SSPM stands for SaaS Security Posture Management. It is the practice of checking the security settings inside the SaaS applications you already use, finding the misconfigurations, and fixing them before somebody else finds them. Not the network around the apps. The settings inside them.
The question that prompted this article came from a business meeting: which SSPM vendors do you work with. It is a fair question and a surprisingly awkward one, because the honest answer for most organisations is that they are already paying for some of this and have never switched it on.
Transputec manages Microsoft Defender for Cloud Apps for clients, which is where our own answer sits. The rest of this article explains the category, what Microsoft covers, and the cases where a dedicated tool genuinely earns its place.
Nobody breaches a SaaS platform like Microsoft 365 or Salesforce. They walk in through a setting somebody left open inside your tenant, which is the one part of the stack the vendor will never fix for you.
What SSPM Actually Covers
Every SaaS platform ships with hundreds of configurable settings. Who can share externally. Whether guests expire. Which third party apps can read your mail. Whether legacy authentication is still permitted. The vendor secures the platform. You own the settings, and the settings are where the incidents come from.
SaaS security posture management is the discipline of monitoring those settings continuously across every SaaS app you run, scoring them against a benchmark, and flagging drift. It sits alongside two neighbours that get confused with it.
CASB, cloud access security broker, is about traffic and access: who is reaching which app, from where, and what they can do in the session. CSPM, cloud security posture management, does the same job for infrastructure in Azure, AWS and Google Cloud rather than for SaaS applications. The three overlap in most products, which is a large part of why the category is confusing.
The practical distinction is simple. If the question is who can get in, that is CASB. If it is whether your cloud servers are built safely, that is CSPM. If it is whether the sharing settings inside your SaaS tenant are sane, that is SSPM.
Why It Became a Category
Three things happened at once.
SaaS estates grew past the point anyone could hold in their head. A mid-sized business now runs dozens of SaaS products, most bought by departments rather than IT, each with its own permission model and its own idea of what a sensible default looks like.
Then OAuth happened. Users grant third party applications permission to read mail, files or calendars, and those grants persist quietly long after anyone remembers making them. An application with delegated access does not need a password and will not show up in a login report.
And the attackers noticed. Breaking the encryption on a major SaaS platform is hard. Finding a tenant where external sharing is wide open, or where a forgotten integration still holds read access to everything, is not. This is the same shift that makes conditional access worth configuring properly: the control plane moved into the tenant, so the tenant is where the work is.
Not sure what your SaaS settings currently allow
Transputec manages Microsoft Defender for Cloud Apps as part of its cyber security services, including app discovery, connected app posture and OAuth app governance. A short review will tell you what your tenant is currently permitting.
Get a Strategic ConsultationWhat Microsoft Already Gives You
This is the part that changes most buying decisions, and it is the reason the vendor question is harder than it looks.
Microsoft Defender for Cloud Apps is a genuine SSPM product, not an approximation of one. Microsoft’s own documentation lists SaaS Security Posture Management as one of its four pillars, alongside CASB functionality, threat protection and app-to-app protection. It surfaces misconfigurations per connected app, recommends specific fixes based on standards including the Center for Internet Security benchmarks, and feeds the results into Microsoft Secure Score automatically.
It also covers the two problems described above directly. Cloud discovery identifies the applications people are actually using, assesses each against more than 90 risk indicators, and ranks them. App governance watches OAuth applications, including unused ones and those with expired credentials, which is the blind spot most organisations do not know they have.
So for a Microsoft-centred estate, the starting position is not nothing. It is usually a licensed capability that has never been connected to anything.
The Licensing Split That Catches People Out
There is a trap here worth understanding before anyone quotes you for a tool.
Two different products share a portal and almost share a name. Office 365 Cloud App Security is a subset of Microsoft Defender for Cloud Apps, and the difference is not cosmetic.
| Capability | Defender for Cloud Apps | Office 365 Cloud App Security |
|---|---|---|
| Apps discoverable | More than 34,000 | 750+, limited to apps similar to Office 365 |
| App governance for OAuth apps | Included | Not included |
| Discovery method | Manual upload, automated log collector and API, native endpoint integration | Manual log upload only |
| Data loss prevention | Cross-SaaS, integrates with Purview and third party tools | Uses existing Office DLP |
| Session control | Any cloud or on-premises app | Office 365 apps only |
| Cloud platform posture | Azure, AWS and Google Cloud | Azure only |
Read that table as a buying guide. If your estate is Microsoft 365 and little else, the subset may genuinely be enough. If you run Salesforce, Workday, ServiceNow or anything else that matters, the subset will not see them, and a proposal that assumes otherwise is wrong.
Check what your licences actually include before anybody designs a solution. This is the same pattern we wrote about with Microsoft Purview: capability that exists, sits inside licences already paid for, and has never been turned on.
When a Dedicated Tool Earns Its Place
It would be convenient to say Microsoft covers everything. It does not, and three situations point the other way.
A genuinely multi-SaaS estate. If your crown jewels sit in Salesforce, Workday or a specialist platform rather than in Microsoft 365, depth of coverage for those specific applications matters more than breadth. Pure-play vendors build deep connectors for a defined list of applications, and that depth is their argument.
Regulatory pressure on a specific platform. If an auditor asks for evidence of configuration control over a named system, a tool that produces that evidence for that system is worth more than a general posture score.
A dedicated security team with time to run it. This is the one that gets skipped. Any tool in this category produces findings, and findings need somebody to triage them. Buying a platform that generates work nobody has been assigned is a familiar and expensive mistake.
If none of those applies, the honest recommendation for a mid-market organisation is to use what the Microsoft licensing already provides, connect it properly, and revisit the question in a year with real data about what it found.
The Vendor Landscape, Plainly
Since the question was about vendors, here is the market as it stands, without pretending to a neutrality nobody in this industry has.
The pure-play names that appear on enterprise shortlists are AppOmni, Obsidian Security, Wiz, Reco and Valence Security. CrowdStrike entered the category by acquiring Adaptive Shield in late 2024 and now sells it as Falcon SSPM. Microsoft appears on the same lists through Defender for Cloud Apps.
The category is also consolidating. Posture management for SaaS, cloud infrastructure, data and identity is increasingly sold as one platform rather than four, which is worth knowing before signing a three year contract for a single slice of it.
Transputec does not resell any of the pure-play platforms. Our route to this capability is Microsoft, through Defender for Cloud Apps, which we manage for clients as part of our cyber security services. If your situation is one of the three above, we will say so, and a specialist tool from a vendor we have no commercial relationship with may be the right answer.
Where to Start
The sequence matters more than the product choice, and the first three steps cost nothing but attention.
- Find out what you are licensed for. Establish whether you have Defender for Cloud Apps or the Office 365 subset. The answer changes everything downstream.
- Run discovery before buying anything. The list of applications actually in use is usually longer than the list anyone expected, and it reframes the conversation on its own.
- Audit OAuth grants. Look at which third party applications hold delegated access to mail, files and calendars, and revoke the ones nobody can account for.
- Connect your main apps so posture findings and Secure Score reflect reality rather than Microsoft 365 alone.
- Fix external sharing defaults before worrying about anything more sophisticated. This is where most real incidents start.
- Assign an owner. Posture findings are a standing workload, not a project with an end date, and an unowned dashboard decays within a quarter.
Only after those is the question of a dedicated platform worth asking, because by then you will know what it would actually be fixing.
How This Fits the Rest of Your Security
Posture management is not a standalone purchase, and treating it as one is how organisations end up with nine consoles and no clearer picture.
It belongs with identity, because almost every SaaS control is ultimately an identity decision, which is why zero trust work and posture work tend to arrive together. It belongs with data protection, because knowing a file is shared externally matters a great deal more once you know the file contains personal data. And it belongs with monitoring, because a posture finding nobody reads is indistinguishable from not having found it.
Transputec runs these together rather than separately: Microsoft 365 managed services for the tenant configuration, a 24/7 UK security operations centre for the monitoring, and Defender for Cloud Apps sitting across the SaaS estate. The value is in the joins, not in any one console.
The Short Version
SaaS security posture management is the practice of keeping the settings inside your SaaS applications sane, which is a real problem and not an invented one. Most mid-market organisations running Microsoft do not need to buy a new platform to start on it, because Defender for Cloud Apps already does this job and may already be in your licensing.
The work that matters is unglamorous: find out what you own, discover what is actually in use, revoke the OAuth grants nobody remembers, fix the sharing defaults, and give the findings an owner. A dedicated tool is worth considering after that, when you know what it would be solving.
If you want a straight answer about your own tenant, Transputec’s cyber security services team can talk you through the posture work behind a SaaS estate, including what your current licences already cover.
FAQs
What does SSPM stand for?
SaaS Security Posture Management. It is the practice of continuously checking the security configuration inside the SaaS applications an organisation uses, identifying misconfigurations such as over-permissive external sharing or risky third party app access, and correcting them. The focus is the settings inside the tenant rather than the network or the infrastructure around it.
What is the difference between SSPM, CASB and CSPM?
CASB governs access and traffic: who reaches which application, from where, and what they can do in that session. CSPM checks the configuration of cloud infrastructure in Azure, AWS and Google Cloud. The same configuration job applied to SaaS applications is what this category covers. Most products now combine at least two of the three, which is why the labels overlap in practice.
Does Microsoft Defender for Cloud Apps count as an SSPM tool?
Yes. Microsoft’s documentation names SaaS Security Posture Management as one of the four pillars of Defender for Cloud Apps. It surfaces misconfigurations for each connected app, recommends fixes based on standards including the Center for Internet Security benchmarks, and feeds the results into Microsoft Secure Score. Coverage depends on which applications you connect to it.
Do we already have SaaS posture management in our Microsoft licensing?
Possibly, and it is worth checking before buying anything. Office 365 Cloud App Security is a subset that only supports the Office 365 connector and does not include app governance for OAuth applications. The full Defender for Cloud Apps product discovers more than 34,000 applications and works across other SaaS platforms. Confirm which one your licences include before anyone designs a solution around it.
Which SSPM vendors does Transputec work with?
Microsoft, through Defender for Cloud Apps, which Transputec manages for clients as part of its cyber security services. Transputec does not resell a pure-play SSPM platform such as AppOmni or Obsidian. For most mid-market estates the capability inside existing Microsoft licensing is the right place to start, and where a dedicated tool genuinely fits better we will say so.
This article was drafted with AI assistance and reviewed by the Transputec team. Featured image: AI-generated.
