Software as a service (SaaS) is a model where you use a provider's application over a network and the provider runs the infrastructure and code. NIST's definition says you do not manage the underlying servers, with the exception of limited user-specific settings. Security is shared: the provider secures the platform, you secure users, configuration and data.
What is the official definition?
NIST Special Publication 800-145 defines cloud computing through five essential characteristics, three service models and four deployment models. The three service models are Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS).
In the SaaS model, the capability given to the consumer is to use the provider's applications running on a cloud infrastructure. The applications are reachable from client devices through something like a web browser or program interface. The consumer does not manage or control the underlying network, servers, operating systems or storage, with the possible exception of limited user-specific application configuration settings.
That last clause is the important one for security teams. The settings you do control are where most of your risk sits.
Who is responsible for what?
The UK NCSC describes a shared responsibility model: security and availability of data and workloads is a joint responsibility between provider and customer, and how much each party owns depends on the type of service. The provider almost always owns physical protection and availability of its servers. With SaaS you cede the most responsibility to the provider, but, as the NCSC's SaaS guidance notes, you remain responsible for the configuration specific to your use of the application.
A fair split looks like this:
- Provider: data center, network, platform code, patching, tenant separation, backups of the service.
- You: who has an account, how they sign in, what roles they hold, which data goes in, which integrations are connected, what is shared outside the company, and how you respond when something goes wrong.
What goes wrong in practice?
A constructed example: a 60 person company adopts a project tracking tool. A manager invites contractors with a shared guest login. Six months later, one contractor leaves, the shared password is unchanged, and customer files remain attached to old tickets. The vendor did nothing wrong. The tenancy was never set up for offboarding.
Typical failures in SaaS tenancies:
- Single sign-on and multi-factor authentication left off or optional.
- Admin roles granted broadly and never reviewed.
- Public sharing links that never expire.
- Third-party apps and API tokens connected and forgotten.
- Departed staff whose accounts stay active.
- No export plan if you need to leave.
How should you review a SaaS application?
The NCSC's SaaS guidance is organized as a set of actions that can be done with controls the application offers. They include understanding the application and its purpose, managing user onboarding and offboarding, strong authentication, protecting administration, managing standard user permissions, using trusted devices, protecting data, managing service identities, planning incident response, monitoring for security incidents and maintaining posture over time.
It also warns against locking an application down so far that users turn to shadow IT. Disable features that offer no value, but keep the tool usable.
For vendor due diligence, ask for independent assurance reports and the provider's own security documentation, and check what logs and export functions you get as a customer.
How to check or apply this
- List every SaaS application in use, including ones adopted by single teams. Name an owner for each.
- Require single sign-on and multi-factor authentication where offered.
- Review admin roles and external sharing settings each quarter.
- List connected third-party apps and API tokens, and remove what is unused.
- Tie account removal to your leaver process, and test it.
- Confirm how to export your data, and which audit logs you can access.
Quick check
Is SaaS more secure than running software ourselves?
Often the platform is better run, but your configuration still determines your risk. The answer depends on the provider and on how well you set up your tenancy.
What is the difference between SaaS and PaaS?
With SaaS you use a finished application. With PaaS you deploy your own application onto a managed platform, so you own the code and its security.
Sources
- NIST SP 800-145, The NIST Definition of Cloud Computing
- NCSC, Using SaaS securely
- NCSC, Cloud security shared responsibility model
Last reviewed: 18 October 2026.
