Netskope named a Leader in the 2022 Gartner® Magic Quadrant™ for Security Service Edge. Get the Report.

  • Security Service Edge Products

    Protect against advanced and cloud-enabled threats and safeguard data across all vectors.

  • Borderless SD-WAN

    Confidently provide secure, high-performance access to every remote user, device, site, and cloud.

  • Platform

    Unrivaled visibility and real-time data and threat protection on the world's largest security private cloud.

Netskope Named a Leader in the 2022 Gartner Magic Quadrant™ for SSE Report

Get the report Go to Products Overview
Netskope gartner mq 2022 sse leader

Gartner® Quick Answer: How Does Netskope’s Acquisition of Infiot Impact SD-WAN, SASE, and SSE Projects?

Get the report
Quick Answer: How Does Netskope’s Acquisition of Infiot Impact SD-WAN, SASE and SSE Projects?

Netskope delivers a modern cloud security stack, with unified capabilities for data and threat protection, plus secure private access.

Explore our platform
Birds eye view metropolitan city

Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn more
Lighted highway through mountainside switchbacks

Prevent threats that often evade other security solutions using a single-pass SSE framework.

Learn more
Lighting storm over metropolitan area

Zero trust solutions for SSE and SASE deployments

Learn more
Boat driving through open sea

Netskope enables a safe, cloud-smart, and fast journey to adopt cloud services, apps, and public cloud infrastructure.

Learn more
Wind turbines along cliffside
  • Our Customers

    Netskope serves more than 2,000 customers worldwide including more than 25 of the Fortune 100

  • Customer Solutions

    We are here for you and with you every step of the way, ensuring your success with Netskope.

  • Training and Certification

    Netskope training will help you become a cloud security expert.

We help our customers to be Ready for Anything

See our Customers
Woman smiling with glasses looking out window

Netskope’s talented and experienced Professional Services team provides a prescriptive approach to your successful implementation.

Learn more
Netskope Professional Services

Secure your digital transformation journey and make the most of your cloud, web, and private applications with Netskope training.

Learn more
Group of young professionals working
  • Resources

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog

    Learn how Netskope enables security and networking transformation through security service edge (SSE).

  • Events & Workshops

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

Episode 18: Fostering Relationships for Security Awareness

Play the podcast
Black man sitting in conference meeting

Read the latest on how Netskope can enable the Zero Trust and SASE journey through security service edge (SSE) capabilities.

Read the blog
Sunrise and cloudy sky

SASE Week

Netskope is positioned to help you begin your journey and discover where Security, Networking, and Zero Trust fit in the SASE world.

Learn more
SASE Week

What is Security Service Edge?

Explore the security side of SASE, the future of network and protection in the cloud.

Learn more
Four-way roundabout
  • Company

    We help you stay ahead of cloud, data, and network security challenges.

  • Why Netskope

    Cloud transformation and work from anywhere have changed how security needs to work.

  • Leadership

    Our leadership team is fiercely committed to doing everything it takes to make our customers successful.

  • Partners

    We partner with security leaders to help you secure your journey to the cloud.

Netskope enables the future of work.

Find out more
Curvy road through wooded area

Netskope is redefining cloud, data, and network security to help organizations apply Zero Trust principles to protect data.

Learn more
Switchback road atop a cliffside

Thinkers, builders, dreamers, innovators. Together, we deliver cutting-edge cloud security solutions to help our customers protect their data and people.

Meet our team
Group of hikers scaling a snowy mountain

Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn more
Group of diverse young professionals smiling

How Graph-powered SSPM Adds the Right Context

Nov 30 2022

SaaS apps have become the “easy button” for organizations seeking a fast and simple way to make foundational business apps available to their employees. According to Gartner, “SaaS remains the largest public cloud services market segment, forecasted to reach $176.6 billion in end-user spending in 2022,” growing 14% over 2021. And according to research by Netskope, the average company with 500–2,000 employees had 805 distinct apps and cloud services in use during the first half of 2021.

The growing SaaS app security challenge

Cloud access security brokers (CASBs) can be used to protect SaaS apps and often have both API-based and inline protections that can be used to control access, protect data, and even block threats and malware. However, when it comes to governance and compliance issues, CASBs were not designed for continuous monitoring of SaaS app configurations and security settings. Each SaaS app is unique and can have tens or hundreds of global settings to monitor and manage, and compliance admins can be quickly overwhelmed when responsible for monitoring a large number of SaaS apps. Often, they’re forced to increase the time between manual configuration checks or stop monitoring certain apps altogether.

These are the challenges that first generation SaaS security posture management (SSPM) solutions were designed to address. For example, Netskope SSPM was initially built to consolidate and monitor an array of SaaS app configuration and security settings from within a single console, and excels at helping security practitioners minimize risky configurations, prevent configuration drift, and ensure compliance. It’s also great for configuration hardening, tracking public compliance metrics, user management, and automating common security tasks.

However, as organizations become evermore reliant on SaaS apps, security analysts are increasingly being tasked with protecting them and the growing amount of sensitive information they store. Security analysts understand that your environment is constantly changing, and that all connected resources form a complex topography that needs to be shielded against ever-evolving threats, both external and internal. What’s more, the collaborative SaaS apps that organizations rely on often extend data, permissions, and privileges outside of their walled gardens—exposing sensitive information beyond the managed security perimeter and expanding the attack surface. Of particular concern are the large number of popular SaaS apps that allow the use of extensions and plugins via OAuth, or Open Authorization. SSPM tools can’t see unmanaged OAuth extensions and so connections to them are invisible, creating covert security vulnerabilities. Because of security gaps like this, Netskope believes that better, more comprehensive protections are needed to secure today’s sprawling SaaS app ecosystems, and now we are proud to unveil new capabilities that we believe will set the standard for the next generation of SSPM tools.

Netskope Next Generation SaaS Security Posture Management (SSPM)

Netskope has been rethinking how to best secure SaaS apps and has now added new features that go beyond what’s possible with traditional “asset list”-based configuration management tools. Netskope’s new, graph-powered SSPM regards SaaS apps as extensions of your business and maps their contextual information, including data models and all resource connections, into a single graph. Monitored assets and attributes are placed on the graph structure according to application-native data models and their related object hierarchies. Connections between elements and apps are drawn as graph edges, allowing security practitioners to accurately visualize and secure all connected resources.

Netskope’s intuitive SSPM console helps security analysts to navigate and mine this rich trove of assets and contextual data. The graph structure enables more granular and accurate logic to be used when defining basic posture management policies such as continuous monitoring of security settings to prevent configuration drift, real-time incident investigations, asset inventory management, and threat surface and impact modeling. Security administrators gain detailed visibility into SaaS apps and their related assets so they can quickly determine how they’re connected and structured, what their security models look like, and what resources and data are directly or indirectly exposed by the asset.

Graph-powered SSPM enables new SaaS security use cases

Netskope’s graph-powered SSPM provides broader and deeper monitoring of SaaS apps, opening up some powerful new use cases for security analysts:

  • More granular search options expose hidden risks: Netskope graph-powered SSPM enables security analysts to evolve from basic searches, such as “Find all Salesforce users who do not have multi-factor authentication enabled,” to validating complex relationships like “Discover everyone who is using internet-connected Microsoft 365 plugins which have read and write access to our documents.” 
  • Graph-based visualization simplifies security analysis: The single graph allows administrators to create connections and enforce rules between apps, such as “List users who have their Azure AD account disabled but can still access Salesforce,” and also “Get me their active session tokens.”
  • Convert risky findings into monitoring policies with one click: The discovered anomalies and violations of company policies become continuous monitoring rules with a single click, alerting you immediately to any configuration drift.
  • Easily deploy uniform security policies: Graph-based security monitoring makes it easy to deploy uniform security policies across hundreds or thousands of SaaS apps.
  • Apply security models developed for advanced apps to less advanced apps, for example:
    • Apply identity provider group policies to an app that does not have native integration capabilities (e.g., extend Azure AD domain controls developed for an app that supports them natively to an app that doesn’t).
    • Ensure that all members of a sensitive chat room carry appropriate authorization.
    • Evaluate privileges and trustworthiness of suspected bot accounts which are accessing sensitive spaces.

Conclusion

Demand for SaaS apps will continue to grow along with their complexity, interconnectivity, and security challenges. As you work to transform your business critical workflows and security models to support new cloud-based apps and infrastructure, Netskope graph-powered SSPM is ready to help with the tools you need. A single interface and single graph reduce the effort and complexity of securing dozens of high-risk SaaS apps. Netskope helps you manage multiple security environments and enables you to connect and extend security capabilities to additional platforms, strengthening your overall security posture and reducing risk. Find more information at Netskope SSPM or contact us directly.

author image
Eetu Korhonen
Eetu Korhonen is a Security Researcher on Netskope's Security Posture Management team.
author image
Dan Frey
Dan Frey is the Product Marketing Director for Netskope Cloud Security products including CSPM, SSPM, CASB API, and CASB Inline.