Who can reach your data in Microsoft 365, Google Workspace, and GitHub?
SSPM: posture checks for Microsoft 365, Google Workspace, GitHub, Snowflake and four more SaaS platforms.
SaaS Security posture management extends the same rule graph to the platforms your company runs on: Microsoft 365, Google Workspace, GitHub, GitLab, Snowflake, SharePoint, Dynamics 365 and Okta. It applies 433 CIS Benchmark rules across six SaaS benchmarks.
- posture rules
- 9,853
- cloud providers
- 7
- cloud services
- 549
- compliance frameworks
- 78
A cloud posture tool will tell you an S3 bucket is public.
It will say nothing about the SharePoint site shared with 'anyone with the link', the Microsoft 365 global admin without MFA, the stale Google Workspace guest account from a contractor who left in 2023, or the Snowflake service account holding ACCOUNTADMIN. Attackers go after exactly these accounts, and a cloud posture tool never sees them.
How SaaS Security (SSPM) works
- 01
Each SaaS platform is connected through a dedicated read-only connector: Microsoft Graph with OAuth 2.0, Google Admin SDK with service-account impersonation, Snowflake private-key JWT, GitHub and GitLab app tokens.
- 02
Discovery enumerates tenants, users, admin roles, sharing settings, audit-log configuration, and data-exposure surfaces without any agent or browser extension.
- 03
Findings are evaluated against 433 CIS rules: Microsoft 365 (130), GitLab (122), Google Workspace (89), Snowflake (39), SharePoint (37) and Dynamics 365 (16).
- 04
SaaS findings write into the same findings model as cloud findings, so a SaaS identity risk and a cloud identity risk appear in one queue rather than two consoles.
- 05
Because identity is shared, an Okta or Entra ID account that federates into AWS is traced through to the cloud permissions it unlocks on the attack-path graph.
What you see in the console
- SaaS tenant inventory
- every user, admin, guest, and service account across connected platforms
- MFA and conditional-access gaps on privileged SaaS accounts
- External sharing exposure
- SharePoint, OneDrive and Google Drive links open to anyone
- Audit-log configuration checks
- M365 Unified Audit Log, GWS retention, Snowflake QUERY_HISTORY
- DevOps platform posture
- GitHub and GitLab org settings, branch protection, token hygiene
- Data warehouse posture
- Snowflake roles, network policies, and grant sprawl
- CIS Benchmark scoring per SaaS platform with per-control evidence
- Stale and orphaned SaaS identity report
SaaS Security (SSPM) in the real console.
A recreation of the Onam console with sample data — the screens and finding types your team works with.
Questions we get a lot
See SaaS Security (SSPM) on your own cloud
Book a 30-minute demo. We walk through it on sample data, or on one of your accounts if you want to connect it.