Software as a service (SaaS)

NIST SP 800-145 defines SaaS as the capability to use the provider's applications running on a cloud infrastructure, accessible through a thin client such as a browser or through a program interface, where the consumer manages neither the infrastructure nor individual application capabilities, apart from limited user-specific configuration. Salesforce, founded in 1999, established the commercial pattern; Microsoft 365, Google Workspace and ServiceNow made it the default for business software. The defining architectural property is multi-tenancy, commonly described as silo (a dedicated stack per tenant), pool (shared compute and database, with every row carrying a tenant identifier enforced by query scoping or database row-level security) or a hybrid bridge model. In the pool model a single scoping bug becomes a cross-tenant data leak, which is why tenant isolation is the first thing to probe in a SaaS security assessment.

The customer's remaining controls are concentrated in identity and configuration. Authentication is federated to the organisation's identity provider via SAML 2.0 or OpenID Connect, accounts are provisioned and, crucially, deprovisioned via SCIM 2.0 (RFC 7643 and RFC 7644), and conditional access or MFA is enforced at the IdP. OAuth consent grants to third-party integrations are a separate and often unmanaged trust channel: a token granted to a connected app keeps working after a password reset and bypasses MFA. The 2024 wave of intrusions into Snowflake customer tenants worked with credentials harvested by infostealer malware against accounts that had no MFA; the provider's platform itself was not breached.

Hundreds of tenant settings drift over time, including external sharing ("anyone with the link"), guest access, mail forwarding rules and legacy authentication protocols; SaaS security posture management tools baseline and monitor them. Audit logging depends on licence tier and retention, and after the Storm-0558 intrusion in 2023 Microsoft broadened the logging available to standard customers. Providers generally protect against their own failures but not against customer-side deletion, malicious insiders or ransomware syncing encrypted files, so backup of SaaS data is usually a customer task. Exit requires data export in usable formats.

Under GDPR the SaaS provider is typically a processor; Art. 28(2) requires the controller's prior specific or general written authorisation for sub-processors, so the sub-processor list and change notifications belong in supplier management, together with data location and Chapter V transfer mechanisms. NIS2 Art. 21(2)(d) brings SaaS dependencies into supply chain security. SaaS differs from PaaS in that the customer brings no code, and from traditional managed hosting in that all customers run the same multi-tenant version on the provider's release schedule.