Cloud Access Security Brokers (CASBs), even as part of broader Secure Access Service Edge (SASE) frameworks, only help with a limited, pre-catalogued subset of web applications—typically around 30,000 for the leading vendors. In comparison, there are an estimated 200 million active web applications today. These represent applications that have undergone formal risk assessments with appropriate risk scores generated.

For the vast majority of web applications, security teams face a binary choice: allow or block entirely. This all-or-nothing approach leaves no middle ground for nuanced access control. There’s simply no practical way for enterprises to monitor what’s happening within these uncatalogued web applications or determine whether they should be allowed with restrictions or blocked partially. Administrators must rely on Security SaaS Posture Management (SSPM) risk scoring to make blocking decisions without any real understanding of actual usage patterns or data exchange within their organisation.

Many SaaS Management Platforms (SMPs) claim to address CASB gaps in shadow SaaS identification. Some even provide greater visibility into authentication methods and MFA implementation across SaaS apps. However, SaaS management shouldn’t exist as a standalone function isolated from your broader security infrastructure.

With CASB solutions that integrate into SASE frameworks, security teams benefit from shared data pools that web security gateways also contribute to, providing deeper visibility into data exchanges. In contrast, SMPs introduce yet another product category into enterprise environments with questionable return on investment. Without visibility into exactly how shadow applications are used in practice, there’s no foundation for informed decision-making about allowing or restricting these apps.

Both CASBs and SMPs rely heavily on API integrations to gather critical data points. These are expensive operations limited to applications that support API integrations and the restricted range of actions those APIs expose. They generate tremendous costs while providing incomplete Shadow SaaS management coverage.

Additionally, neither solution adequately addresses today’s expanded shadow IT landscape, which must include browser extensions from official stores and side-loaded/developmental ones. This blind spot leaves organisations vulnerable to risks from seemingly innocuous browser add-ons that can access sensitive data.

The ability to build a security program that stands up in a courtroom is becoming as important as one that stands up to attackers.

“A focus on asset management and monitoring is crucial for a legally defensible security program,” says Chase Doelling, Principal Strategist at JumpCloud. “Your system must be auditable—tracking who has access to what, when they accessed it, and who authorised that access in the first place.”

This approach closely mirrors the structure of compliance programs. If an organisation is already aligned with established compliance frameworks, it’s likely on the right path toward a security posture that can hold up under legal examination. According to Doelling, “Essentially, if your organisation is compliant, you are already on track to having a security program that can stand up in a legal setting.”

The foundation of that defensibility lies in visibility. With a clear view of users, assets, and permissions, organisations can more readily conduct accurate audits and respond quickly to legal inquiries.

This is especially critical in the age of shadow IT. Doelling emphasises that “the key is visibility, and the more you see, the more protected you are.” Without insight into what tools are being used and by whom, organisations are exposed to both security vulnerabilities and legal risks.

To make this visibility actionable, Doelling advocates for centralisation. “The most efficient way to achieve this clarity is through a unified platform that serves as a single source of truth, simplifying the process of tracking assets and permissions,” he says. This kind of platform not only streamlines security operations but also enables third parties, like auditors or legal professionals, to understand and verify data.

When applied to shadow IT, the benefits become even clearer. “By extending this perspective to shadow IT, you can automate tracking down to the individual user, ensuring that even unapproved IT assets are accounted for,” Doelling notes. This level of insight helps reduce the hidden risks and inefficiencies caused by shadow IT, including escalating costs and compliance gaps.

“As shadow IT becomes a more pressing concern, managing it effectively is no longer optional but essential,” Doelling concludes. “It’s not just about security, it’s about being able to defend your program legally when it matters most.”