Intro: Why hack in when you can log in?
SaaS applications are the backbone of modern organizations, powering productivity and operational efficiency. But every new app introduces critical security risks through app integrations and multiple users, creating easy access points for threat actors. As a result, SaaS breaches have increased, and according to a May 2024 XM Cyber report, identity and credential misconfigurations caused 80% of security exposures.
Subtle signs of a compromise get lost in the noise, and then multi-stage attacks unfold undetected due to siloed solutions. Think of an account takeover in Entra ID, then privilege escalation in GitHub, along with data exfiltration from Slack. Each seems unrelated when viewed in isolation, but in a connected timeline of events, it’s a dangerous breach.
Wing Security’s SaaS platform is a multi-layered solution that combines posture management with real-time identity threat detection and response. This allows organizations to get a true identity map of their SaaS ecosystem, detect and respond rapidly to threats, and prevent future attacks.
Getting started with SaaS visibility and coverage
You can’t protect what you don’t know. The majority of existing solutions (IAM, PAM, IAM, etc.) do not cover SaaS applications or lack the depth needed to detect SaaS threats. This is why the first step is to overcome shadow IT and get complete visibility into the organization’s stack, including all apps, accounts, and all the hidden third-party integrations that security teams have no clue about.
Wing’s discovery approach is non-intrusive, without agents or proxies. It simply connects through APIs to major IdPs (like Okta, Google Workspace, and Azure AD) and to business-critical SaaS applications (from Microsoft 365 and Salesforce to Slack, GitHub, etc).
Wing discovers:
- Human (users) and non-human (service accounts, API keys, etc.) identities.
- App-to-app connectivity and third-party integrations and their permission scopes.
- AI-powered applications and data usage.
- MFA status, admins in the different SaaS applications (including stale admins)
Visibility alone isn’t enough. Understanding identity behavior in SaaS apps is key to detecting and responding to real threats in time. That’s where Wing’s identity-centric threat detection layer comes in.
Want to see Wing in action? Request a demo with one of our security experts.
SaaS Identity Threat Detection — From scattered logs to a clear attack story
Wing maps identity events and IoCs to represent how attackers think. It then correlates them with MITRE ATT&CK techniques to transform long and messy SaaS logs into one clear attack story – simplifying investigations, reducing alert fatigue, and speeding up median time to resolution (MTTR).
Every detection is enriched with threat intelligence for context: IP reputation (geolocation and privacy), VPN/Tor usage, and more. So, instead of digging through raw logs for days, analysts can understand the attacker’s playbook in a few minutes.
A real-life example of how hackers try to exploit identities:
- Step 1 – Password spray attempt: A password spray attack targeting multiple user accounts within the Entra ID environment. The attacker attempted to log in using credential-based attacks to compromise one or more user accounts without triggering lockout mechanisms.
- Step 2 – Cross-account user agent overlap: Login attempts across multiple accounts from the same user agent (UA) confirmed that the attacker was systematically testing credentials at scale during the reconnaissance phase.
- Step 3 – Successful login post-reconnaissance: The attacker successfully logged in to an account. This login matched the same user agent used during the reconnaissance phase, indicating that credentials were compromised via the earlier password spraying activity.
- Step 4 – Privilege escalation via role assignment: The attacker escalated the compromised account’s privileges by assigning it administrative roles in Entrad ID. This granted the attacker broader visibility and control, including access to OAuth-connected third-party services like GitHub.
- Step 5 – Data exfiltration from GitHub: With elevated privileges, the attacker leveraged the Entra ID account’s linked GitHub access to infiltrate internal repositories. Activity logs indicate that private repositories were downloaded, including projects that may contain source code, API keys, or internal documentation. The attacker used this foothold to exfiltrate sensitive intellectual property directly from GitHub.
Attack path timeline
The threat timeline (Ref. Image #2) is more useful than logs alone, as it presents all SaaS detections with context. Each detection has a detailed context on the affected identity, the trigger, and where and when it occurred (app, timestamp, geolocation).
The attack path timeline helps security operations teams:
- Visualize how the attack unfolded with a chronological view of related detections.
- Map each detection to MITRE ATT&CK techniques, like active scanning, valid accounts, account manipulation, etc.
- Enrich the alert with context and IoCs, IPs, user agents, geolocation, VPN/Tor, and evidence.
- Connect anomalies with routine activity (e.g., permission changes after a successful brute force).
Prioritize threats
Not all security threats are created equal. Every threat is assigned a breach confidence score, quantifying the likelihood that a threat will result in a successful breach. This metric is calculated based on factors such as:
- The type of detections (i.e., password spray, spike in activity, etc.)
- The number of detections per threat (i.e., one identity has 4 detections)
- The tactic of the attack based on MITRE ATT&CK (i.e., initial access, exfiltration, etc.)
SecOps can sort and focus on the most critical threats first. For example, a single failed login from a new IP might be low priority when viewed on its own, but a successful login followed by data exfiltration would get a higher confidence score. In the dashboard, you can see a prioritized threat queue, with high-severity threats at the top that deserve immediate attention and lower-risk ones further down, cutting through alert fatigue and providing real threat detection.
Want to see Wing in action? Request a demo with one of our security experts.
Track threat status & progress
Wing’s tracking structure helps SecOps stay organized and avoid threats slipping through the cracks. Teams can update statuses and track every threat from creation to resolution.
Main functionalities:
- Flag threats for follow-up for efficient prioritization or for monitoring specific cases.
- Flag threats to trigger a webhook event so they’ll appear in external systems like SIEM or SOAR and not be overlooked.
- Update threat status based on the investigations conducted by the SOC and IR teams.
Resolve fast with concise mitigation guides
When SecOps drill down into a specific threat, they get a customized mitigation playbook with steps tailored to the specific attack type and SaaS application. The mitigation guides include:
- Tailored recommendations for each detection type
- Relevant documentation (e.g., how to configure Okta policies)
- Best practices for addressing root cause and preventing recurrence (posture)
Prevention: Checking for the root cause
After the threat has been stopped, you’ll need to ask yourself what facilitated this threat to succeed and how can you make sure it won’t happen again.
Security teams should check if these events are related to underlying risk factors in the organization’s SaaS configurations, so they aren’t just treating the symptoms (the active breach) but are addressing the root cause.
This is possible because Wing’s platform is layered, combining SaaS security posture management (SSPM) with identity threat detection capabilities. Wing continuously monitors for misconfigurations (based on CISA’s SCuBA framework), pinpointing those risky settings – like accounts without MFA or admin tokens that never expire.
Wrap-up: Closing the security loop
Wing Security brings clarity to SaaS chaos through a multi-layered security platform that combines deep visibility, prioritized risk management, and real-time detection. By combining posture management (SSPM) and identity threat detection and response (ITDR), organizations can reduce risk exposure, respond to threats with context, and stay ahead of SaaS identity-based attacks.
Book a demo with Wing to find blind spots, catch threats early, and fix what puts your business at risk.
About The Author
Original post here
