SSPM, CSPM, CASB, OAuth scopes and drift, a glossary of mixed up terms

SSPM checks the settings and access inside your SaaS apps. CSPM does the same for cloud infrastructure accounts. CASB sits between users and cloud services to control traffic. Shadow SaaS is apps staff adopted without approval. Each answers a different question, and products often blend them.

SaaS

Software you use over the internet, run by the vendor: mail, chat, file sharing, ticketing, CRM, HR. You control settings, users and data, but not the infrastructure. That split is why SaaS needs its own checks.

SSPM (SaaS security posture management)

Tools or practices that check configuration and access inside SaaS apps against a baseline: is multi factor required, who are the admins, is public sharing on, which third party apps are connected. It works through the apps' admin interfaces and APIs.

Question: are our SaaS settings and accounts safe?

CSPM (cloud security posture management)

The same idea for cloud infrastructure accounts: storage that is public, roles that are too broad, logging that is off. It covers compute, storage and network, not the apps your staff log into.

Question: is our cloud infrastructure configured safely?

CASB (cloud access security broker)

A control point between users and cloud services. It can see which services people use, apply rules on uploads and downloads, and block some activity. It focuses on traffic and usage rather than internal settings.

Question: what are people doing in cloud services, and should it be allowed?

Shadow SaaS (shadow IT)

Apps adopted without security review, often with a corporate login or a personal one. They hold data you do not know about. Discovery comes from expense reports, single sign on logs, browser data and network logs.

Question: what apps are in use that we did not approve?

Misconfiguration

A setting that makes an app less safe than intended, such as a file sharing default that allows anyone with the link. It is the most common SSPM finding. It is not a vulnerability in the vendor's code. The vendor patches code, and you set settings.

Configuration drift

A change over time from your intended baseline. Someone turns off a rule to fix a problem and never turns it back on. SSPM tools compare current state with a baseline and flag the difference.

Question: what changed since we last checked?

Baseline

The settings you decide are required for each app. It is your standard, written down. Without one, a tool can only report generic issues.

OAuth grant (third party app access)

When a user lets an outside app access their account, such as a calendar tool reading mail, the app receives a token with certain permissions. Those grants persist after the user forgets them. Review them: which apps, with what scope, granted by whom.

Scope

The set of permissions an app or token holds. Narrow scope means less access. A broad scope on a small tool is a warning sign.

Over privileged account

A user or service with more rights than their job needs. Admin accounts in SaaS are common examples. Counting and trimming admins is a quick win.

Dormant account

An account that has not been used for a long time. It is still a way in. Remove or disable it after a defined period.

SaaS supply chain

The apps connected to your apps, and the vendors behind them. A compromised connected app can reach the data it was granted. Treat third party integrations as dependencies, with owners and review dates, in the way you treat software libraries.

Where Safeguard fits

SSPM is not something Safeguard offers. Safeguard focuses on the application and software supply chain side, and does not replace an SSPM, CSPM or CASB tool. The software supply chain idea above applies in its own domain: policies and gates at build, CI and release.

How do these terms show up in an audit?

Auditors rarely ask for a product category. They ask for evidence of controls: that access is reviewed, that multi factor is enforced, that departed staff lose access and that changes to critical settings are tracked. SSPM and similar tools can supply that evidence, but so can a dated export and a signed review. Map each control you must show to the term above that covers it, then choose the lightest way to produce proof on a schedule.

What to do

1. Write a baseline of required settings for your top five SaaS apps.
2. List admins and dormant accounts and trim them.
3. Review third party app grants monthly.
4. Find shadow SaaS through single sign on and expense data.
5. Check for drift on a schedule.
6. Pick tools by the question you need answered.

Quick check

Sources

1. NIST SP 800-137, Information Security Continuous Monitoring

Last reviewed: 18 October 2026.