SaaS security posture management (SSPM) is software that checks the settings, permissions and connected apps of the business software that a company rents, such as its CRM, email and HR system. Rented software of this kind is called SaaS (software as a service). Well-known examples include Salesforce, Microsoft 365 and Slack.
Every SaaS application has hundreds or thousands of settings. A large CRM has more than 2,000. Some settings decide who can see which records. Some decide whether people outside the company can log in. Some decide which other apps may read the data. One wrong setting can expose customer records to the whole internet. Under the shared responsibility model, the SaaS company secures its software, but the customer is responsible for its own settings.
SSPM connects to each SaaS application through the application's API, with read-only access. It reads the settings every day and compares them with a list of safe settings. It reports each change that makes the company less safe.
Here is a typical case. A lending company in Chennai keeps its loan applications in a CRM. It also runs a public website where customers can check the status of their application. SSPM finds four problems. First, the website's guest profile, which visitors use before they log in, can read every loan application record, because of one sharing setting. Second, 37 former employees still have CRM accounts that do not go through single sign-on (SSO). When the company closed their SSO accounts, these CRM accounts stayed open. Third, a sales executive has installed a free add-on that can read all CRM data. Fourth, an AI assistant connected last month can read and change every record, although it only needs to read support tickets. The team fixes the guest setting first, because anyone on the internet could use it.
The fourth problem is the newest kind. Companies now connect AI tools and AI agents to their SaaS data. An agent with access to everything can leak everything. The page on AI agent guardrails explains why an agent should get only the access it needs. SSPM now checks AI applications as well as ordinary SaaS. AI agent identity and security tools give each agent its own login and its own limits.
SSPM checks settings. A cloud access security broker (CASB) watches what users do inside the same apps. SaaS management tools find every app that staff use, and what each one costs. The findings of SSPM also go to compliance automation software, as evidence for auditors.