The Shadowy Side of SaaS and AI: How Sprawl Is Threatening Businesses and Investors
The rapid adoption of generative AI (genAI) in early 2023 has left many companies grappling with unforeseen security and privacy risks. Incidents like JPMorgan Chase, Verizon, and Samsung banning the use of ChatGPT after employee data breaches highlighted the dangers of unchecked genAI integration. Cisco’s 2024 Data Privacy Benchmark study reveals that over 25% of organizations have outright banned genAI due to these concerns. While the potential of genAI is undeniable, the unmanaged adoption of new technologies, particularly in the realm of Software-as-a-Service (SaaS) and AI, has created a new era of “sprawl” with significant financial and security implications. As investors, understanding this new landscape is crucial for navigating the risks and rewards of a rapidly evolving technological environment.
Key Takeaways:
- Unchecked SaaS and AI adoption has led to "sprawl," a phenomenon where companies struggle to manage a rapidly growing number of applications and their associated risks.
- SaaS sprawl and Shadow IT are major contributors to this trend, with the pandemic accelerating the adoption of digital tools and the emergence of Shadow AI.
- This sprawl creates significant financial burdens and security vulnerabilities, potentially leading to data breaches, regulatory penalties, and operational disruptions.
- Cybersecurity innovations are offering solutions to manage and secure this expanding landscape, helping companies mitigate risks and reap the benefits of tech adoption.
- Investors should carefully assess the SaaS and AI security posture of companies they invest in, looking for evidence of strong IT governance, proactive cybersecurity measures, and partnerships with security solution providers.
The Rise of SaaS and Its Unforeseen Consequences
The rise of SaaS has revolutionized the way businesses operate, offering cost-effective access to a wide range of applications and services. Companies can easily onboard new tools and scale services to meet their needs, and employees benefit from the global accessibility of these applications. This convenience has, however, come with a cost. The relentless adoption of new SaaS tools has resulted in SaaS sprawl, a phenomenon where companies struggle to track, manage, and secure the ever-expanding list of applications within their environment.
Okta’s 2023 report highlights the scale of this issue: large companies with 2,000+ employees are using an average of 231 applications, a 10% increase from the previous year. This uncontrolled proliferation of applications poses two critical problems:
SaaS Sprawl and Shadow IT
SaaS sprawl arises from the uncontrolled use of SaaS subscriptions and applications within an organization. Shadow IT plays a significant role in this trend, referring to the unauthorized use of applications outside of IT and security approval processes. Often, employees choose to use personal accounts or tools without informing their IT departments, creating blind spots for security and governance.
The COVID-19 pandemic significantly accelerated this trend as companies rapidly digitized their operations to accommodate remote work and increased digital demand. This shift resulted in a surge of new applications and a decline in traditional IT oversight.
The Addition of AI Sprawl: A New Frontier
The emergence of genAI applications has further amplified the problem of sprawl. These AI-powered tools offer significant efficiency gains and opportunities for innovation, leading companies to embrace them enthusiastically. However, this rapid adoption has created a new layer of complexity, with companies now facing the challenge of managing AI sprawl and Shadow AI.
Navigating the Risks of Sprawl
The consequences of SaaS and AI sprawl are far-reaching, impacting companies’ financial stability, operational efficiency, and security posture. Here’s a closer look at the challenges companies face:
Financial Burden & Inefficiencies
Redundant or unnecessary applications contribute to a significant financial burden for companies. A report from Zylo found that companies with 5,001-10,000 employees spent $41.7 million per year on SaaS applications and wasted an additional $16.8 million. This figure further ballooned for larger companies, with those with 10,001+ employees spending $264.2 million and wasting $126.9 million annually.
Beyond direct financial costs, sprawl creates inefficiencies as teams become isolated from each other while using different applications, hampering collaboration and making it challenging for companies to make informed business decisions based on complete data.
Security Risks & Data Breaches
The security risks posed by sprawl are multifaceted and significant:
- Third-party vulnerabilities: Each new application introduces a third-party provider, creating additional avenues for attackers to exploit vulnerabilities in the software supply chain.
- Shadow IT & AI: The blind spots created by Shadow IT and Shadow AI make it extremely difficult for companies to assess and secure these applications.
- Data leakage: The proliferation of applications can increase the risk of data leakage, as companies struggle to monitor and control data access across multiple platforms.
- Prompt injection and data poisoning: These new threats target AI models, potentially compromising their integrity and output.
- Increased attack surface: Overall, sprawl increases the attack surface, making it easier for attackers to find and exploit vulnerabilities.
This culmination of risks can lead to damaging cyber incidents, including data breaches, operational disruptions, and regulatory penalties. The financial impact of such incidents can be devastating, jeopardizing brand reputation, customer trust, and the company’s overall profitability.
Leveraging Cybersecurity Innovations to Counter Sprawl
The challenges of SaaS and AI sprawl are not insurmountable. Cutting-edge cybersecurity solutions are emerging to equip companies with the tools needed to manage and secure their expanding digital footprint.
SaaS Security Solutions: A New Wave of Protection
Companies like Nudge Security are developing innovative solutions to address the challenges of SaaS and AI sprawl. Nudge Security’s platform leverages a patented application discovery capability to provide companies with comprehensive visibility into their SaaS and AI enabled applications.
This visibility enables organizations to:
- Securely on-board and off-board applications: Nudge Security’s platform allows companies to manage application usage, ensuring that they are properly vetted, secure, and compliant.
- Monitor third-party software breaches: The platform proactively monitors third-party providers, alerting companies to potential risks and enabling rapid responses.
- Implement strong governance policies: Nudge Security helps organizations establish clear policies for application usage, ensuring that security remains a top priority.
By empowering IT and security teams to proactively manage their applications, Nudge Security helps companies:
- Cut costs associated with unnecessary or redundant subscriptions.
- Reduce the risk of data breaches and other security incidents.
- Ensure compliance with regulations like GDPR.
The Importance of Software Supply Chain Security
The prevalence of malicious software in the software supply chain has grown drastically in recent years, with supply chain attacks increasing by 1300% between 2021 and 2023, according to ReversingLabs.
This trend has attracted significant attention from regulators and researchers, with Gartner predicting that the cost of software supply chain attacks will rise from $46 billion in 2023 to $138 billion by 2031.
Companies like ReversingLabs specialize in comprehensive software supply chain security and malware analysis solutions. By analyzing software’s "bill of materials" (SBOM), ReversingLabs can identify vulnerabilities and potential security threats hidden within software packages, helping companies stay ahead of hackers.
Addressing Sprawl in Investor Decision-Making
The prevalence and potential impact of SaaS and AI sprawl make it imperative for investors to consider this factor when evaluating companies. Here are crucial factors to analyze:
- Company’s Cybersecurity Strategies: Listen to earnings calls and review company disclosures to understand their approach to SaaS and AI security.
- Cybersecurity Breaches & Responses: Research past incidents and how swiftly and effectively companies addressed them.
- Regulatory Compliance: Examine past violations or potential risks related to data privacy regulations like GDPR.
- Security Partnerships: Look for partnerships with cybersecurity and SaaS management providers, indicating proactive investment in security solutions.
Companies demonstrably committed to strong IT and security governance, embracing robust solutions to tackle SaaS and AI sprawl, are better positioned for long-term success. By proactively managing their digital landscape and mitigating security risks, these companies can fully leverage the benefits of new technologies while safeguarding their financial stability and growth.
Conclusion
While the allure of digital innovation is undeniable, unrestricted SaaS and AI adoption can create a treacherous path for businesses. Companies need to carefully control their digital environment, prioritize security, and proactively manage the risks associated with sprawl. Investors, in turn, should scrutinize companies’ security postures, seeking evidence of effective strategies, strong governance, and the adoption of innovative security solutions. Those who balance the relentless pursuit of technology with responsible security practices will emerge as winners, navigating the complexities of the modern tech landscape and securing their place in the future.
