SaaS has revolutionised the workspace, and it shows no signs of slowing down. Only 10 years ago, I would have been writing this in a Word document that was saved locally on a network computer, before uploading it to the internet.
Today, I am writing the draft of this article on a Notion workspace, hosted entirely in the cloud. I can embed a Google Sheets document onto this page, which is synced with Hubspot and Airtable. I can then add automatic Slack notifications which will be delivered by Zapier to tell me when someone has opened the page. Data sprawled everywhere… all with a simple /command.
The world is so different. The way data flows between apps, people, and physical locations has never looked like this. Just think, I’m only one click away from sharing my entire CRM with anyone on the internet. In fact, anyone in my company can do this.
And I’m five clicks away from giving another company access to my entire Slack workspace, where you can find all my employees' phone numbers, every lead that’s signed up on our website, every customer action that’s been taken in our dashboard, and so much more.
But it isn't just me that is a matter of clicks away from giving away my sensitive information. I have a team creating Google docs, Airtables, Notion pages, Jira tickets, Slack Connect channels, and probably a bunch of other tools I don’t even know about, every hour of every day.
Every person in my company is a matter of clicks away from leaking sensitive data, simply in the natural course of doing their jobs. And our team is growing fast. How much worse will this problem become when we’re 5,000 people distributed all over the world with dozens of employees coming and going every day? Hundreds of contractors? Thousands more interconnected apps? It quickly becomes a privacy, security, and compliance nightmare.
Just five years ago, ‘cybersecurity’ was Googled 30% as often as it is today. Regulations like GDPR and CCPA didn’t even exist, and security breaches were 50% less frequent than they are today. Things are changing, rapidly.
“Your data matters” is the ultimate promise that every company is having to make.
The type, volume and cadence of sensitive data generated by companies are growing exponentially. The ever-increasing adoption of SaaS tools means that sensitive data is now distributed across hundreds of platforms, all of which have their own data schema, APIs, and native security controls. What makes this extremely challenging is:
Out-of-the-box risk detections don’t work. The one-size-fits-all approach has its limitations in modern security. Antivirus, EDR, and similar black-box products are only exposing the top layer — “I blocked X, now you are safe”. While it’s a good start, it’s no longer sufficient and it often gets in the way. To operate effectively, mature security professionals need visibility into the deeper layers of not just technology, but the data itself.
IAM tools like Okta are going to help you control who can get into SaaS apps. SSPM tools like AppOmni are going to help you manage the next layer of surface security (if there are misconfigurations, if one of your vendors has had a data breach, how many third-party bots you have integrated, etc).
They can alert you to a binary incident / failed test, but who gives you continuous visibility and control over how employees are using sensitive data inside these apps? People can still upload, view, copy, share, and download sensitive data to any extent they wish. It’s a complete wild-west of sensitive data activity inside SaaS applications; companies have no visibility or control, and the world is starting to wake up to this new dimension of risk.
That’s why we built Metomic. We saw the opportunity to disrupt SSPM to bring the power of semantic data risks insight to the SaaS/infrastructure layer. This is a fundamentally missing concept from almost all security management tooling. Put simply: there is limited value in controlling access and surface-level configuration to SaaS apps when you have no visibility or control over what data is sitting where and who it’s accessible to.
Offering companies this deep visibility and granular control, Metomic gives them the knowledge they need to ensure their sensitive data is protected.