GenAI risks explained and how Adaptive Shield’s new GenAI risk management capabilities within its SSPM platform enable security teams to manage and control them
What is SaaS Security?
SaaS vendors invest heavily in security controls, providing organizations with the necessary tools to secure their SaaS environments. This investment, however, often leads to confusion regarding the responsibility for SaaS security and its core principles.
While SaaS apps are inherently secure, it’s important for organizations to understand the entire ‘shared responsibility’ model, including which security aspects the cloud provider is responsible for and which ones the organization must manage. Organizations are responsible for continuous monitoring and proper configuration.
The SaaS security attack surface has expanded significantly in recent years. This has necessitated focusing on key areas such as misconfiguration management, identity security for both human and non-human entities, and user device vulnerability management. Furthermore, it has also pushed organizations to implement Identity Threat Detection & Response (ITDR) to thwart cyber threats targeting identities. Today, the emergence of GenAI has introduced a new attack vector and heightened concerns for security teams.
Why are security teams so concerned about GenAI?
The revolutionary capabilities of GenAI are transforming productivity in today’s content-driven digital landscape. The introduction of ChatGPT sparked the widespread adoption of generative AI technology, with vendors swiftly integrating GenAI tools into SaaS applications. Recent launches of major GenAI products, including Microsoft 365 Copilot, GitHub Copilot, and Salesforce Einstein Copilot, empower users to effortlessly generate diverse content types, including text, videos, images, and code.
Before diving into why GenAI concerns SaaS security teams, we need to understand a key SaaS security challenge. SaaS app ownership typically resides outside IT/security departments, leaving the security team with limited visibility into configurations, users, third-party app integrations, and the use of Shadow AI apps. The diverse nature of each SaaS app further complicates security management, making it arduous for security teams to ensure comprehensive protection using traditional manual methods or CASBs.
Addressing this democratization of SaaS requires a new shift in security that empowers security teams to oversee the corporate SaaS stack collaboratively with app owners. The introduction of GenAI aggravates this core challenge of SaaS security, in which app owners not only have control over security settings but also have access to AI-driven features within these apps.
According to a recent PwC report, more than half of the companies surveyed (54%) have implemented GenAI in some areas of their business.
Risk from GenAI-enabled SaaS apps explained
The risks linked with adopting GenAI functionalities into company data and workflows are significant, primarily stemming from the extensive access permissions granted to corporate data. Employees often exhibit reliance and trust in these mechanisms, uploading sensitive information to these environments to automate time-consuming work without fully understanding the implications.
Any data, whether it be confidential intellectual property, sensitive customer information, or employee data, could inadvertently be accessed, stored, and used by a GenAI engine. For instance, in the case of Microsoft Copilot, the application can access all data accessible to a user in Microsoft 365, potentially leading to a serious “ca-SaaS-trophe”.
Shadow apps also pose a significant attack surface in the realm of GenAI. Organizations must be able to identify and regulate unsanctioned apps utilized by employees, as well as unsanctioned apps connected to sanctioned apps. AI-driven shadow apps can harbor malicious intent, house sensitive data, or possess high privileges while interfacing with applications containing confidential information.
This phenomenon raises concerns regarding data security and privacy. Without proper governance of these AI controls, organizations may be exposed to data leakage, breaches, and compliance violations.
Moreover, threat actors are leveraging AI capabilities to enhance their attack methods, leading to increased sophistication in identity-centric threats. Consequently, there is an accelerated urgency to implement robust threat detection and response mechanisms within the SaaS ecosystem.
If You Can’t Beat It, Join It (and Govern It)
Organizations are having trouble effectively controlling GenAI use, including the use of unauthorized applications. According to a recent study by Salesforce, more than half of GenAI adopters use unapproved tools at work. The research also found that despite the benefits GenAI offers, a lack of clearly defined policies around its use may be putting businesses at risk.
Recent measures, such as the U.S. Congress’s prohibition of Microsoft’s Copilot on government-issued PCs and comparable restrictions within the banking industry, highlight the immediate need to tackle these risks. In fact, the US government has taken the lead in defining new policies, recently directing agencies to appoint Chief AI officers.
The GenAI revolution is forcing organizations to develop AI policies and security strategies. Some organizations have banned the use of GenAI to protect themselves from unknown risks. However, as more SaaS applications introduce GenAI tools into their core platform, this approach will have a limited impact. Rather than hide from it, companies need to invest in AI security tools that enable the safe usage of these tools.
Getting GenAI under control with SSPM
The only realistic approach is to effectively manage the use of GenAI. This can only be done with a robust SaaS Security Posture Management (SSPM) solution that has deep visibility into the entire SaaS Stack. To understand the full SSPM capabilities and features, download this checklist.
Adaptive Shield’s SSPM Capabilities for Managing GenAI Risks
To address the GenAI challenge within the SaaS ecosystem, Adaptive Shield has developed new GenAI Security Posture Management capabilities in our SSPM & ITDR platform. Now, our customers will be able to adopt GenAI safely while strictly managing its risks.
Key capabilities include:
- Security Posture for AI Apps: Delve into the security posture of any AI application within the SaaS stack and prioritize addressing application configuration drifts. Adaptive Shield provides a security score for each application, enabling security teams to pinpoint those with heightened risk levels. This includes:
- Hygiene/risk score based on the number of security checks passed, weighted by severity.
- Detailed security checks, filterable by domain, severity, or compliance framework. This entails step-by-step guidance and remediation cycles through any ticketing system or SIEM/SOAR.
- Risk management pertaining to the relationship between user devices and their access to the SaaS app.
- AI Configurations: Control AI-related security settings within SaaS applications to prevent data leakage or any exposure. This includes identifying excessive user access and determining which users possess permissions to manage GenAI features.
- Discovery and Management of AI Shadow Apps: Identify AI Shadow apps, including suspected malicious applications, to automatically revoke access based on their risk level.
- Management of 3rd Party Longtail AI-Sanctioned Apps: Oversee interconnected GenAI applications and the level of risk they pose to the SaaS hubs, including reviewing permission scopes.
- Secure Homegrown Applications: Shield homegrown GenAI-driven applications, restricting access and configuring them securely.
- Data Management to Maintain Data Silos: AI potentially accesses sensitive data in a more sophisticated and comprehensive manner than traditional methods. The ability of AI to analyze and correlate information from multiple sources could lead to a more extensive data exposure. With Adaptive Shield you can govern security controls to avoid data leakage.
Getting a view of every connected AI-enabled app and measuring its security posture for risks that could undermine SaaS security will empower organizations to prevent, detect, and respond to new and evolving threats while enjoying the benefits that come from GenAI.
Request a demo to see how Adaptive Shield can help you adopt GenAI securely
About the writer
