Why Most SSPM Tools Fail at the “Unknown Unknowns”

Martin Snyder
Sep 4, 2025
4 min read

If you keep finding surprise apps, duplicate tenants, or mystery OAuth connections, you’ve hit the limit of traditional posture tools. Waldo Security discovers every SaaS app and account in minutes—including shadow tenants and AI plug-ins—then helps you enforce SSO/MFA, right-size risky OAuth permissions, automate offboarding, and export audit-ready evidence. Start with Instant SaaS Discovery, then keep auditors happy with our SaaS Compliance Overview.

The core problem: posture without a map

Classic SSPM assumes you already know what to monitor. It integrates with the usual suspects, checks settings, and reports drift. That’s helpful—but only for known services. In real environments, portfolios average ~106 apps, and many live outside formal catalogs. If your tool can’t see them, it can’t protect them. (BetterCloud)

Public guidance agrees: inventory + least privilege + logging is the bedrock of cloud/SaaS security. Posture is step two. If your stack starts at step two, “unknown unknowns” slip through. (CISA)

Where “unknowns” hide (and why SSPM misses them)

Duplicate tenants & unmanaged workspacesPilots become production in a separate tenant with default settings and local passwords. Catalog-based SSPM never connects to what it doesn’t know exists.
OAuth persistence (the quiet backdoor)One “Sign in with …” later, an app gets broad scopes plus offline_access—refresh tokens that keep access alive even after a password reset. Without centralized consent governance, these never show up on your radar. Microsoft’s Entra docs explicitly recommend restricting end-user consent to low-risk permissions and verified publishers. (Microsoft Learn)
Browser-level AI and extensionsShadow AI use is rising across organizations; many assistants run under personal identities and move snippets of tickets, code, or contracts off-platform. Netskope’s 2025 data shows orgs now use ~9–10 genAI apps on average—most adopted before policy catches up. (Netskope)
Guests, contractors, and personal accountsEven when suites are behind SSO, guests and unmanaged identities accumulate high-privilege roles over time and get missed during offboarding.
API tokens that outlive peoplePATs and app tokens often bypass the front door. If your tool only checks UI settings, these durable credentials hide in plain sight.

Why it matters: attackers love the path of least resistance. In the 2025 Verizon DBIR, stolen credentials remain a dominant driver of basic web-app breaches—exactly what proliferates in unmonitored apps and tokens. (Verizon)

Five questions to expose your SSPM blind spots

Can it discover unsanctioned apps without an API key?If your tool only “sees” what you connect, it will never catch shadow estates. You need multi-signal discovery (IdP sign-ins, email/collab logs, DNS/proxy, browser extensions, and expense data).
Does it inventory OAuth grants across suites?Look for scope-aware risk scoring (e.g., *.ReadWrite.All = big blast radius) and persistence detection (offline_access), with easy bulk revocation. Microsoft’s consent model supports enforcing verified publishers and low-impact scopes for users. (Microsoft Learn)
Can it tie identities across tenants, guests, and personal accounts?The same human often appears as multiple accounts. You need stitching that flags non-SSO logins and unmanaged identities.
Does it surface genAI usage and extensions?If the tool can’t see browser-level AI and plug-ins, a growing slice of your egress is invisible. Netskope’s trendline explains why this blind spot is expanding. (Netskope)
Can it prove coverage continuously?Auditors (and insurers) now expect fresh, exportable evidence—not screenshots the night before: SSO/MFA coverage, admin changes, OAuth diffs, offboarding timestamps, public-link exceptions. CISA’s reference architecture is clear: visibility and monitoring aren’t one-and-done. (CISA)

The upgraded playbook: Find → Fix → Prove

1) Find what’s real (not just what’s integrated)

Aggregate signals from your IdP, email/collab, DNS/proxy, browser extensions, and spend to build a living inventory of apps, tenants, accounts, and OAuth grants. Tag auth method (SSO vs local), admin count, scopes, and data sensitivity. This aligns to zero-trust fundamentals: asset visibility before control. (CISA)

With Waldo: SaaS Discovery does this in minutes, including shadow and AI tools.

2) Fix the blast radius fast

Enforce SSO/MFA on high-sensitivity apps first.
Cull admin sprawl and time-box elevation.
Tighten consent: verified publishers only; admin approval for high-privilege scopes. Microsoft provides the exact knobs. (Microsoft Learn)
Kill persistent tokens (unused refresh tokens, stale PATs).These moves directly counter the DBIR’s credential-driven web-app patterns. (Verizon)

3) Prove it continuously

Stream SaaS audit logs to your SIEM; generate monthly packets with SSO/MFA coverage, admin changes, OAuth diffs, offboarding evidence, and sharing exceptions. That’s how you answer customers, auditors, and insurers without a scramble. (CISA)

With Waldo: Exportable evidence lives in the SaaS Compliance Overview.

A 30-day plan you can actually finish

Week 1 — See it: Run discovery; tag owners, auth method, admins, scopes, sensitivity. Flag apps with usage or spend but no SSO.
Week 2 — Stabilize: Enforce SSO/MFA on top-risk apps; remove stale admins; revoke idle offline_access tokens; restrict user consent to verified, low-impact scopes. (Microsoft Learn)
Week 3 — Seal egress: Turn off default public links in sensitive spaces; review external guests; restrict genAI to an allowlist. Netskope’s data shows why this matters. (Netskope)
Week 4 — Prove: Wire logs to SIEM; enable drift alerts (new apps, admins, high-privilege grants, public links); export your first monthly evidence pack. (CISA)

Bottom line

Most SSPM misses the riskiest 10% of your estate because it starts with what’s already known. The attacks haven’t changed—credentials + web apps are still the easiest path in—but the edge has: shadow tenants, OAuth sprawl, and AI plug-ins grow daily. (Verizon)

Flip the order: discover first, then posture. When you can see everything, harden what matters, and prove it continuously, the “unknown unknowns” disappear—and so do the surprises in incidents and audits.