qe2","kYgMv6WsbvfmlOUYqR2SFwGzw6e2",[],{"kind":104,"lastPreviewUrl":105,"hasLinks":6,"breakpoints":106,"hasErrors":6,"hasAutosaves":6},"component","https://pushsecurity.com/?builder.space=f3a1111ff5be48cdbb123cd9f5795a05&builder.user.permissions=read%2Ccreate%2Cpublish%2CeditDesigns%2CeditLayouts%2CeditLayers%2CeditContentPriority%2CeditFolders%2CcreateProjects%2CsendPullRequests&builder.user.role.name=Designer&builder.user.role.id=creator&builder.cachebust=true&builder.preview=always-visible-banner&builder.noCache=true&builder.allowTextEdit=true&__builder_editing__=true&builder.overrides.always-visible-banner=fd266d0172cc47429be7ad10f48c99ad&builder.overrides.fd266d0172cc47429be7ad10f48c99ad=fd266d0172cc47429be7ad10f48c99ad&builder.options.locale=Default",{"xsmall":31,"small":32,"medium":33},"kyujw1aptq",[109,145],{"createdDate":110,"id":111,"name":112,"modelId":113,"published":13,"stageModifiedSincePublish":6,"query":114,"data":115,"variations":138,"lastUpdated":139,"firstPublished":140,"testRatio":23,"createdBy":24,"lastUpdatedBy":24,"folders":141,"meta":142,"rev":144},1776247359804,"9136a8f18b3b4a6ba29b8653a99372b1","testimonial-inductive-automation","20d9eaa352304613b3d1a794b400703d",[],{"link":116,"type":117,"testimonialLink":118,"testimonial":119},{},"testimonial","/customer-stories/inductive-automation",{"@type":120,"id":121,"model":117,"value":122},"@builder.io/core:Reference","f028f2b685bb47cd8bf9e82a26dd5a79",{"query":123,"folders":124,"createdDate":125,"id":121,"name":126,"modelId":127,"published":13,"data":128,"variations":132,"lastUpdated":133,"firstPublished":134,"testRatio":23,"createdBy":100,"lastUpdatedBy":100,"meta":135,"rev":137},[],[],1735823466309,"We found Push to be more accurate when compared to competitors and the browser agent offered features that others couldn’t match.","42035571a56940ac98bff4544aa79aa5",{"author":129,"jobTitle":130,"quote":126,"image":131},"Jason Waits","\u003Cp>CISO at Inductive Automation\u003C/p>","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ff04c0c0689ce4a89ac0f0708d78c0a07",{},1735910703862,1735823501152,{"kind":28,"lastPreviewUrl":29,"breakpoints":136,"hasAutosaves":34},{"small":32,"medium":33},"e8bsg4qrgtu",{},1776247404986,1776247404973,[],{"breakpoints":143,"kind":28,"lastPreviewUrl":29,"hasAutosaves":6},{"xsmall":31,"small":32,"medium":33},"g9lqcuxphw7",{"createdDate":146,"id":147,"name":148,"modelId":113,"published":13,"meta":149,"stageModifiedSincePublish":6,"query":151,"data":152,"variations":178,"lastUpdated":179,"firstPublished":180,"testRatio":23,"createdBy":24,"lastUpdatedBy":24,"folders":181,"rev":144},1776255761419,"05a9322735fc427db12e2740e4302300","Report: 2026 Browser Attack Techniques",{"breakpoints":150,"kind":28,"lastPreviewUrl":29,"hasAutosaves":6},{"xsmall":31,"small":32,"medium":33},[],{"testimonial":153,"link":172,"type":175,"title":148,"description":176,"image":177},{"@type":120,"id":154,"model":117,"value":155},"192acbb1f9ca4cac918c0ec435a8bae3",{"query":156,"folders":157,"createdDate":158,"id":154,"name":159,"modelId":127,"published":13,"data":160,"variations":166,"lastUpdated":167,"firstPublished":168,"testRatio":23,"createdBy":100,"lastUpdatedBy":24,"meta":169,"rev":171},[],[],1728981467463,"Push does for identity what CrowdStrike did for the endpoint",{"video":161,"jobTitle":162,"author":163,"qoute":29,"quote":164,"image":165},"https://cdn.builder.io/o/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F8b30e8ca50064058bbaef0f3c6164575%2Fcompressed?apiKey=f3a1111ff5be48cdbb123cd9f5795a05&token=8b30e8ca50064058bbaef0f3c6164575&alt=media&optimized=true","\u003Cp>Deputy CISO at Microsoft\u003C/p>\u003Cp>Former LinkedIn, Slack, Palantir\u003C/p>","Geoff Belknap","Push does for identity what CrowdStrike did for the endpoint.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F748f0ad0a5064a00a13f4721fcc8dea1",{},1742902158597,1728981782923,{"kind":28,"lastPreviewUrl":29,"breakpoints":170,"hasAutosaves":34},{"small":32,"medium":33},"ulhc0im1hfo",{"text":173,"url":174},"Download now","/resources/browser-attacks-report","resource","Learn about the latest techniques being used in the wild.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F7b4a5ebf81d64e8c9d7fc35f6c96c4a9",{},1776255810913,1776255810900,[],[183,205],{"createdDate":184,"id":185,"name":148,"modelId":186,"published":13,"meta":187,"stageModifiedSincePublish":6,"query":189,"data":190,"variations":200,"lastUpdated":201,"firstPublished":202,"testRatio":23,"createdBy":24,"lastUpdatedBy":24,"folders":203,"rev":204},1776256900280,"1f429607996e4e5fae8fe3f9b9610e55","4829faa81e7c4ee8bd2d000e160e8d3c",{"breakpoints":188,"kind":28,"lastPreviewUrl":29,"hasAutosaves":6},{"xsmall":31,"small":32,"medium":33},[],{"testimonial":191,"link":199,"type":175,"title":148,"description":176,"image":177},{"@type":120,"id":154,"model":117,"value":192},{"query":193,"folders":194,"createdDate":158,"id":154,"name":159,"modelId":127,"published":13,"data":195,"variations":196,"lastUpdated":167,"firstPublished":168,"testRatio":23,"createdBy":100,"lastUpdatedBy":24,"meta":197,"rev":171},[],[],{"video":161,"jobTitle":162,"author":163,"qoute":29,"quote":164,"image":165},{},{"kind":28,"lastPreviewUrl":29,"breakpoints":198,"hasAutosaves":34},{"small":32,"medium":33},{"text":173,"url":174},{},1776256937553,1776256937540,[],"xggsv10v1q9",{"createdDate":206,"id":207,"name":208,"modelId":186,"published":13,"stageModifiedSincePublish":6,"query":209,"data":210,"variations":220,"lastUpdated":221,"firstPublished":222,"testRatio":23,"createdBy":24,"lastUpdatedBy":24,"folders":223,"meta":224,"rev":204},1776256949234,"ce043785b71b4ece98eac811ecf4ba10","inductive-automation",[],{"link":211,"type":117,"testimonial":212,"testimonialLink":118},{},{"@type":120,"id":121,"model":117,"value":213},{"query":214,"folders":215,"createdDate":125,"id":121,"name":126,"modelId":127,"published":13,"data":216,"variations":217,"lastUpdated":133,"firstPublished":134,"testRatio":23,"createdBy":100,"lastUpdatedBy":100,"meta":218,"rev":137},[],[],{"author":129,"jobTitle":130,"quote":126,"image":131},{},{"kind":28,"lastPreviewUrl":29,"breakpoints":219,"hasAutosaves":34},{"small":32,"medium":33},{},1776256974140,1776256974130,[],{"breakpoints":225,"kind":28,"lastPreviewUrl":29,"hasAutosaves":6},{"xsmall":31,"small":32,"medium":33},{"id":227,"title":228,"authorsCollection":229,"content":237,"extension":1012,"faqItemsCollection":1013,"faqTitle":62,"featured":6,"hashTags":62,"meta":1015,"metaTitle":1016,"ogImage":62,"publishedDate":1017,"relatedBlogPostsCollection":1018,"slug":1710,"stem":1711,"subtitle":62,"summary":1712,"synopsis":1723,"sys":1724,"tagsCollection":1727,"__hash__":1735},"blog/blog/embrace-saas-to-move-faster-than-your-competitors.json","Embrace SaaS to move faster than your competitors",{"items":230},[231],{"fullName":232,"firstName":233,"jobTitle":234,"profilePicture":235},"Sally Soulliere","Sally","Head of Brand & Content",{"url":236},"https://images.ctfassets.net/y1cdw1ablpvd/7Gh4SbbEj6Zsbd6OzGto8Q/885041a4ddeccc5ef3045c0e22975ef4/T016S22KZ96-U036FPETQRH-330f87708d26-192.jpeg",{"json":238,"links":1007},{"nodeType":239,"data":240,"content":241},"document",{},[242,251,258,266,273,294,301,347,354,362,407,427,434,441,448,468,488,495,530,537,557,564,571,603,623,630,637,644,651,658,665,672,679,686,693,700,707,714,731,738,809,816,823,852,868,875,882,889,922,942,949,956,963,970,989],{"nodeType":243,"data":244,"content":245},"paragraph",{},[246],{"nodeType":247,"value":248,"marks":249,"data":250},"text","Our goal at Push is simple - to reduce the risk of using SaaS apps at work. Doing this well means building controls that are easy to use, easy to understand - and ultimately effective. Not just effective against the hand-wavy concept of “SaaS attacks” but specific techniques –the most common techniques that are likely to cause real damage.",[],{},{"nodeType":243,"data":252,"content":253},{},[254],{"nodeType":247,"value":255,"marks":256,"data":257},"To talk about this, we need to have a shared understanding of what these techniques are. To get that conversation going we’ve pulled together all the techniques we're aware of, and our research team has even added a bunch of new ones.",[],{},{"nodeType":259,"data":260,"content":261},"heading-1",{},[262],{"nodeType":247,"value":263,"marks":264,"data":265},"The SaaS attack matrix",[],{},{"nodeType":243,"data":267,"content":268},{},[269],{"nodeType":247,"value":270,"marks":271,"data":272},"We’ve taken inspiration from the MITRE ATT&CK framework (certainly intended as the sincerest form of flattery), but wanted to make a conscious break away from the endpoint-focused ATT&CK techniques and instead focus on techniques that are SaaS-specific. In fact, these techniques don’t touch endpoints (so they bypass EDR) or customer networks (so  they bypass network detection) - so we’re calling them networkless attacks.",[],{},{"nodeType":243,"data":274,"content":275},{},[276,280,291],{"nodeType":247,"value":277,"marks":278,"data":279},"You can find more detailed descriptions of these techniques (and hopefully PR’s for some we missed) on ",[],{},{"nodeType":281,"data":282,"content":284},"hyperlink",{"uri":283},"https://github.com/pushsecurity/saas-attacks",[285],{"nodeType":247,"value":286,"marks":287,"data":290},"GitHub",[288],{"type":289},"underline",{},{"nodeType":247,"value":29,"marks":292,"data":293},[],{},{"nodeType":243,"data":295,"content":296},{},[297],{"nodeType":247,"value":298,"marks":299,"data":300},"Since we’re not targeting endpoints, let’s talk about the new targets: the accounts/identities on SaaS apps. We found it was useful to not think about these identities as stand-alone isolated islands - they are much more like a graph; less a single web-server on the internet and more like many Windows endpoints on an Active Directory. ",[],{},{"nodeType":243,"data":302,"content":303},{},[304,308,317,321,330,334,343],{"nodeType":247,"value":305,"marks":306,"data":307},"You can leverage this access to an identity on a trusted platform to target (so laterally more or escalate privilege to) other users or identities. For example, attacks like using access to SaaS apps to ",[],{},{"nodeType":281,"data":309,"content":311},{"uri":310},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/in-app_phishing/description.md",[312],{"nodeType":247,"value":313,"marks":314,"data":316},"phish other employees through comments",[315],{"type":289},{},{"nodeType":247,"value":318,"marks":319,"data":320}," and ",[],{},{"nodeType":281,"data":322,"content":324},{"uri":323},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/im_user_spoofing/description.md",[325],{"nodeType":247,"value":326,"marks":327,"data":329},"spoofing users on IM platforms",[328],{"type":289},{},{"nodeType":247,"value":331,"marks":332,"data":333}," to social engineer them there - or perhaps ",[],{},{"nodeType":281,"data":335,"content":337},{"uri":336},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/link_backdooring/description.md",[338],{"nodeType":247,"value":339,"marks":340,"data":342},"backdooring links",[341],{"type":289},{},{"nodeType":247,"value":344,"marks":345,"data":346}," in documents.",[],{},{"nodeType":243,"data":348,"content":349},{},[350],{"nodeType":247,"value":351,"marks":352,"data":353},"In this case, unusually, it’s not the data in these hundreds of SaaS apps that create risk, and you need to consider low-risk (from a data perspective) apps as a vector to pivot to higher risk apps in your estate.",[],{},{"nodeType":355,"data":356,"content":357},"heading-2",{},[358],{"nodeType":247,"value":359,"marks":360,"data":361},"Initial access and poisoned tenants",[],{},{"nodeType":243,"data":363,"content":364},{},[365,369,378,381,390,394,403],{"nodeType":247,"value":366,"marks":367,"data":368},"Attacks like ",[],{},{"nodeType":281,"data":370,"content":372},{"uri":371},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/credential_stuffing/description.md",[373],{"nodeType":247,"value":374,"marks":375,"data":377},"credential stuffing",[376],{"type":289},{},{"nodeType":247,"value":318,"marks":379,"data":380},[],{},{"nodeType":281,"data":382,"content":384},{"uri":383},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/email_phishing/description.md",[385],{"nodeType":247,"value":386,"marks":387,"data":389},"email phishing",[388],{"type":289},{},{"nodeType":247,"value":391,"marks":392,"data":393}," that get you initial access to SaaS apps are fairly well known - because they work and are widely used. We’re also starting to see tools and attacks that suggest ",[],{},{"nodeType":281,"data":395,"content":397},{"uri":396},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/im_phishing/description.md",[398],{"nodeType":247,"value":399,"marks":400,"data":402},"phishing employees through these IM apps",[401],{"type":289},{},{"nodeType":247,"value":404,"marks":405,"data":406}," is about to go mainstream.",[],{},{"nodeType":243,"data":408,"content":409},{},[410,414,423],{"nodeType":247,"value":411,"marks":412,"data":413},"Another interesting attack is a spin on the classic waterhole attack called a ",[],{},{"nodeType":281,"data":415,"content":417},{"uri":416},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/poisoned_tenants/description.md",[418],{"nodeType":247,"value":419,"marks":420,"data":422},"poisoned tenant",[421],{"type":289},{},{"nodeType":247,"value":424,"marks":425,"data":426},". Rather than attacking a customer tenant for a SaaS app, the attacker lures employees into joining an attacker-controlled tenant. ",[],{},{"nodeType":243,"data":428,"content":429},{},[430],{"nodeType":247,"value":431,"marks":432,"data":433},"SaaS apps allow anyone to name app tenants (a.k.a. spaces, teams, or instances) anything they like - including your company name. Attackers send invites to your employees from within the app with a customized message explaining why they should join this new tenant (or sign up to the app if they are not already a user). ",[],{},{"nodeType":243,"data":435,"content":436},{},[437],{"nodeType":247,"value":438,"marks":439,"data":440},"Attackers might even pay for premium licenses in the app to further entice employees to join. The attacker then waits for the employee to upload sensitive data or create integrations with other company apps containing crown jewels.",[],{},{"nodeType":355,"data":442,"content":443},{},[444],{"nodeType":247,"value":445,"marks":446,"data":447},"Living-off-the-(SaaS)-land to persist and avoid detection",[],{},{"nodeType":243,"data":449,"content":450},{},[451,455,464],{"nodeType":247,"value":452,"marks":453,"data":454},"In the endpoint world, a favorite technique is the use of legit OS utilities or ",[],{},{"nodeType":281,"data":456,"content":458},{"uri":457},"https://lolbas-project.github.io",[459],{"nodeType":247,"value":460,"marks":461,"data":463},"LOLBaS",[462],{"type":289},{},{"nodeType":247,"value":465,"marks":466,"data":467}," (Living-Off-the-Land Binaries and Scripts), which are often signed Microsoft utilities. Perhaps the most well-known example is executing scripts through PowerShell rather than building custom malware. That isn’t as useful these days but there was a time when PowerShell was routinely used to bypass AV, EDR, and even app allow-listing.",[],{},{"nodeType":243,"data":469,"content":470},{},[471,475,484],{"nodeType":247,"value":472,"marks":473,"data":474},"In that same living-off-the-land mindset, an attacker trying to maintain access to each SaaS app they compromise using custom OAuth integration apps, might instead choose to use legit SaaS apps that specialize in workflow automation to create ",[],{},{"nodeType":281,"data":476,"content":478},{"uri":477},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/shadow_workflows/description.md",[479],{"nodeType":247,"value":480,"marks":481,"data":483},"shadow workflows",[482],{"type":289},{},{"nodeType":247,"value":485,"marks":486,"data":487},". Utilizing legit SaaS apps also means they can hide in plain sight from incident responders, instead of having to rely on unverified or unpublished integrations.",[],{},{"nodeType":243,"data":489,"content":490},{},[491],{"nodeType":247,"value":492,"marks":493,"data":494},"Perhaps the best example here is using a well-known automation app like Zapier, which claims to have more than 5000 integrations. These integrations are often verified, approved, and connected to a trusted vendor (Zapier). An attacker might create workflows to:",[],{},{"nodeType":496,"data":497,"content":498},"unordered-list",{},[499,510,520],{"nodeType":500,"data":501,"content":502},"list-item",{},[503],{"nodeType":243,"data":504,"content":505},{},[506],{"nodeType":247,"value":507,"marks":508,"data":509},"do daily data exfiltration from a victim’s data lake",[],{},{"nodeType":500,"data":511,"content":512},{},[513],{"nodeType":243,"data":514,"content":515},{},[516],{"nodeType":247,"value":517,"marks":518,"data":519},"configure a webhook which adds malicious accounts to a github repo on demand",[],{},{"nodeType":500,"data":521,"content":522},{},[523],{"nodeType":243,"data":524,"content":525},{},[526],{"nodeType":247,"value":527,"marks":528,"data":529},"automatically find and replace bank account numbers in emails to the finance team",[],{},{"nodeType":243,"data":531,"content":532},{},[533],{"nodeType":247,"value":534,"marks":535,"data":536},"All appear as legitimate Zapier integrations. But, before you put in alerts specifically for Zapier, know that it’s one of dozens of apps that support these kinds of offensive workflows.",[],{},{"nodeType":243,"data":538,"content":539},{},[540,544,553],{"nodeType":247,"value":541,"marks":542,"data":543},"A sneaky attacker might go further and use an ",[],{},{"nodeType":281,"data":545,"content":547},{"uri":546},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/evil_twin_integrations/description.md",[548],{"nodeType":247,"value":549,"marks":550,"data":552},"evil twin integration",[551],{"type":289},{},{"nodeType":247,"value":554,"marks":555,"data":556}," to make another instance of an existing integration - making this backdoor almost impossible to discover.",[],{},{"nodeType":355,"data":558,"content":559},{},[560],{"nodeType":247,"value":561,"marks":562,"data":563},"Features or vulnerabilities?",[],{},{"nodeType":243,"data":565,"content":566},{},[567],{"nodeType":247,"value":568,"marks":569,"data":570},"When looking for attack techniques, you’re typically going after features that have weaknesses you can abuse rather than bugs in a single app that will be patched. ",[],{},{"nodeType":243,"data":572,"content":573},{},[574,578,587,590,599],{"nodeType":247,"value":575,"marks":576,"data":577},"It’s pretty common for SaaS apps to skip email verification or allow multiple simultaneous authentication methods. Both of these are conscious design choices in the name of lowering the friction of account creation and reducing customer support. However, these features make techniques like ",[],{},{"nodeType":281,"data":579,"content":581},{"uri":580},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/account_ambushing/description.md",[582],{"nodeType":247,"value":583,"marks":584,"data":586},"account ambushing",[585],{"type":289},{},{"nodeType":247,"value":318,"marks":588,"data":589},[],{},{"nodeType":281,"data":591,"content":593},{"uri":592},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/ghost_logins/description.md",[594],{"nodeType":247,"value":595,"marks":596,"data":598},"ghost logins",[597],{"type":289},{},{"nodeType":247,"value":600,"marks":601,"data":602}," possible. If these attacks become widespread, these might come to be seen more as bugs rather than a positive feature for users.",[],{},{"nodeType":243,"data":604,"content":605},{},[606,610,619],{"nodeType":247,"value":607,"marks":608,"data":609},"In other cases, the bugs are serious enough and hard enough to patch that they’re worth noting as a technique. The recently disclosed (and perfectly named) ",[],{},{"nodeType":281,"data":611,"content":613},{"uri":612},"https://www.descope.com/blog/post/noauth",[614],{"nodeType":247,"value":615,"marks":616,"data":618},"nOAuth",[617],{"type":289},{},{"nodeType":247,"value":620,"marks":621,"data":622}," bug fits this bill. ",[],{},{"nodeType":243,"data":624,"content":625},{},[626],{"nodeType":247,"value":627,"marks":628,"data":629},"The bug arises from a confusion between an email identity and email metadata field in Microsoft integrations and without a central fix from MS (the fix isn’t trivial), these bugs are likely to be discovered and re-occur on third-party OAuth apps for a while to come.",[],{},{"nodeType":259,"data":631,"content":632},{},[633],{"nodeType":247,"value":634,"marks":635,"data":636},"The SaaS market is driving these offensive techniques",[],{},{"nodeType":243,"data":638,"content":639},{},[640],{"nodeType":247,"value":641,"marks":642,"data":643},"SaaS apps are basically webapps that are run in the cloud and accessed from endpoints, so then WebApp, endpoint, and cloud security should cover all of SaaS, right? ",[],{},{"nodeType":243,"data":645,"content":646},{},[647],{"nodeType":247,"value":648,"marks":649,"data":650},"That was our assumption when we started, but what we found instead was that SaaS marketing  best practices are driving a lot of pretty interesting techniques that you don’t run into in standalone web apps.",[],{},{"nodeType":355,"data":652,"content":653},{},[654],{"nodeType":247,"value":655,"marks":656,"data":657},"Modern SaaS is easy to adopt, easy to use, low friction, low cost, low overhead",[],{},{"nodeType":243,"data":659,"content":660},{},[661],{"nodeType":247,"value":662,"marks":663,"data":664},"Making apps easy to sign-up for and low effort to support means you need to make some interesting choices when it comes to designing account creation and recovery flows. ",[],{},{"nodeType":243,"data":666,"content":667},{},[668],{"nodeType":247,"value":669,"marks":670,"data":671},"Many apps allow users to sign into apps using multiple methods, easily invite collaborators (internal and external) and avoid any additional friction during the sign up process. ",[],{},{"nodeType":243,"data":673,"content":674},{},[675],{"nodeType":247,"value":676,"marks":677,"data":678},"For example, many apps avoid verifying new account email addresses. This is not laziness, these are conscious design choices - not driven by security clearly, but not accidents.",[],{},{"nodeType":355,"data":680,"content":681},{},[682],{"nodeType":247,"value":683,"marks":684,"data":685},"Modern SaaS is highly integrated",[],{},{"nodeType":243,"data":687,"content":688},{},[689],{"nodeType":247,"value":690,"marks":691,"data":692},"Most SaaS apps are trying to build app marketplaces or perform well in other app’s marketplaces (often both) and it’s rare these days to find apps that don’t integrate with other apps. ",[],{},{"nodeType":243,"data":694,"content":695},{},[696],{"nodeType":247,"value":697,"marks":698,"data":699},"OAuth has become the de facto standard protocol for doing this, and most users have become quite used to approving OAuth2.0 consent flows. These integrations have opened up lots of incredibly useful doors for attackers to persist access and move laterally across SaaS apps that few incident response teams have run into yet. These tokens don’t expire when you reset passwords, aren’t protected by MFA, and actions they performed are rarely logged. ",[],{},{"nodeType":243,"data":701,"content":702},{},[703],{"nodeType":247,"value":704,"marks":705,"data":706},"These are not bugs or oversights but rather a consequence of how these APIs are intended to be used (by machines, not human adversaries).",[],{},{"nodeType":259,"data":708,"content":709},{},[710],{"nodeType":247,"value":711,"marks":712,"data":713},"Problems with observing SaaS attacks ",[],{},{"nodeType":243,"data":715,"content":716},{},[717,721,727],{"nodeType":247,"value":718,"marks":719,"data":720},"This research begs one question above others - ",[],{},{"nodeType":247,"value":722,"marks":723,"data":726},"“Are we seeing these attacks in the wild?",[724],{"type":725},"italic",{},{"nodeType":247,"value":728,"marks":729,"data":730},"” ",[],{},{"nodeType":355,"data":732,"content":733},{},[734],{"nodeType":247,"value":735,"marks":736,"data":737},"Yes, definitely",[],{},{"nodeType":243,"data":739,"content":740},{},[741,745,754,757,766,770,779,783,792,796,805],{"nodeType":247,"value":742,"marks":743,"data":744},"For some of the better known techniques, like credential stuffing and email phishing, the answer is an easy yes. Stats from ",[],{},{"nodeType":281,"data":746,"content":748},{"uri":747},"https://www.microsoft.com/en-us/security/blog/2023/05/04/how-microsoft-can-help-you-go-passwordless-this-world-password-day/",[749],{"nodeType":247,"value":750,"marks":751,"data":753},"Microsoft (1,287 password attacks every second)",[752],{"type":289},{},{"nodeType":247,"value":318,"marks":755,"data":756},[],{},{"nodeType":281,"data":758,"content":760},{"uri":759},"https://auth0.com/blog/top-insights-from-our-2022-state-of-secure-identity-report/",[761],{"nodeType":247,"value":762,"marks":763,"data":765},"Auth0 (a third of their traffic is credential stuffing)",[764],{"type":289},{},{"nodeType":247,"value":767,"marks":768,"data":769}," speaks volumes. Other sources like the ",[],{},{"nodeType":281,"data":771,"content":773},{"uri":772},"https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2022/cyber-security-breaches-survey-2022",[774],{"nodeType":247,"value":775,"marks":776,"data":778},"NCSC's Cyber Security Breaches Survey 2022",[777],{"type":289},{},{"nodeType":247,"value":780,"marks":781,"data":782}," and the ",[],{},{"nodeType":281,"data":784,"content":786},{"uri":785},"https://www.verizon.com/business/resources/reports/dbir/",[787],{"nodeType":247,"value":788,"marks":789,"data":791},"Verizon 2023 Data Breach Investigations Report",[790],{"type":289},{},{"nodeType":247,"value":793,"marks":794,"data":795}," suggest that phishing is also a major cause of SaaS breaches. Anecdotal reports from colleagues in the Incident Response field suggest that malicious mail forwarding rules are seen a lot, something which is supported by the ",[],{},{"nodeType":281,"data":797,"content":799},{"uri":798},"https://expel.com/expel-quarterly-threat-report/",[800],{"nodeType":247,"value":801,"marks":802,"data":804},"Expel Quarterly Threat Report for Q1 2023",[803],{"type":289},{},{"nodeType":247,"value":806,"marks":807,"data":808}," (see page 6).",[],{},{"nodeType":243,"data":810,"content":811},{},[812],{"nodeType":247,"value":813,"marks":814,"data":815},"The takeaway is that the current focus for defenders should be to ensure users have good phishing-resistant account security in place - make sure you have basics like strong unique passwords and MFA in place across your entire SaaS estate.",[],{},{"nodeType":355,"data":817,"content":818},{},[819],{"nodeType":247,"value":820,"marks":821,"data":822},"For newer OAuth attacks it’s a lot less clear…",[],{},{"nodeType":243,"data":824,"content":825},{},[826,830,835,839,848],{"nodeType":247,"value":827,"marks":828,"data":829},"Other techniques like consent phishing, and have been discussed in some breach disclosures like the ",[],{},{"nodeType":247,"value":831,"marks":832,"data":834},"2020 Sans breach",[833],{"type":289},{},{"nodeType":247,"value":836,"marks":837,"data":838},". These OAuth techniques also pop up in the news (for example, the ",[],{},{"nodeType":281,"data":840,"content":842},{"uri":841},"https://www.bleepingcomputer.com/news/security/github-how-stolen-oauth-tokens-helped-breach-dozens-of-orgs/",[843],{"nodeType":247,"value":844,"marks":845,"data":847},"2022 Github/Heroku/Travis-CI breach",[846],{"type":289},{},{"nodeType":247,"value":849,"marks":850,"data":851}," where GitHub accounts were breached using stolen Heroku and Travis-CI OAuth tokens). ",[],{},{"nodeType":243,"data":853,"content":854},{},[855,859,864],{"nodeType":247,"value":856,"marks":857,"data":858},"That said, none of these techniques come up as frequently as their usefulness would suggest. This means one of two things: ",[],{},{"nodeType":247,"value":860,"marks":861,"data":863},"either attackers aren’t yet using them widely or they are and we aren’t detecting them",[862],{"type":725},{},{"nodeType":247,"value":865,"marks":866,"data":867},".",[],{},{"nodeType":243,"data":869,"content":870},{},[871],{"nodeType":247,"value":872,"marks":873,"data":874},"There is certainly a case to be made that attackers simply don’t need these newer techniques yet. Many organizations don’t have a way of discovering SaaS use in their organization yet, nevermind breached accounts, so new persistence techniques might be a bit more than necessary at the moment.",[],{},{"nodeType":355,"data":876,"content":877},{},[878],{"nodeType":247,"value":879,"marks":880,"data":881},"But would we know if it was happening?",[],{},{"nodeType":243,"data":883,"content":884},{},[885],{"nodeType":247,"value":886,"marks":887,"data":888},"On the other hand, there is certainly the possibility that these attacks are increasingly used, but are simply not being discovered. A strong argument in favor of this view is the difficulty in investigating these attacks. Very few SaaS apps provide enough logging capability to discover these attacks as a customer, this is true even for the biggest, most mature apps like Office 365 and Google Workspace unless you are on top license tiers. This is doubly true for attacks that use OAuth, with many apps providing no insight or details into actions made using OAuth-authenticated APIs. ",[],{},{"nodeType":243,"data":890,"content":891},{},[892,896,905,909,918],{"nodeType":247,"value":893,"marks":894,"data":895},"This suggests only the SaaS providers for these apps are really in a position to discover and investigate them. This does ring true when you consider that ",[],{},{"nodeType":281,"data":897,"content":899},{"uri":898},"https://blog.heroku.com/april-2022-incident-review",[900],{"nodeType":247,"value":901,"marks":902,"data":904},"Heroku",[903],{"type":289},{},{"nodeType":247,"value":906,"marks":907,"data":908}," relied heavily on Github during the investigation (and in one case even the detection of) their 2022 breaches, and the same  seems true for a similar breach affecting ",[],{},{"nodeType":281,"data":910,"content":912},{"uri":911},"https://circleci.com/blog/jan-4-2023-incident-report/",[913],{"nodeType":247,"value":914,"marks":915,"data":917},"CircleCI",[916],{"type":289},{},{"nodeType":247,"value":919,"marks":920,"data":921}," later that year. Github and CircleCI’s customers prompted the investigation after seeing strange behavior, but Github had access to the logs to investigate. It’s difficult to imagine that most or even many SaaS vendors have the resources or inclination to run these investigations effectively as GitHub appears to have.",[],{},{"nodeType":243,"data":923,"content":924},{},[925,929,939],{"nodeType":247,"value":926,"marks":927,"data":928},"So, are these attacks happening in the real world? My best guess is it’s a little bit of column A and a little bit of column B – there are likely not so many of these attacks happening yet, and when they do I suspect the vast majority go undetected. ",[],{},{"nodeType":281,"data":930,"content":932},{"uri":931},"https://www.youtube.com/watch?v=j95kNwZw8YY",[933],{"nodeType":247,"value":934,"marks":935,"data":938},"But that’s just like my opinion, man.",[936,937],{"type":289},{"type":725},{},{"nodeType":247,"value":29,"marks":940,"data":941},[],{},{"nodeType":243,"data":943,"content":944},{},[945],{"nodeType":247,"value":946,"marks":947,"data":948},"This is part of the reason we think enabling red-teamers to try these techniques in anger is useful - this is the time-proven way to understand these risks.",[],{},{"nodeType":259,"data":950,"content":951},{},[952],{"nodeType":247,"value":953,"marks":954,"data":955},"What’s next?",[],{},{"nodeType":243,"data":957,"content":958},{},[959],{"nodeType":247,"value":960,"marks":961,"data":962},"We’ve barely scratched the surface, but perhaps there is enough here to get the discussion going. From past experience, discussion may not be enough, and it’s likely that live offensive work like penetration tests or more likely red-team exercises will be required to make the risks of using these techniques real for the wider security community. ",[],{},{"nodeType":243,"data":964,"content":965},{},[966],{"nodeType":247,"value":967,"marks":968,"data":969},"After all, seeing is believing. We think some more practical examples and tools to help red- teamers use these techniques on engagements will help drive awareness forward so we’ll be looking to build out this content.",[],{},{"nodeType":243,"data":971,"content":972},{},[973,977,986],{"nodeType":247,"value":974,"marks":975,"data":976},"We’ve started with pure networkless attacks that don’t touch customer networks or endpoints, but there are many useful techniques to connect the old endpoint world to the SaaS world. Consider stealing OAuth tokens from a thick client on an endpoint, or using a ",[],{},{"nodeType":281,"data":978,"content":980},{"uri":979},"https://github.blog/2023-07-18-security-alert-social-engineering-campaign-targets-technology-industry-employees/",[981],{"nodeType":247,"value":982,"marks":983,"data":985},"backdoored github repo to get code execution on endpoints",[984],{"type":289},{},{"nodeType":247,"value":865,"marks":987,"data":988},[],{},{"nodeType":243,"data":990,"content":991},{},[992,996,1003],{"nodeType":247,"value":993,"marks":994,"data":995},"Help us all better understand how widespread these attacks are by sharing some war stories - blueteams, have you seen these attacks in IR investigations? Red-teamers, have tried these or similar techniques against SaaS? Even better, we’d love some comments, discussions, or PRs on ",[],{},{"nodeType":281,"data":997,"content":998},{"uri":283},[999],{"nodeType":247,"value":286,"marks":1000,"data":1002},[1001],{"type":289},{},{"nodeType":247,"value":1004,"marks":1005,"data":1006},"!",[],{},{"entries":1008},{"hyperlink":1009,"block":1010,"inline":1011},[],[],[],"json",{"items":1014},[],{},"Move faster than competitors by embracing SaaS","2023-04-21T00:00:00.000Z",{"items":1019},[1020,1359],{"__typename":1021,"sys":1022,"content":1024,"title":1337,"synopsis":1338,"hashTags":62,"publishedDate":1339,"slug":1340,"tagsCollection":1341,"authorsCollection":1351},"BlogPosts",{"id":1023},"2cLFeaDTWWdZ8G8U12qmiZ",{"json":1025},{"data":1026,"content":1027,"nodeType":239},{},[1028,1035,1042,1049,1056,1063,1070,1077,1084,1091,1098,1105,1129,1149,1156,1163,1170,1233,1257,1276,1283,1290,1297,1304,1311,1318],{"data":1029,"content":1030,"nodeType":259},{},[1031],{"data":1032,"marks":1033,"value":1034,"nodeType":247},{},[],"Prevention isn’t always the answer",{"data":1036,"content":1037,"nodeType":243},{},[1038],{"data":1039,"marks":1040,"value":1041,"nodeType":247},{},[],"As a security team, our job is to help our company achieve its goals by taking risks securely. Simply using a computer represents a risk over the more traditional pen and paper, but the productivity gains clearly outweigh the risk; so the security team ensures the business takes that risk securely. Outright prevention - i.e. not using a computer - in this case, makes no sense.",{"data":1043,"content":1044,"nodeType":243},{},[1045],{"data":1046,"marks":1047,"value":1048,"nodeType":247},{},[],"Of course, within how the computer operates we might choose to prevent some functionality in the name of security, but the principle remains the same - prevention usually requires a trade-off against productivity.",{"data":1050,"content":1051,"nodeType":259},{},[1052],{"data":1053,"marks":1054,"value":1055,"nodeType":247},{},[],"Detection, but at the cost of privacy",{"data":1057,"content":1058,"nodeType":243},{},[1059],{"data":1060,"marks":1061,"value":1062,"nodeType":247},{},[],"When a base level of security became more common (through better awareness, accessible knowledge, and sensible vendor defaults), attackers shifted to using techniques that couldn’t be prevented because the business relied on the underlying tools - a malicious Word doc, a sneaky PowerShell script, a dodgy PDF.",{"data":1064,"content":1065,"nodeType":243},{},[1066],{"data":1067,"marks":1068,"value":1069,"nodeType":247},{},[],"Now prevention wasn’t an option, the security team had to monitor usage for malicious activity. But monitoring comes at a cost. To detect when malicious activity happens, the security team needs to monitor all activity, including legitimate activity. So, while a detection approach doesn’t restrict what a user can do, it comes at the cost of their privacy.",{"data":1071,"content":1072,"nodeType":259},{},[1073],{"data":1074,"marks":1075,"value":1076,"nodeType":247},{},[],"Building trust with your users",{"data":1078,"content":1079,"nodeType":243},{},[1080],{"data":1081,"marks":1082,"value":1083,"nodeType":247},{},[],"In either case, when introducing security controls you should aim to justify and explain this decision to your users, remembering that security’s job is to help them do their jobs securely - it shouldn’t be for them to figure out how to do their jobs within the confines of what the security team has decided is OK. A security team should be more like the secret service, than the prison service.",{"data":1085,"content":1086,"nodeType":243},{},[1087],{"data":1088,"marks":1089,"value":1090,"nodeType":247},{},[],"Although, of course, many employees won’t have much interest in the motivations of their IT/security team, maintaining this attitude will help you build and keep trust with them. With trust in hand, employees will be less likely to try to work around your controls.",{"data":1092,"content":1093,"nodeType":259},{},[1094],{"data":1095,"marks":1096,"value":1097,"nodeType":247},{},[],"SaaS - the new frontier",{"data":1099,"content":1100,"nodeType":243},{},[1101],{"data":1102,"marks":1103,"value":1104,"nodeType":247},{},[],"In recent years, our computers are mostly just windows to the Internet - many users access their email, video conferencing, productivity suites and more via their browser (or Electron apps pretending they aren’t browsers).",{"data":1106,"content":1107,"nodeType":243},{},[1108,1112,1117,1121,1125],{"data":1109,"marks":1110,"value":1111,"nodeType":247},{},[],"And, as is often the way, we’re relearning the same lessons as before. Should employees be ",{"data":1113,"marks":1114,"value":1116,"nodeType":247},{},[1115],{"type":725},"allowed",{"data":1118,"marks":1119,"value":1120,"nodeType":247},{},[]," to sign up for and use arbitrary SaaS platforms? Should employees be ",{"data":1122,"marks":1123,"value":1116,"nodeType":247},{},[1124],{"type":725},{"data":1126,"marks":1127,"value":1128,"nodeType":247},{},[]," to add arbitrary apps into Microsoft 365, Google Workspace, or other SaaS platforms?",{"data":1130,"content":1131,"nodeType":243},{},[1132,1136,1145],{"data":1133,"marks":1134,"value":1135,"nodeType":247},{},[],"Regardless of your answer, your coworkers have already spoken and it’s almost certainly already happening. A ",{"data":1137,"content":1139,"nodeType":281},{"uri":1138},"https://track.g2.com/resources/shadow-it-statistics",[1140],{"data":1141,"marks":1142,"value":1144,"nodeType":247},{},[1143],{"type":289},"report from G2",{"data":1146,"marks":1147,"value":1148,"nodeType":247},{},[]," stated that 80% of workers admit to using SaaS applications at work without getting approval from IT. If you want to enable your colleagues’ productivity, prevention, it would seem, isn’t an option.",{"data":1150,"content":1151,"nodeType":259},{},[1152],{"data":1153,"marks":1154,"value":1155,"nodeType":247},{},[],"The risks of SaaS",{"data":1157,"content":1158,"nodeType":243},{},[1159],{"data":1160,"marks":1161,"value":1162,"nodeType":247},{},[],"So how do we secure the company in this new way of working? We still have plenty to consider.",{"data":1164,"content":1165,"nodeType":243},{},[1166],{"data":1167,"marks":1168,"value":1169,"nodeType":247},{},[],"We can start thinking about SaaS not just as an allow or not to allow, but taking a more flexible and pragmatic approach, asking questions like::",{"data":1171,"content":1172,"nodeType":496},{},[1173,1183,1193,1203,1213,1223],{"data":1174,"content":1175,"nodeType":500},{},[1176],{"data":1177,"content":1178,"nodeType":243},{},[1179],{"data":1180,"marks":1181,"value":1182,"nodeType":247},{},[],"What kind of data users are entering into these third-party platforms?",{"data":1184,"content":1185,"nodeType":500},{},[1186],{"data":1187,"content":1188,"nodeType":243},{},[1189],{"data":1190,"marks":1191,"value":1192,"nodeType":247},{},[],"How much do we trust the controls the third-party has in place?",{"data":1194,"content":1195,"nodeType":500},{},[1196],{"data":1197,"content":1198,"nodeType":243},{},[1199],{"data":1200,"marks":1201,"value":1202,"nodeType":247},{},[],"Are those controls appropriate for the data? ",{"data":1204,"content":1205,"nodeType":500},{},[1206],{"data":1207,"content":1208,"nodeType":243},{},[1209],{"data":1210,"marks":1211,"value":1212,"nodeType":247},{},[],"Is this platform redundant with the other services we use (e.g. “we use Google Drive, not Dropbox”)? ",{"data":1214,"content":1215,"nodeType":500},{},[1216],{"data":1217,"content":1218,"nodeType":243},{},[1219],{"data":1220,"marks":1221,"value":1222,"nodeType":247},{},[],"Does IT or security need to manage accounts for joiners/leavers?",{"data":1224,"content":1225,"nodeType":500},{},[1226],{"data":1227,"content":1228,"nodeType":243},{},[1229],{"data":1230,"marks":1231,"value":1232,"nodeType":247},{},[],"Does this platform impact our compliance? (e.g. does storing this data on this platform compromise our GDPR status?)",{"data":1234,"content":1235,"nodeType":243},{},[1236,1240,1253],{"data":1237,"marks":1238,"value":1239,"nodeType":247},{},[],"No one said it would be easy 🙃 and it’s easy to see why many organizations initially opt to simply try to block users from using such systems. Assessing each application can be daunting using traditional third-party security assessment techniques - we’ve written a ",{"data":1241,"content":1247,"nodeType":1252},{"target":1242},{"sys":1243},{"id":1244,"type":1245,"linkType":1246},"3PqX7fLrTIYhWjbEhHSRHG","Link","Entry",[1248],{"data":1249,"marks":1250,"value":1251,"nodeType":247},{},[],"short guide","entry-hyperlink",{"data":1254,"marks":1255,"value":1256,"nodeType":247},{},[]," on how to approach security auditing in a world of SaaS, which you might find useful.",{"data":1258,"content":1259,"nodeType":243},{},[1260,1264,1272],{"data":1261,"marks":1262,"value":1263,"nodeType":247},{},[],"But the first step in managing this new world is through visibility. Knowing the problem is half the battle and we published ",{"data":1265,"content":1267,"nodeType":281},{"uri":1266},"https://pushsecurity.com/blog/rolling-your-own-saas-discovery/",[1268],{"data":1269,"marks":1270,"value":1271,"nodeType":247},{},[],"an article",{"data":1273,"marks":1274,"value":1275,"nodeType":247},{},[]," about how to manually find the SaaS apps your employees are using. The problem is, a lot of them are either error-prone or quite invasive, potentially collecting your users private activity. In the trade-off of security versus privacy, we think that’s a bit too far and will likely damage the trust you’ve built with your coworkers.",{"data":1277,"content":1278,"nodeType":259},{},[1279],{"data":1280,"marks":1281,"value":1282,"nodeType":247},{},[],"Monitoring SaaS use without compromising privacy",{"data":1284,"content":1285,"nodeType":243},{},[1286],{"data":1287,"marks":1288,"value":1289,"nodeType":247},{},[],"Our approach at Push is to deploy our browser extension to our users’ browsers which is configured with the domains we use for work (e.g. @pushsecurity.com). The browser extension only monitors logins where an @pushsecurity.com email address is used, which we can reasonably assume means the platform is being used for work reasons.",{"data":1291,"content":1292,"nodeType":243},{},[1293],{"data":1294,"marks":1295,"value":1296,"nodeType":247},{},[],"We share this with employees up front during the onboarding process and, if you click on the browser extension, it also lets you know which domains it’s monitoring:",{"data":1298,"content":1302,"nodeType":1303},{"target":1299},{"sys":1300},{"id":1301,"type":1245,"linkType":1246},"6z1apzuDIaXXN7xIAHEUku",[],"embedded-entry-block",{"data":1305,"content":1306,"nodeType":243},{},[1307],{"data":1308,"marks":1309,"value":1310,"nodeType":247},{},[],"This helps our users understand why we are monitoring which SaaS they’re using which in turn makes them aware of the risk we are managing and why.",{"data":1312,"content":1313,"nodeType":243},{},[1314],{"data":1315,"marks":1316,"value":1317,"nodeType":247},{},[],"With this approach we’ve built a comprehensive picture of which SaaS platforms our team is using which has helped us understand where our data lives and which platforms need extra attention to ensure we have all the right controls in place. When our users use a new platform we can reach out to them at the start of their journey to understand what they’re trying to achieve and how we can help them do it securely.",{"data":1319,"content":1320,"nodeType":243},{},[1321,1324,1333],{"data":1322,"marks":1323,"value":29,"nodeType":247},{},[],{"data":1325,"content":1327,"nodeType":281},{"uri":1326},"https://pushsecurity.com/features/saas-discovery",[1328],{"data":1329,"marks":1330,"value":1332,"nodeType":247},{},[1331],{"type":289},"Learn more about how Push can discover SaaS apps your employees are using",{"data":1334,"marks":1335,"value":1336,"nodeType":247},{},[]," without compromising their privacy. ","How to discover SaaS use without invading employee privacy","Learn how to manage SaaS in a way that keeps employees productive and doesn't compromise privacy.","2022-08-22T00:00:00.000Z","how-to-discover-saas-use-without-invading-employee-privacy",{"items":1342},[1343,1347],{"sys":1344,"name":1346},{"id":1345},"3SA5H01UkKauuiTdt0KC6q","Shadow IT",{"sys":1348,"name":1350},{"id":1349},"1gZi8NrRy2v9OqPV7C4dwD","Risk management",{"items":1352},[1353],{"fullName":1354,"firstName":1355,"jobTitle":1356,"profilePicture":1357},"Andy Waugh","Andy","VP Product",{"url":1358},"https://images.ctfassets.net/y1cdw1ablpvd/3Rf76rJn6S9inMb4dUnAIJ/0a787f8141d05b95300e2fe77c4493fa/DSC_6868.jpg",{"__typename":1021,"sys":1360,"content":1362,"title":1692,"synopsis":1693,"hashTags":62,"publishedDate":1694,"slug":1695,"tagsCollection":1696,"authorsCollection":1702},{"id":1361},"4LOMe7ez5adQtwbPireIBc",{"json":1363},{"data":1364,"content":1365,"nodeType":239},{},[1366,1373,1394,1401,1408,1415,1422,1429,1436,1443,1450,1457,1464,1471,1478,1494,1501,1508,1515,1522,1529,1536,1555,1562,1569,1576,1583,1590,1599,1632,1640,1673],{"data":1367,"content":1368,"nodeType":243},{},[1369],{"data":1370,"marks":1371,"value":1372,"nodeType":247},{},[],"As part of your larger cloud security strategy, you’ve likely been asked to focus on how to secure SaaS apps used in your company. The first step to securing SaaS is getting a real sense of what platforms employees are actually using, beyond those that you already know about. Since SaaS is so easy for employees to adopt and start using without any input from IT and security, they’re likely using hundreds of SaaS apps that aren’t even on your radar. The first step in securing something is getting full visibility into what you even need to secure in the first place. ",{"data":1374,"content":1375,"nodeType":243},{},[1376,1380,1390],{"data":1377,"marks":1378,"value":1379,"nodeType":247},{},[],"To help guide folks through how you might do SaaS discovery on your own, we wrote an ",{"data":1381,"content":1385,"nodeType":1252},{"target":1382},{"sys":1383},{"id":1384,"type":1245,"linkType":1246},"45iZ69EdPF4629gZ6yf7p5",[1386],{"data":1387,"marks":1388,"value":1389,"nodeType":247},{},[],"article",{"data":1391,"marks":1392,"value":1393,"nodeType":247},{},[]," about how to manually find what apps employees are using. In it, we explored how to analyze data that you already have on hand to find the unknown apps (shadow IT) used within your business. That’s a pretty significant manual effort, though, and most security teams don’t have the resources to do it. Plus, while these manual attempts can chip away at the SaaS discovery process, none are great at giving you a comprehensive view of SaaS use, nor do they keep up with the constant influx of apps employees are signing up for daily. ",{"data":1395,"content":1396,"nodeType":243},{},[1397],{"data":1398,"marks":1399,"value":1400,"nodeType":247},{},[],"To get truly broad coverage of what SaaS employees are using, you need a large dataset of SaaS apps, the domains associated with them, and this dataset must constantly be updated and expanded to include new apps that are launched every day. ",{"data":1402,"content":1403,"nodeType":243},{},[1404],{"data":1405,"marks":1406,"value":1407,"nodeType":247},{},[],"Unless you can find such a dataset, you must create it. And creating a constantly updated dataset is no small undertaking. That’s why there are so many off-the-shelf solutions and tools that focus solely on SaaS discovery these days. Many say that they are full-scale SaaS security platforms, but what that means isn’t always clear, even after reading product marketing materials. If you were to look at a venn diagram of “SaaS security platforms,” you’d have a giant mess of interlocking circles, with some shared activities amongst all (or most) tools and then vastly different features from that core functionality.",{"data":1409,"content":1410,"nodeType":243},{},[1411],{"data":1412,"marks":1413,"value":1414,"nodeType":247},{},[],"How “good” they are at SaaS discovery really depends on what data they’re using, what they have access to within your environment, the quality of their proprietary datasets (breadth, depth, and timeliness of that data), and how they work with your existing data and tools. To help navigate this mess, we’re sharing some pros and cons of the categories of commercial tools on the market.",{"data":1416,"content":1417,"nodeType":243},{},[1418],{"data":1419,"marks":1420,"value":1421,"nodeType":247},{},[],"To determine which solution you need, you need to consider your tech stack, your specific needs, your risk tolerance, and your short and long term objectives. In this article, we’ll break down some major use cases and match them up with what solutions make the most sense to address them.",{"data":1423,"content":1424,"nodeType":355},{},[1425],{"data":1426,"marks":1427,"value":1428,"nodeType":247},{},[],"You’re a large enterprise interested in securing core SaaS platforms",{"data":1430,"content":1431,"nodeType":243},{},[1432],{"data":1433,"marks":1434,"value":1435,"nodeType":247},{},[],"\nWorking to only secure 20 or so core applications that have already been sanctioned by the security team? A cloud security posture management (CSPM) or SaaS security posture management (SSPM) solution might be the answer you’re looking for, particularly if you’re on the highest tier license for those apps. ",{"data":1437,"content":1438,"nodeType":243},{},[1439],{"data":1440,"marks":1441,"value":1442,"nodeType":247},{},[],"You can make the most of these tools during in-depth investigations or threat hunting exercises. Leverage them to enforce custom SaaS or cloud app policies as well. The caveat with this one is that you’ll need a fairly sophisticated security team to manage, customize, and run SSPM and CSPM tools.",{"data":1444,"content":1445,"nodeType":243},{},[1446],{"data":1447,"marks":1448,"value":1449,"nodeType":247},{},[],"An ideal environment for these solutions is one that has a full SOC capability so that you extend your existing security monitoring and threat hunting coverage into these core SaaS platforms. You’ll be able to secure a small handful of your business critical applications as long as they’re large and well-established platforms. ",{"data":1451,"content":1452,"nodeType":243},{},[1453],{"data":1454,"marks":1455,"value":1456,"nodeType":247},{},[],"The reason you’ll need top-level licenses and well-established SaaS platforms to make these solutions work is because they rely on API data from those SaaS platforms. Those mature APIs provide necessary information about those core apps that CSPMs and SSPMs use to provide security insights you need to manage the risks. Unfortunately, they won’t cover the dozens of smaller SaaS apps most organizations use, and are normally only available on top license tiers.",{"data":1458,"content":1459,"nodeType":355},{},[1460],{"data":1461,"marks":1462,"value":1463,"nodeType":247},{},[],"You’re a more traditional, on-prem enterprise interested in blocking unsanctioned SaaS",{"data":1465,"content":1466,"nodeType":243},{},[1467],{"data":1468,"marks":1469,"value":1470,"nodeType":247},{},[],"If your environment is traditional on-site internal networks and you have mature gateway monitoring technology in place already, a cloud access security broker (CASB) may be your best path to securing cloud apps. CASBs work best if you have no employees working from home or on the road or you’re forcing employees to only access work platforms and internet browsers through your corporate VPN.",{"data":1472,"content":1473,"nodeType":243},{},[1474],{"data":1475,"marks":1476,"value":1477,"nodeType":247},{},[],"CASBs typically pull network data such as DNS, SASE, VPN, proxy, and firewall logs. They may also require that you install an agent on each employees’ devices if you want coverage when they are out of the office. ",{"data":1479,"content":1480,"nodeType":243},{},[1481,1485,1490],{"data":1482,"marks":1483,"value":1484,"nodeType":247},{},[],"With those data sources, they provide good aggregate information about SaaS platforms that are accessed. What they ",{"data":1486,"marks":1487,"value":1489,"nodeType":247},{},[1488],{"type":725},"can’t do well",{"data":1491,"marks":1492,"value":1493,"nodeType":247},{},[]," is provide any insight into how the SaaS app is being used, by which employees (you typically get IP addresses not user names), and for what purpose - as an example, they are typically not able to tell the difference between opening a SaaS product’s homepage, or actually logging into the application - so you are going to have a fairly large number of false positives. ",{"data":1495,"content":1496,"nodeType":243},{},[1497],{"data":1498,"marks":1499,"value":1500,"nodeType":247},{},[],"A CASB also really makes sense if you’re forced into complying with strict regulatory requirements to block everything until you’re able to do an in-depth due diligence process on each app. If your goal (or need) is to block access to unknown, unvetted, or unsanctioned SaaS at the network level with no exceptions, a CASB might be for you.",{"data":1502,"content":1503,"nodeType":355},{},[1504],{"data":1505,"marks":1506,"value":1507,"nodeType":247},{},[],"You’re a cloud-native company who wants to enable SaaS without introducing too much risk",{"data":1509,"content":1510,"nodeType":243},{},[1511],{"data":1512,"marks":1513,"value":1514,"nodeType":247},{},[],"For cloud-native companies that need better coverage, and are looking for more nuanced controls than network-level blocking, a solution that discovers and secures SaaS through the browser is the way to go. Since employees access SaaS through their browser, it’s a logical step to collect data about who is using what apps through a browser extension. ",{"data":1516,"content":1517,"nodeType":243},{},[1518],{"data":1519,"marks":1520,"value":1521,"nodeType":247},{},[],"The browser approach lets you do true SaaS discovery - so you can find what employees are actually using (not just accessing) and then go about securing those apps. You also don’t need to do much in terms of managing a browser-based solution once it’s set up. It simply runs in the background and surfaces employee SaaS use data into a dashboard. ",{"data":1523,"content":1524,"nodeType":243},{},[1525],{"data":1526,"marks":1527,"value":1528,"nodeType":247},{},[],"By combining browser-level data and robust security APIs from those core business platforms that SSPMs typically tap into, you can get broad visibility of SaaS use in your company for those large in number, but less mature, more up-and-coming apps, and the depth of security data you need for those few core apps that most employees are using. ",{"data":1530,"content":1531,"nodeType":243},{},[1532],{"data":1533,"marks":1534,"value":1535,"nodeType":247},{},[],"The other key benefit of a browser-based approach for SaaS discovery is that you can get incredibly powerful data about who is using the app, how they’re using it, if they’re using security features such as MFA, if they’re reusing passwords across multiple apps, if they’re sharing passwords, when they’ve used it last, and so on. That data is critical when it comes to securing SaaS because the devil truly is in the details. ",{"data":1537,"content":1538,"nodeType":243},{},[1539,1543,1551],{"data":1540,"marks":1541,"value":1542,"nodeType":247},{},[],"If we’ve piqued your interest and you’re curious to see what we can discover about SaaS in your business, ",{"data":1544,"content":1546,"nodeType":281},{"uri":1545},"https://login.pushsecurity.com/",[1547],{"data":1548,"marks":1549,"value":1550,"nodeType":247},{},[],"try the free browser extension",{"data":1552,"marks":1553,"value":1554,"nodeType":247},{},[],". ",{"data":1556,"content":1557,"nodeType":355},{},[1558],{"data":1559,"marks":1560,"value":1561,"nodeType":247},{},[],"Consider their data sources  ",{"data":1563,"content":1564,"nodeType":243},{},[1565],{"data":1566,"marks":1567,"value":1568,"nodeType":247},{},[],"The critical thing to understand when you’re evaluating if a solution will work for you would be understanding what their data sources are, what weaknesses those data sources inherently have, and what aligns best with your goals. We’ve tried to surface some of that information within the use cases in this article.",{"data":1570,"content":1571,"nodeType":243},{},[1572],{"data":1573,"marks":1574,"value":1575,"nodeType":247},{},[],"So if you’re looking at an EDR that says they can discover SaaS usage, they’ll likely be leveraging endpoint data to detect SaaS use. If you’re looking at CASBs that integrate with your proxy, they’re probably looking at network level data – you get the idea.  ",{"data":1577,"content":1578,"nodeType":355},{},[1579],{"data":1580,"marks":1581,"value":1582,"nodeType":247},{},[],"Conclusion",{"data":1584,"content":1585,"nodeType":243},{},[1586],{"data":1587,"marks":1588,"value":1589,"nodeType":247},{},[],"To wrap this up, we’re going to summarize some key points and provide some questions to ask yourself, your team, or even the vendor of the solution you’re evaluating, as you consider what combination of efforts or what tool is right for you. ",{"data":1591,"content":1592,"nodeType":243},{},[1593],{"data":1594,"marks":1595,"value":1598,"nodeType":247},{},[1596],{"type":1597},"bold","Does this solution provide SaaS discovery?",{"data":1600,"content":1601,"nodeType":496},{},[1602,1612,1622],{"data":1603,"content":1604,"nodeType":500},{},[1605],{"data":1606,"content":1607,"nodeType":243},{},[1608],{"data":1609,"marks":1610,"value":1611,"nodeType":247},{},[],"Will this tool find what SaaS apps employees are using, including those you don’t already know about? If so, how? ",{"data":1613,"content":1614,"nodeType":500},{},[1615],{"data":1616,"content":1617,"nodeType":243},{},[1618],{"data":1619,"marks":1620,"value":1621,"nodeType":247},{},[],"Will the tool be able to differentiate between a user visiting a SaaS website, and actually logging into the app? How will it determine who the user is?",{"data":1623,"content":1624,"nodeType":500},{},[1625],{"data":1626,"content":1627,"nodeType":243},{},[1628],{"data":1629,"marks":1630,"value":1631,"nodeType":247},{},[],"If the tool doesn’t provide you with SaaS discovery (finding Shadow IT and the apps employees are using that aren’t on your radar), how will you deal with those apps employees are using without your knowledge?",{"data":1633,"content":1634,"nodeType":243},{},[1635],{"data":1636,"marks":1637,"value":1639,"nodeType":247},{},[1638],{"type":1597},"Does the tool provide enough context so you can manage SaaS risk?",{"data":1641,"content":1642,"nodeType":496},{},[1643,1653,1663],{"data":1644,"content":1645,"nodeType":500},{},[1646],{"data":1647,"content":1648,"nodeType":243},{},[1649],{"data":1650,"marks":1651,"value":1652,"nodeType":247},{},[],"Are you getting context about how your users are using apps (are they logging in with social logins or passwords, do they have MFA enabled, are they admins on the app, etc.), or is it only providing generic information about the app?",{"data":1654,"content":1655,"nodeType":500},{},[1656],{"data":1657,"content":1658,"nodeType":243},{},[1659],{"data":1660,"marks":1661,"value":1662,"nodeType":247},{},[],"How will you engage employees that already rely on these SaaS platforms, or want to adopt new apps, can you handle that though email or in-person - or do you need something more scalable?",{"data":1664,"content":1665,"nodeType":500},{},[1666],{"data":1667,"content":1668,"nodeType":243},{},[1669],{"data":1670,"marks":1671,"value":1672,"nodeType":247},{},[],"Do you need the ability to apply progressive controls, or simply need the ability to block apps entirely?",{"data":1674,"content":1675,"nodeType":243},{},[1676,1680,1688],{"data":1677,"marks":1678,"value":1679,"nodeType":247},{},[],"\nIf you aren’t sure about these questions, why not consider what a ",{"data":1681,"content":1683,"nodeType":281},{"uri":1682},"/product",[1684],{"data":1685,"marks":1686,"value":1687,"nodeType":247},{},[],"user-powered security approach",{"data":1689,"marks":1690,"value":1691,"nodeType":247},{},[]," might look like for your organization.","How to find the right SaaS security solution for your organization ","In this guide, we’ll break down some major SaaS use cases and match them up with solutions that can address them, covering pros and cons for each.\n","2022-07-25T00:00:00.000Z","how-to-find-the-right-saas-security-solution-for-your-organization",{"items":1697},[1698,1700],{"sys":1699,"name":1346},{"id":1345},{"sys":1701,"name":1350},{"id":1349},{"items":1703},[1704],{"fullName":1705,"firstName":1706,"jobTitle":1707,"profilePicture":1708},"Jacques Louw","Jacques","Co-founder / CRO",{"url":1709},"https://images.ctfassets.net/y1cdw1ablpvd/39m8bektV23lnCRcEq0G8h/2a08f6276a50744f1a4b499b273f6bb2/Push_Founders_at_Cahoots_October_28_2022_by_Doug_Coombe-21.jpg","embrace-saas-to-move-faster-than-your-competitors","blog/embrace-saas-to-move-faster-than-your-competitors",{"json":1713},{"data":1714,"content":1715,"nodeType":239},{},[1716],{"data":1717,"content":1718,"nodeType":243},{},[1719],{"data":1720,"marks":1721,"value":1722,"nodeType":247},{},[],"One of the questions we hear all the time is, “Can’t I just block my employees from using SaaS that my team hasn’t already vetted and approved?” And the answer is “Yes, you can. You can certainly block the apps we find your employees using, but the real question is ‘Should you?’”","Look at enabling SaaS from a broader understanding of the business and not just the impact to security",{"id":1725,"publishedAt":1726},"6tC3Xqkq7kdTMOvqLMEafp","2025-04-28T18:09:28.631Z",{"items":1728},[1729,1731],{"sys":1730,"name":1346},{"id":1345},{"sys":1732,"name":1734},{"id":1733},"3pjES4THCIfSAwhGdNwBcy","Browser security","4wbmB8CwgJvW-XKP9IbryS5PtJAzkkq-etgLXe0nmLo",1784196720247]