What Are SSPM Tools?

Across our assessments, the SaaS findings that matter fall into three buckets, and the two best-known recent incidents map onto them cleanly.

In mid-2024 a financially motivated group Mandiant tracks as UNC5537 logged into Snowflake customer accounts using credentials stolen by infostealer malware, some dating back to 2020. Mandiant and Snowflake notified about 165 potentially exposed organizations. Mandiant found that at least 79.7% of the accounts used had prior credential exposure, and named three root causes: no MFA on the affected accounts, credentials that had not been rotated for years, and no network allow lists. Snowflake itself was not breached. CISA issued an alert on 3 June 2024, and Snowflake has since moved to block single-factor password sign-ins.

Every one of those three root causes is a setting.

In 2025 the attack shifted from passwords to tokens. An FBI FLASH alert of 12 September 2025 described two groups targeting Salesforce. One, UNC6040, phoned staff posing as IT support and talked them into approving a malicious connected app, often a modified Data Loader, which sidestepped MFA and bulk-exported records. The other, UNC6395, used stolen OAuth tokens from the Salesloft Drift chatbot integration to pull data from customers' Salesforce instances until Salesloft and Salesforce revoked all Drift tokens on 20 August 2025.

Your MFA can be perfect and a single "Allow" click, or an integration nobody remembers installing, still opens the door.

The third bucket is less dramatic and far more common: former contractors still active in Slack, a dozen people with global admin, Google Drive or SharePoint links set to "anyone with the link," a GitHub organization where anyone can install apps. The Verizon 2026 DBIR puts credential abuse in 39% of breaches and third-party involvement in 48%.

Before you look at any tool, open the admin console of the five apps that hold your customer data, source code or money. Every check below is built into products you already pay for. If you have not done these, an SSPM tool will only hand you a longer list of the same findings.

For Microsoft 365 and Google Workspace there is a better yardstick than vendor defaults. CISA's Secure Cloud Business Applications (SCuBA) project publishes secure configuration baselines for both suites, plus free open-source assessment tools (ScubaGear for Microsoft 365 and ScubaGoggles for Google Workspace) that produce a pass/fail report. Under Binding Operational Directive 25-01, issued in December 2024, US federal civilian agencies must apply the mandatory SCuBA policies, and CISA strongly recommends that every organization adopt them. It is the closest thing to a neutral, public SaaS baseline, and Canadian companies can use it just as easily.

Buyers often treat these as interchangeable. They are not. Some vendors will dispute our view.

One opinion that surprises people: under 100 staff, the most valuable SSPM feature is not configuration scanning. It is the inventory of third-party apps and OAuth grants on your core platforms, exactly the gap the Salesforce campaigns exploited. If a tool is weak there, keep your money. Our shadow AI guide covers the same discovery problem for AI tools.

You do not need an SSPM tool when:

SSPM also does not stop a user socially engineered into approving an app in real time, does not scan files for malware, and does not replace incident response. If a token is stolen today, you need a tested revoke-and-rotate plan, which our small business incident response guide covers.

This matters on both sides of the border. A misconfiguration that exposes personal information can trigger reporting under PIPEDA where there is a real risk of significant harm, a confidentiality incident register entry under Quebec Law 25, and US state breach notification duties. A configuration baseline is part of the safeguards regulators expect, so we treat it as part of data security and privacy work.

No. CSPM (cloud security posture management) checks infrastructure you build on AWS, Azure or Google Cloud: storage buckets, security groups, IAM roles. SSPM checks applications you subscribe to: Microsoft 365, Salesforce, Slack. Many SaaS companies need both.

It helps produce evidence for access and change controls, but SOC 2 does not require a tool. A documented quarterly review with screenshots satisfies most auditors at this size.

For a company with five to ten core apps, the 30-day steps above usually take an experienced admin two to four working days. Our Cybersecurity Baseline Assessment covers the same ground if you would rather have an outside view.

One named person, usually the head of IT or engineering, with executive oversight. If nobody has the time, a virtual CISO can own the baseline and quarterly review; our Crawling tier starts from $2,000 a month. See all options on our pricing page, or book a call and we will tell you honestly whether you need a tool yet.