>
    Strata Copilot
    What’s SaaS Security?
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. What’s SaaS Security?
    Download PDF
    SaaS Security

    What’s SaaS Security?

    Table of Contents

    What’s SaaS Security?

    Learn about the advantages of SaaS Security over legacy CASBs.
    Where Can I Use This?What Do I Need?
    Data Security, SaaS Security Posture Management, and Behavior Threats:
    • Strata Cloud Manager
    SaaS Security Inline:
    • NGFW (Managed by Panorama or Strata Cloud Manager)
    • Prisma Access (Managed by Panorama or Strata Cloud Manager)
    One of the following SaaS Security licenses:
    • Data Security license, and a NGFW or Prisma Access license
    • SaaS Security Inline license
    • SaaS Security Posture Management license
    Or any of the following licenses that include one of the SaaS Security licenses:
    • CASB-X
    • CASB-PA
    NG-CASB Standalone Web Interface Deprecation in November 2024
    The standalone console for SaaS Security (accessible at https://<tenant-name>.aperture.paloaltonetworks.com/) is being retired as of 30 November 2024. SaaS Security is now available in the new, unified Strata Cloud Manager platform.
    Since April 2023, Strata Cloud Manager has been enhancing how you manage data security, offering a centralized solution that simplifies your workflows. While you might be accustomed to the functionality of the previous portal, transitioning to Strata Cloud Manager brings several significant benefits. Refer to the customer resources blog for detailed explanations and FAQs related to this transition.
    Security teams like yours are challenged with protecting the growing availability of sanctioned and unsanctioned SaaS apps and maintaining compliance consistently in the cloud while stopping threats to sensitive information, users, and resources.
    SaaS Security is an integrated CASB (Cloud Access Security Broker) solution that:
    • Provides visibility and control over all your shadow IT risks.
    • Secures SaaS apps from known and unknown cloud threats.
    • Protects sensitive data and ensures compliance across all SaaS apps.
    • Allows access to corporate apps only for legitimate users.
    Use SaaS Security Inline to discover and manage risks posed by unsanctioned SaaS apps while you rely on Data Security to scan assets in the cloud space for at-rest detection, inspection, and remediation across all user, folder, and file activity within sanctioned SaaS apps. SaaS Security Posture Management (SSPM) helps detect and remediate misconfigured security settings in sanctioned SaaS apps through continuous monitoring.
    With SaaS Security—SaaS Security Inline, Data Security, and SSPM combined—you have an integrated CASB solution that offers better security outcomes without the complexity of third-party integrations and the overhead and cost of managing the large number of vendors who exist with legacy CASBs.
    SaaS Security on Strata Cloud Manager
    We are in the process of updating the SaaS Security Administrator’s Guide to include information for new customers and those who are migrating to Strata Cloud Manager. Read the following information carefully to learn more about the updated terms and feature availability in Strata Cloud Manager. We are updating this section during this transition.
    • SaaS Security API is now Data Security in the Strata Cloud Manager.
    • SaaS Security Inline is now Discovered Apps in the Strata Cloud Manager.
    • See Common Services for Subscription and add-ons, Tenant management, Identity and Access, and Device Association.
    • Navigation in the Strata Cloud Manager is documented wherever applicable.
    • We are updating images and screenshots as you migrate to Strata Cloud Manager.

    What’s Data Security?

    Learn about Data Security capabilities.
    Data Security is a security solution that connects to your sanctioned SaaS app using the SaaS app’s API. This API integration enables the service to discover and scan all assets retroactively when you first connect the SaaS app. Data Security scans and analyzes all your assets and applies policy to identify exposures, external collaborators, risky user behavior, and sensitive documents and identifies the potential risks associated with each asset.
    Data Security also performs deep content inspection and protects both your historical assets and new assets from malware, data exposure, and data exfiltration. As Data Security identifies incidents, you can assess them and define automated actions to eliminate or close the incident. After the initial scan of your historical assets, Data Security continuously monitors each SaaS app and applies policy against new or modified assets for ongoing incident assessment and protection.
    To provide visibility into the security challenges with data classification and governance, security gaps owing to noncompliance, sharing or permission violations, and malware propagation within the sanctioned cloud apps on your network, Data Security focuses on the following key areas:
    • Content Security—The content you store in each cloud app is an asset. Data Security provides visibility into your asset inventory to help you uncover accidental or malicious data exposure. Data Security discovers the assets residing in the cloud app, assesses the shared or exposed data within and outside your organization, and identifies the impact or risk to intellectual property and regulatory noncompliance. In addition to creating an incident and alerting the administrator, the service provides autoremediation capabilities, including the option to quarantine, change sharing, or notify the owner.
    • User Activity Monitoring—Data Security uses a combination of tools including machine language learning, predefined and user-defined data patterns, security configuration controls, and access to event logs auditing user access and activity on each cloud app. With these tools, it builds context on sensitive data within your environment, identifies thresholds for expected and unexpected behavior, and uses this intelligence to log a violation or alert you to risky user behavior and possible data leaks from accidental or malicious user activity.
    • Security Configuration Controls—Data Security provides policies allowing you to manage and restrict privileged user activity, email forwarding, and retention rules, and protects you from misconfigurations such as lack of storage volume encryption, lack of enforcement for securing keys, credentials, and multi-factor authentication. When any of these security issues occur, you can configure the service to generate an alert or log it as a policy violation.
    • Third-Party App Integrations—Threats from third-party apps are serious because these apps have access to all or a large part of the data in the related cloud app. Protect your users and network from misconfigurations and known and unknown malware arising from these app integrations with a service that gives you the ability to approve, block, or restrict third-party app installation.
    Data Security complements SaaS Security Inline capabilities to provide an integrated CASB (Cloud Access Security Broker) solution.

    What’s SaaS Security Inline?

    Learn about SaaS Security Inline capabilities.
    SaaS Security Inline natively integrates with your NGFW and Prisma Access tenants managed by Panorama or Strata Cloud Manager to provide granular SaaS app visibility and control of unsanctioned SaaS apps through advanced analytics, reporting, visualization, categorizations, and Security policy authoring so that you can minimize data security risks to your organization. Employees inadvertently use SaaS apps that violate compliance agreements or that carry risks that exceed your organization’s tolerance. SaaS Security Inline discovers such risks so that you can understand them and take action.
    SaaS Security Inline provides easy deployment and inline policy enforcement. SaaS Security Inline leverages ACE (App-ID Cloud Engine) technology and SaaS policy rule recommendations to provide greater and faster SaaS app discovery and a seamless SaaS security workflow between your organization’s administrators for improved security posture.
    SaaS Security Inline provides:
    • Shadow IT discovery—Using our language-agnostic ACE technology, automatically discovers new SaaS apps to keep pace with the new and emerging SaaS apps. SaaS Security Inline identifies over 74,800 SaaS apps using machine-learning algorithms to achieve a high-level of accuracy and speed.
      Definition of a SaaS App: For the purpose of discovery, we define a SaaS app as any app delivered as a service over the internet. The app should have the capability to upload, download, or share content. Additionally, the app might have the following capabilities and characteristics:
      • The ability to be delivered and managed remotely
      • Features such as session login and data transfer
      • Pricing or subscription pages
    • Shadow IT control—Enables you to author SaaS policy rule recommendations based on a combination of apps, users and groups, categories, activities, device posture (personal vs. corporate) and Enterprise Data Loss Prevention (E-DLP) data profiles and collaborate with your firewall administrator on SaaS security policy rules to control intentional and unintentional risky SaaS apps and user activity, allowing access to corporate SaaS apps only for the legitimate users.
    • Shadow IT visibility and reporting—Delivers an up-to-date combined view of both unsanctioned and sanctioned SaaS app usage across categories and subcategories, including Content Marketing, Collaboration & Productivity, and ERP:
      • Risk assessment—Exposes risky SaaS apps that are being used in your app ecosystem. SaaS Security Inline tracks over 80 attributes, and calculates a risk score based on over 55 of these attributes. The risk score is between 1 (low risk) and 5 (high risk). To calculate the risk score, SaaS Security Inline considers the following types of attributes:
        You can generate a SaaS Security Report to help you assess risks posed by unsanctioned SaaS apps. The SaaS Security Report summarizes the most risky SaaS apps in your network. After processing completes, the report is automatically emailed to you as a PDF attachment.
        Risk score customizing tools to enable you to manually change the risk score for individual SaaS apps without changing the underlying calculation method, or adjust the weights for the underlying attributes and allow SaaS Security Inline to recalculate and apply the risk score automatically.
      • Risk categorization—Identifies safer alternatives to risky SaaS apps with advanced filters with drill-down views for granularity to locate the SaaS app that meets your organization’s risk tolerance; NPS score metric to assess customer satisfaction with SaaS apps; and tagging, both custom and default, to differentiate sanctioned SaaS apps from unsanctioned SaaS apps that are being used by employees in your organization for efficient monitoring and policy enforcement.
    SaaS Security Inline complements Data Security capabilities to provide an integrated CASB (Cloud Access Security Broker) solution.

    What’s SaaS Security Posture Management (SSPM)?

    Learn about the benefits of SaaS Security Posture Management.
    SaaS Security Posture Management (SSPM) helps detect and remediate misconfigured settings in sanctioned SaaS apps through continuous monitoring. SSPM provides:
    • Detection of Misconfigurations—Finds misconfigurations using built-in best practices, categorizes misconfigurations by severity to help you prioritize risks.
    • Comprehensive and effortless remediation—Provides misconfiguration alerts and the ability to remediate issues quickly across apps with one click of a button or manually using straightforward instructions. Enables you to lock a configuration so that the setting does not become a misconfiguration in the future.

    Learn More About SSPM

    Our website includes a variety of resources that describe SSPM and how it can help you secure your sanctioned SaaS apps. A short video overview of SSPM is also available on our YouTube channel.

    What's Behavior Threats?

    The Behavior Threats feature uses a machine-learning model and user history to detect potential threats based on anomalous user behavior.
    The Behavior Threats feature of SaaS Security helps you identify potential threats to your organization from compromised accounts, malicious insiders, and data breaches. Specifically, Behavior Threats examines how your organization’s users are interacting with sanctioned SaaS apps to identify suspicious user activities that might indicate attempts to steal or corrupt data.
    Behavior Threats obtains information about user activities from the Data Security component of SaaS Security, and examines the data to identify suspicious user activities. Suspicious user activities include actions such as a user uploading or downloading a large number of files within a short period of time, or a user logging on to a SaaS app outside of their normal working hours.
    Because every organization is different, we designed Behavior Threats to tailor itself to your particular organization. Behavior Threats uses machine learning to analyze and model user behavior in your organization. Behavior Threats provides a set of policies rules for detecting suspicious user actions, but these policies are not based on predefined or manually configured thresholds. Instead, these policies compare new user actions against past actions to detect unusual activities. The policies are enabled by default, so no configuration is necessary. All you require is a tenant with Data Security and the Cloud Identity Engine.
    Depending on when you first activated and configured Data Security, up to 90 days of historical user data is available to Behavior Threats. Behavior Threats examines this historical user data to determine a baseline for each user in your organization. This baseline is derived from the user’s past actions and also from the actions of other users in your organization. Using data-driven machine learning models, Behavior Threats assigns a risk score to each user based on anomalous behavior.
    Behavior Threats displays the most anomalous user actions as threat incidents, and assigns a Severity level to each threat incident. Behavior Threats is designed to minimize the number of false positives by only reporting a very small percentage of user actions as threat incidents.
    Each day, Behavior Threats collects data on the most recent user actions to identify the most risky users and new threats. Behavior Threats also uses this new data to recalculate user baselines.
    The Behavior Threats page on Strata Cloud Manager displays the threat incidents and risky users. From this page, you can complete the following tasks:

    © 2026 Palo Alto Networks, Inc. All rights reserved.