Let's face it: SaaS security was difficult before AI entered the picture.
Most organizations have hundreds or thousands of SaaS applications, sprawling integrations, OAuth grants, service accounts and third-party connections. For years, SaaS security efforts asked familiar questions: Who has access? Is the application configured securely? Where is sensitive data stored? Which third parties are connected?
Those questions still need answers, but the intersection of AI and SaaS security adds a new dimension. Most important, what can the application do on the user's behalf?
AI is changing how SaaS platforms use data, how identities behave and, increasingly, who or what is allowed to take action.
SaaS ripe for exploitation
Copilots and assistants are rapidly becoming agents that can read documents, query business systems, create tickets, send messages, modify records and invoke APIs. In effect, SaaS is becoming an execution environment for AI. An identity that once allowed a person to view a CRM record might now be inherited by an agent capable of processing thousands of records or acting across several connected applications. That dramatically changes the potential blast radius of excessive privilege.
The other major shift is visibility. Security teams could approve a SaaS platform and believe they understand its risk profile, only to have the vendor introduce generative AI features, new model integrations or agentic capabilities through a routine product update. The distinction between "approved SaaS'" and "approved AI" is therefore disappearing.
AI and SaaS security is fueling several emerging risks, among them:
- Nonhuman identities multiply. AI agents depend on service accounts, API tokens, OAuth grants, keys and machine identities. These identities can be long-lived, poorly inventoried and granted privileges that exceed what the agent actually needs.
- Shadow AI becomes part of shadow SaaS. Employees can paste sensitive data into consumer AI services, connect personal AI accounts to enterprise applications or enable AI plugins without security review. Just as importantly, sanctioned SaaS applications can quietly add AI capabilities that change their risk profile.
- Agents are over-permissioned. The easiest deployment model is often to let an AI agent inherit a user's permissions. That is convenient, but dangerous. Compromise or manipulation of the agent can turn ordinary access into automated, high-speed misuse.
- Prompt injection creates a new control problem. Malicious content in documents, email, websites or SaaS records can influence an agent and potentially cause it to expose information or invoke connected tools in unintended ways.
- AI-enabled attacks increase speed and scale. Attackers can use AI to accelerate reconnaissance, phishing, credential abuse, vulnerability exploitation and analysis of stolen SaaS data. Defenders should assume the time between initial access and meaningful abuse will continue to shrink.
- The AI supply chain expands. Models, plugins, agent skills, APIs, Model Context Protocol servers, open source components and third-party data sources create dependencies that traditional SaaS vendor assessments might not cover.
Updating SaaS security for the AI age
Cybersecurity leaders need to adjust their programs to address these risks. Consider these steps:
- Expand SaaS discovery into AI discovery. Inventory not only applications, but also embedded AI features, agents, model connections, OAuth integrations and the nonhuman identities supporting them. SaaS security posture management, cloud access security brokers, security service edge, data security posture management and emerging AI security posture management capabilities can all contribute, but no single tool will provide a complete picture.
- Apply least privilege. Restrict privileges for agents as aggressively as you would to administrators. Give agents dedicated identities where possible, narrow scopes, short-lived credentials and require explicit approval for high-impact actions. An agent that summarizes a document should not automatically have permission to delete it, share it externally or modify the underlying repository.
- Put data controls around AI interactions. Classify which data can be sent to which models, monitor uploads and prompts where practical, and prevent sensitive information from flowing into unapproved services. Upgrade existing data loss prevention and SaaS controls to recognize AI-specific workflows rather than assuming browser access to an approved application is inherently safe.
- Make AI behavior observable. Log agent actions, tool calls, identity use and data access, and feed meaningful events into security operations. For higher-risk use cases, test agents for prompt injection, excessive agency, data leakage and unsafe tool use before deployment and periodically afterward.
For most organizations, it would be a mistake to create an entirely separate AI security program that's disconnected from SaaS, identity, data and cloud security. AI is now a capability embedded across all of these areas. CISOs should instead extend existing governance models so every AI-enabled SaaS offering has an owner, a data classification, an identity and permission model, logging requirements and a defined level of acceptable autonomy.
There's no stopping employees and teams from using AI. The CISO's goal is to make sanctioned AI easier to use safely than unsanctioned AI, while keeping autonomous actions proportional to business risk. The combination of AI and SaaS security ultimately comes down to visibility, identity, data and control -- familiar security principles applied to systems that can now act at machine speed.
Dave Shackleford is founder and principal consultant at Voodoo Security, as well as a SANS analyst, instructor and course author, and GIAC technical director.
