INDUSTRY FACT FILE · SAAS & ENTERPRISE SOFTWARE

Threat Landscape: Top Cyber Threats Facing SaaS and Enterprise Software Vendors

The 18 most relevant cyber threats, attacks and industry challenges for ERP, CRM, HRMS, collaboration, cybersecurity and business application vendors.

Attackers target SaaS platforms because one weakness can expose many customers. They probe tenant isolation and APIs, steal OAuth tokens from integrations, use info-stealer logs to take over accounts and support sessions, and exploit vulnerable dependencies.

Widely reported incidents—credential-based access to customer accounts on a major cloud data platform (2024), a breach of a large identity provider's support system (2023) and OAuth token theft from a third-party chat integration used to export CRM data (2025)—show how trust paths around the product become attack paths.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by SaaS segment (Codec Networks assessment).

4.1 Tenant isolation

Multi-tenant products often pass a tenant or object ID in requests. If the server trusts it instead of binding the tenant from the session, any customer admin can read others' data.

• Questions to test: Is the tenant bound server-side on every endpoint, cache, export and background job? Are isolation tests automated in CI?
• Relevant services: tenant isolation testing, secure code review, CI authorisation tests.

4.2 Integration and OAuth tokens

Integrations hold long-lived tokens to many customers' tenants. Breaching one integration vendor can expose all of them.

• Questions to test: Are scopes minimal and tokens short-lived? Are bulk exports by integrations monitored? Can tokens be revoked quickly?
• Relevant services: OAuth and API reviews, integration vendor assessments, export monitoring.

4.3 Account takeover and support sessions

Info-stealer malware harvests passwords and session cookies. Without default MFA and session binding, attackers log in as customers—or as support staff with access to many tenants.

• Questions to test: Is MFA on by default for admins? Are support sessions just-in-time and customer-approved? Are sessions bound to devices?
• Relevant services: identity and session testing, support-tool reviews, SOC use cases.

4.4 Dependencies and SBOMs

Most products include hundreds of open-source components. When a critical vulnerability is published, vendors without an SBOM struggle to know if they are affected.

• Questions to test: Is there an SBOM per release? Are dependencies scanned continuously? Are patch SLAs defined?
• Relevant services: SCA and SBOM programme, vulnerability disclosure process.

4.5 Detection and the 6-hour clock

CERT-In requires reporting within six hours of noticing an incident, and customers expect prompt notice and logs to investigate their own exposure.

• Questions to test: Are production, identity and API logs monitored 24x7? Can customers access audit logs? Is there a customer-notification playbook?
• Relevant services: managed SOC, playbooks, tabletop exercises, IR retainer.

• CERT-In: incidents reported within six hours of noticing them.
• Customers: contracts require prompt notification, logs and cooperation, and may trigger audits, credits or termination.
• Customer regulators: BFSI customers may need to report vendor-caused incidents to RBI, SEBI or IRDAI.
• Privacy: customers as data fiduciaries must intimate personal data breaches to the Data Protection Board once DPDP breach provisions commence in May 2027; EU customers may have GDPR duties.
• Certifications: incidents are examined in SOC 2 and ISO 27001 audits.

• Could one tenant read another tenant's data through any endpoint, export or job?
• Which integrations hold tokens to our customers, and with what scopes?
• Is MFA on by default for customer admins and support staff?
• Do we have an SBOM for every release we support?
• Could we report an incident to CERT-In within six hours and notify every affected customer?
• Can we hand customers current test reports and SOC 2 or ISO 27001 evidence?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events.