The unmanaged stack: Governing SaaS apps and AI tools outside SSO

Note: This blog is a recap of 1Password’s recent webinar, “The unmanaged stack: Governing SaaS apps and AI tools outside SSO.” Head here to watch the complete webinar recording. In the constantly evolving world of enterprise tech, there’s one thing that IT and security teams have always been able to count on: users won’t follow policy if they think it’s standing in the way of their productivity. Case in point: 1Password’s most recent annual report found that 52% of employees have downloaded apps without IT approval. These shadow IT apps typically sit outside a company’s SSO provider, and introduce both unmanaged risk and cost. That governance gap has become more pressing with the growing adoption of AI tools and agents, which introduce new and worsening threats. This issue was the focus of 1Password’s recent webinar, “The unmanaged stack: Governing SaaS apps and AI tools outside SSO.” What is the unmanaged stack? It refers to all of the SaaS apps and AI-based tools that can’t be managed by traditional IAM tools, whether that’s due to software constraints or the infamous “SSO tax.” During the webinar, Evan Sandhu, 1Password Product Marketing Specialist, and Ethan Stoler, Senior Demo Engineer, explored how 1Password’s solutions can help IT and security teams secure and govern these unapproved or unmanaged access points. Key takeaways from the webinar: SaaS and AI tools outside SSO create governance blind spots and can introduce supply chain risk. 1Password SaaS Manager helps discover unmanaged SaaS and AI usage, and help IT teams centralize provisioning, auditing, and lifecycle management. New integrations within 1Password support governance for ChatGPT, Claude, Cursor, and Gemini. Read on for an in-depth recap of the webinar’s key themes. New integration features to manage high-risk SaaS and AI IT and security teams need solutions to manage those apps that fall outside the purview of SSO. Thankfully, new integrations between 1Password Enterprise Password Manager (EPM) and 1Password SaaS Manager are able to do just that. “With SaaS Manager integrating with EPM, you can now discover sensitive and shared accounts stored in EPM vaults, surface them for review, and let IT take ownership of them, moving them from end-user management to IT management.” – Evan Sandhu, The unmanaged stack: Governing SaaS apps and AI tools outside SSO During the webinar, Evan Sandhu explored how these integration features work across three different categories: Discover: With Vault Insights, teams can discover sensitive or shared logins across an organization’s EPM vaults. And with Browser Insights (beta) teams can surface login activity from the 1Password browser extension to reveal unapproved app usage. Review: With an Account Risk Report, teams can review the surfaced accounts and credentials according to their risk level, enabling admins to prioritize remediation. Govern: With Account Governance, IT and security teams can take over management of any of the discovered high-risk logins for sensitive or shared accounts. In a live demo of these features, Ethan Stoler showed in real time how quickly this integration can surface various credential risks for critical applications like GitHub, and how simple it is for admins to govern those risks. How 1Password SaaS Manager helps prevent OAuth supply chain attacks OAuth-based supply chain attacks are a growing concern for today’s companies. These attacks tend to play out like so: An employee connects a third-party tool using “sign in with Google” or “sign in with Microsoft.” Permissions are granted, then forgotten. That third-party tool gets compromised. The attacker walks into your systems with a valid key. In this scenario, the attacker is making authenticated requests within the approved permission scopes; there are no failed logins, anomalies, or privilege escalation attempts that can be detected by a team’s SIEM provider, CASB, or anomaly detection tools. The key to managing this risk doesn’t lie in preventing every OAuth connection or blocking every third-party tool. Rather, as Sandhu put it during the webinar, “Prevention requires knowing which connections exist right now at this moment, and ensuring access is granted only when needed. This is exactly what 1Password SaaS Manager does.” 1Password SaaS Manager can help companies: Discover risky OAuth connections: Teams can continuously surface Oauth connections and flag connections with elevated permission scopes. Secure Access: Admins can revoke access with a single action, set policies to restrict OAuth, and reduce standing privilege exposure. Audit Actions: Every access change is automatically logged, providing teams with defensible audit records for compliance standards like SOC 2, ISO 27001, and HIPAA. These abilities mean that 1Password SaaS Manager is uniquely able to help teams manage risks related to OAuth supply chain attacks – and the other risks associated with a company’s unmanaged stack of shad

Excerpt shown under the publisher's RSS terms · 120 words · full text and figures are on the publisher's site