Valence Threat Labs - Collaborative SaaS Security Remediation blog

2023 SaaS Security Trends & Insights

Download the 2023 SaaS Security Trends & Insights infographic

Secure SaaS to SaaS Supply chain Today | Valence security

The 2023 Valence State of SaaS Security Report

The 2023 State of SaaS Security Report takes us through the rise of SaaS, to SaaS-based attacks, our own insights from our customers, and finally to our recommendations and predictions about where SaaS security is going.

Valence Security ThreatLabs Alert: Salesforce Risk

Valence Security ThreatLabs Alert: Brian Krebs from Krebs on Security has recently posted that numerous organizations, including banks and healthcare providers, are leaking sensitive info from public Salesforce Community websites due to misconfiguration.

CircleCI Says Hackers Stole Encryption Keys and Customers’ Secrets

CircleCI, a vendor specializing in CI/CD and DevOps tools, confirmed that some customer data was stolen in a data breach last month.

Cloudflare Hacked Following Okta Compromise

Discover how the Cloudflare breach, stemming from the Okta compromise, underscores the critical need for holistic risk management in SaaS applications.

The Latest Microsoft Midnight Blizzard Breach is a Wakeup Call for SaaS Security

Explore Microsoft's recent revelation on the Midnight Blizzard cyber attack, uncovering nation-state tactics, SaaS misconfigurations, and crucial lessons for enhancing your organization's cybersecurity.

The SaaS-to-SaaS Supply Chain Threat Landscape

Digital transformation and the democratization of IT has resulted in the rapid proliferation of unsanctioned integrations that place business critical SaaS apps at risk. This paper provides insights into what security teams should know about this challenge.

The Mailchimp Breach Is Just The Latest Supply Chain Attack

MailChimp, a leading email marketing firm, recently discovered that hackers had gained access to internal customer support and account management tools, which could be used to launch phishing attacks to steal customer data.

CircleCI, LastPass, Okta, and Slack: Cyberattackers Pivot to Target Core Enterprise Tool

Dark Reading contributing writer Robert Lemos discusses how threat actors are increasingly focusing on exploiting core enterprise services.

GitHub and Their Customers are the Latest Victims of Supply Chain Attacks

GitHub announces it had discovered that attackers had stolen OAuth user tokens issued to third-party vendors that were used to download private data repositories from dozens of GitHub customers.

The Most Overlooked Element in Most Organizations' Cybersecurity Strategy

Securing the adoption and use of non-human identities is probably the most overlooked element in most organizations' cybersecurity strategy today.

2023 SaaS Management Index Report

In the 2023 Zylo SaaS Management Index Report, researchers provide data, trends and actionable insights from their database of SaaS spend, license and usage data. The most notable of these findings–a staggering 69% of SaaS spend and 82% of SaaS apps by number are adopted and managed by individuals or business units, not IT.

Infographic: Major SaaS Security Breaches 2021-2022

Over the past two years, SaaS adoption has exploded, which has led to an increased frequency and magnitude of SaaS breaches and SaaS supply chain attacks. This infographic shows some of the most destructive recent exploits.

Verizon 2022 DBIR Report: Supply Chain Attacks at Record High

The Verizon 2022 Data Breach Investigation Report (DBIR) noted explosive growth in incidents related to partners and the supply chain.

2022 Shadow SaaS-to-SaaS Integration Report

This 2022 SaaS security rreport covers key trends and challenges organizations face when trying to gain visibility and control over the growing and fast-changing world of SaaS-to-SaaS third-party integrations – known as the SaaS mesh.

Contextualizing Supply Chain Risks In A SaaS Environment

As we grow more dependent on third-party SaaS applications, we must extend third-party vendor risk assessments from their security controls to how we use and interact with the third-party itself.

Three Security Take-aways From The LAPSUS$ Breach of Okta

Okta has denied that the hacker group LAPSUS$ breached their service and performed malicious exploits, while LAPSUS$ claims it has gathered significant Okta customer data over the past several months—enough for additional exploits.