Zero Trust Security Gaps Leave SaaS Applications Exposed
Checked out by Franklin Okeke · 923 reads
Zero Trust adoption is rising, but disconnected controls leave gaps. Brian Soby argues that full coverage across users, devices and apps is key to its value.
Zero Trust can’t deliver much protection when its controls stop short of the applications and data they’re meant to protect. That’s the central point from Brian Soby, CTO and co-founder of AppOmni: many organizations have adopted pieces of the model, but haven’t connected them into an architecture that covers access from the user to the destination application.
The adoption figures suggest the gap matters. Okta reported that 61% of businesses had adopted Zero Trust by 2023. Yet Gartner predicted that more than 50% of organizations would fail to realize its benefits by 2026. Those figures describe a mismatch between adopting the model and making it work across an organization.
Partial deployment creates openings
Zero Trust is often distilled into “verify everything, trust nothing.” In practice, that means treating each request to access a resource as potentially risky, checking identity and permissions, and continuing to validate access during a session. Soby’s concern is that organizations may apply those principles to only some parts of their environment.
They might invest in endpoint detection, single sign-on or network access controls and assume the collection adds up to a complete security strategy. But if a business application sits outside those controls, an attacker may be able to reach it through a gap. In Soby’s account, disconnected tools can leave a company with segments of Zero Trust rather than a coherent system.
“We’re now seeing the inevitable result of partially implemented Zero Trust architectures that overlook critical pieces of our real-world risks or can simply be sidestepped by the bad guys because of their huge gaps.”
This is a coverage problem as much as a technology problem. Business teams increasingly manage important data and processes, but may not know every system connected to them or how those systems are configured. A misconfigured application can expose data even when other parts of the organization have strong controls.
Five principles, applied across the system
Soby describes an effective architecture as the consistent use of several principles across the organization’s technology and workflows. No individual product can provide complete coverage, he says. Organizations should be wary of products presented as full Zero Trust solutions if they leave major parts of the business uncovered.
No implied trust: Users, systems and networks should not receive automatic trust based on their location or connection.
Continuous security: Access should be checked throughout use, not just at the initial login.
Dynamic controls: Policies should respond to changes in activity and risk.
Least privilege: Authorization should grant only the specific access needed.
End-to-end coverage: Controls should extend across the full path from users and devices to the applications they access.
The principles depend on one another. Strong authentication, for example, can’t compensate for an application that allows access without requiring that authentication. Likewise, a network control may protect a route into a system while leaving permissions and configuration inside the destination application unchecked.
Soby pointed to reports of attackers using stolen credentials to access Snowflake customer instances from suspicious locations with malicious applications. He argued that some customers may have expected investments in Secure Access Service Edge, endpoint detection and response, or single sign-on to protect them. But if those safeguards were optional for the affected instances, they could be bypassed.
The example illustrates why organizations need to check how controls apply to each application. A security tool can be present in the environment and still fail to protect a particular workflow if access to that workflow doesn’t depend on it.
Keep controls connected and current
Maintaining coverage across every technology is difficult. Soby says organizations should rely on their security vendors for expertise in specific areas: endpoint detection and response to identify malware, single sign-on to authenticate users, Zero Trust Network Access to authorize and connect users to applications, and SaaS security posture management to secure the applications themselves.
Those tools still need to work together. A company may have effective controls in each category but lack the shared context needed to make access decisions granular and responsive. Soby’s test is whether the components communicate and collectively support the required protections.
That integration also affects how much of the organization is covered. Network access tools may focus on corporate users and traffic, while missing activity by other users. Controls may also provide limited context about what users can do inside an application, or fail to assess the application’s configuration. Covering devices and network traffic alone leaves important parts of the access path unexamined.
Why coverage shapes return on investment
Zero Trust implementations can be expensive, but Soby argues that spending on individual tools won’t produce meaningful value if attackers can route around them. He compares partial coverage to securing three quarters of a power substation: an open section can give an intruder an easy way around the protected perimeter. In his example, protecting 75% of the site might deliver only 5% of the value because the remaining gap undermines the rest.
That comparison is a way to think about security coverage, not a measured estimate for Zero Trust programs. The practical question is whether safeguards are mandatory across the systems and workflows that matter. If a cloud application doesn’t require an organization’s chosen authentication or access controls, those investments may not affect an attack against that application.
For Soby, the route to better returns begins with identifying uncovered destinations, users and activity, then connecting controls so they enforce consistent decisions from identity through application access. Organizations need to understand not only who can sign in, but what each person can do and what they actually do within the applications.
From a collection of tools to an architecture
Soby has spent 20 years working across products, applications and security, including roles at Raytheon, MITRE and Salesforce. He later started a consultancy focused on SaaS security before co-founding AppOmni. His assessment is that many current approaches handle devices, network access and traffic inspection better than they handle user risk or application configuration.
Closing those gaps calls for coverage of all users, not only corporate employees, and more context about their permissions and activity in applications. It also requires the destination applications to be part of the architecture, with their configurations and access paths accounted for.
The practical takeaway is direct: count the applications and users that controls actually cover, then check whether the safeguards interact across the full access path. Until those pieces connect, Zero Trust adoption figures say little about how difficult it will be for an attacker to find a way around the protections.
