Cloud & SaaS Security: Your Business Runs on 47 Apps You Forgot About

The Real Problem Is Not the Cloud — It Is the Sprawl

Five years ago, a small business had maybe five cloud accounts: email, file storage, accounting, CRM, and maybe a project management tool. Today, the average small business uses 40-60 SaaS applications, most of which were adopted without IT ever knowing. Every employee who signed up for a free trial of something two years ago — and never deleted it — has an account sitting out there with company data in it.

This is called shadow IT — technology adopted without IT approval or oversight — and it is the biggest SaaS security risk you have never heard of. Each orphaned account represents an attack surface: a login that is not monitored, a password that is probably reused, and data that nobody remembers exists.

Step 1: Enforce MFA on Every SaaS Account — No Exceptions

If you read one paragraph in this article, make it this one. Multi-factor authentication is the single most effective defense against cloud account takeover. It blocks 99% of credential-based attacks. And the best part: it is free on virtually every SaaS platform.

Go through every SaaS application your business uses and enable MFA. Start with the ones that would hurt the most if compromised:

1. Email (Google Workspace / Microsoft 365): If an attacker gets into your email, they can reset passwords on every other service. This is priority #1. Use hardware keys (YubiKey) for admin accounts and authenticator apps for everyone else.
2. Financial systems (QuickBooks, Stripe, PayPal, bank): Direct path to your money. Hardware keys or authenticator apps. Never SMS — SIM-swap attacks make SMS-based MFA unreliable for financial accounts.
3. CRM and customer data (HubSpot, Salesforce, Mailchimp): These contain customer lists, email histories, and purchase data. A breach here triggers notification requirements.
4. Code repositories (GitHub, GitLab, Bitbucket): If you have a website or app, source code access means the attacker can inject malware directly into your product.
5. Everything else: Slack, Zoom, Dropbox, Figma, project management tools — enable MFA on all of them. Attackers use Slack access to impersonate executives and request fraudulent transfers.

Step 2: Audit Your SaaS Inventory

You cannot secure what you do not know exists. Do a SaaS audit:

• Check Google Workspace / Microsoft 365 admin: Both platforms show you every third-party app that employees have granted access to using their work account. Go to admin console → Security → Third-party apps. You will find apps you forgot existed. Revoke anything that is not actively used.
• Check your credit card statements: Look for recurring SaaS subscriptions. Every line item is an account that someone created. Cross-reference with your known services list. Cancel anything unused.
• Ask your team: Send a simple email: "What apps and services do you use for work that IT might not know about?" Most people will honestly tell you. They just never thought to mention it before.
• Use a free discovery tool: Tools like Torii or Zluri offer free SaaS discovery for small teams. They scan your email domain and financial records to generate an inventory of every SaaS tool connected to your business.

Step 3: Lock Down Sharing Settings

The fastest way to leak data is a sharing link set to "Anyone with the link can edit." It happens constantly — someone pastes a link into a public forum, a customer forwards it to their team, and suddenly your internal pricing spreadsheet is indexed by Google.

Fix this at the admin level:

• Google Workspace: Admin → Apps → Google Drive → Sharing settings → Set "Shared link default" to "Restricted" (not "Anyone in your organization"). Disable the ability for users to change this default.
• Microsoft 365 / SharePoint: Admin → SharePoint → Sharing → Set default link type to "Specific people." Disable "Anyone with the link" at the tenant level unless explicitly approved.
• Dropbox Business: Admin → Settings → Sharing → Default link access to "Team members." Disable "Anyone with the link can edit."
• Slack: Review public channel membership — any external guest who no longer needs access should be removed. Set file sharing defaults to require authentication.

Step 4: Offboarding — The Step Everyone Skips

When an employee leaves, someone usually remembers to disable their email. Almost nobody remembers the 12 SaaS accounts they created. Former employees retaining access to company SaaS tools is frighteningly common — and it is often not malicious. They just still have the password saved in their browser. But an attacker who compromises that ex-employee's personal email now has a backdoor into your company's tools.

Create an offboarding checklist — a simple list in a shared document:

1. Disable email / Google Workspace / Microsoft 365 account
2. Revoke access to: CRM, project management, file storage, accounting, email marketing, social media, code repos, design tools, analytics
3. Remove from shared password vault
4. Remove from any "shared" login credentials (stop sharing logins!)
5. Change any API keys or service account credentials the person had access to
6. Document that offboarding was completed — date, who did it, what was revoked

Step 5: Use SSO (Single Sign-On) Where Possible

Single Sign-On means employees use one set of credentials (their Google or Microsoft account) to log into all your SaaS tools. The benefits for security are enormous:

• One place to enforce MFA — not 40 places
• One place to disable access when someone leaves — not 40 places
• Employees do not create 40 weak, reused passwords — they use one strong, managed account
• You can see every login in one audit log

Most modern SaaS tools support "Sign in with Google" or "Sign in with Microsoft." Encourage — or require — employees to use SSO when available. For tools that do not support SSO, use the password manager to generate and store unique credentials.

The Bottom Line

Your business runs on SaaS. You cannot avoid it — and you should not try. Cloud tools make small businesses more productive, more flexible, and more competitive. The security answer is not "use fewer tools." It is "know what you are using, lock it down, and have a plan for when someone leaves."

Start with the 60-minute checklist above. Do it this week. The biggest risk is not the cloud itself — it is the accounts nobody remembers exist, with passwords nobody has changed in three years, holding data nobody thought to protect.