Could your security team produce an accurate list of every employee, contractor, guest account, application, and AI agent with access to your SaaS environment today?
In this episode of The Business of Cybersecurity, I speak with Jim Lippie, Chief Product Officer at Kaseya, about findings from the company’s latest SaaS security research. The report draws on anonymized activity from the SaaS Alerts platform, covering 27 billion security events across 50,000 organizations.
One finding immediately stands out. Only 44% of monitored organizations were using multifactor authentication. When the research began in 2022, the figure was 32%. Four years of heightened cyber awareness have therefore produced an increase of only 12 percentage points.
The report also found that guest accounts represented 69% of monitored accounts. This means guest users outnumbered licensed users by over two to one.
Jim explains how these accounts accumulate. A consultant, contractor, or temporary employee receives access to company systems, completes the work, and leaves. The account remains because nobody owns the process of removing it. Over time, these forgotten identities create unattended routes into business data and applications.
Our conversation examines how SaaS has changed the security perimeter. Employees no longer need to be inside an office or connected through a corporate network. A browser, valid credentials, and access to a cloud application may be enough. Security teams must therefore monitor user behavior, permissions, locations, and unusual patterns rather than relying on controls designed around the office firewall.
AI agents add another category of identity. An autonomous system performing workflow tasks may require access to files, email, customer data, financial systems, or internal applications. Jim argues that these agents should be treated like users, with defined permissions and continuous behavior monitoring.
We also discuss the tension created by easy collaboration. The report found that 34% of monitored file sharing traveled outside the organization. That sharing may be legitimate, but businesses need to understand which information has left, who received it, and whether access remains appropriate.
Jim’s advice is deliberately practical. Begin with a complete assessment of the environment. Identify every account and application, require MFA, give guest access an expiration date, monitor behavior, and use overlapping security controls where a second source of evidence can expose missed activity.
Does your organization have genuine visibility across its SaaS environment, or are forgotten accounts and unmonitored identities creating doors nobody remembers opening? Listen to the episode and share your thoughts with me.
Useful Links
Connect with Jim Lippie
Learn more about
[00:00:02] How many people, contractors, forgotten guest accounts and AI agents have access to your SaaS environment? If the answer is not entirely sure, then this episode of The Business of Cybersecurity podcast deserves your attention. Because joining me today is Jim Lippey. He's Chief Product Officer at Kaseya.
[00:00:31] And he's joining me today to discuss a report that is based on 27 billion security events across 50,000 organizations. And the findings reveal that guest accounts now represent 69% of monitored accounts. While only 44% of organizations use multi-factor authentication.
[00:00:57] So Jim will explain today why identity has replaced the office firewall as the security boundary. And we'll also talk about how these orphaned accounts are creating unattended doors into business systems. And why AI agents should also be monitored like human users.
[00:01:18] And we'll discuss everything from external file sharing, layered protection, and the unglamorous security basics that companies continue overlooking while attackers become faster and better equipped. But you've not tuned in just to listen to me. Let me introduce you to Jim right now. So thank you for joining me on the podcast today. Can you tell everyone listening a little about who you are and what you do? Yeah. Yeah. First of all, Neil, thanks for having me.
[00:01:47] It's great to be with you today. My name is Jim Lippey. I am the Chief Product Officer at Kaseya. Well, it's a pleasure to have you join me today. One of the things that set off my tech spidey sensors was coming across your latest SaaS security report, which analyzed a phenomenal 27 billion security events across 50,000 organizations. Phenomenal.
[00:02:10] But looking across all of that data, what do you think the biggest security challenge is that businesses still don't recognize and still are under their radar? What is that? You know, Neil, it's a good question. And really, cybersecurity comes down to paying attention to the fundamentals. And when you look at the report, you know, still only 44% of organizations employ MFA.
[00:02:39] When we started doing this report back in 2022, when we started at SaaS Alerts and all the data is from the SaaS Alerts platform, which I think is important, by the way, for all of your listeners to understand, is that all the data in the report is from actual users.
[00:02:59] We obviously, we aggregate it and we anonymize it, but we see a lot of really great trending information, as you mentioned, because we saw, you know, 27 billion different events last year. So we've been able to look at not just trends over any one given year, but over multiple years. We started producing this report in 2022, 32% of organizations employed MFA, which we thought was very low.
[00:03:30] Even today, you know, it's only a 12, you know, 32 to 44% is only a 12% increase over the last, you know, four years, which, you know, that number should be 100%. And so coming back to your question, some of the things that stick out to me are just a lack of fundamentals from a security approach.
[00:03:53] And in addition, how they're not layering enough of these solutions together to really take advantage of better fundamentals. So one of the other findings in the report is now 69% of all the accounts that we monitor are guest accounts. So what does that mean?
[00:04:19] It means that, you know, nearly 70% of all the accounts that we monitor essentially are, in many cases, orphaned. And we just see this trend continuing year over year over year.
[00:04:37] This number is getting bigger and bigger and bigger because what happens is an organization will issue a guest account, which in many cases is full access to an environment, to a consultant or to a part-timer or, you know, whoever needs access to company's information. And then once their time is up, they never actually terminate the guest account. Yeah.
[00:05:07] So these just end up building up over time and no one ever deletes them. And you might ask, well, why is that a problem? Well, because it's still a door into the environment and bad actors can take advantage of any door, even if it may be closed.
[00:05:28] But they become those guest user accounts are extraordinarily vulnerable because what you don't have is usually users consistently using them and monitoring those accounts and seeing if there's anything unusual happening.
[00:05:43] So, again, coming back to your original question, it's fundamentals and making sure that you have enough technologies in place from a layered standpoint to, you know, look at, from a visibility standpoint, look across, you know, the entire environment and understand what's happening. And I think one of the biggest findings is that trust has become almost a new attack surface.
[00:06:13] That's one of the big findings in the report. And listening to you talk about guest user accounts there, I wonder what happens when we go beyond just user guest accounts and we're looking at individuals, teams, et cetera, all with hundreds, if not thousands of AI agents. So, tell me more about what all this means in practical terms and why it is those identities that is replacing the traditional network perimeter. Yeah.
[00:06:37] So, you know, I've been in this space for a long time, Neil, probably a long time I care to admit, you know, 2003. Yeah. Back then, you know, security was a lot simpler because most people were in an office and the perimeter was, you know, a firewall. And if you had antivirus, maybe some anti-malware, like you are in pretty good shape because it was more or less contained.
[00:07:05] But now you have users that could be anywhere. And most organizations have either work from home policies or satellite offices. You've got disparate users all over the planet and they're using SAS applications. So, all you need is a web browser to log in.
[00:07:30] So, the perimeter as we used to know it is way different than it ever was. So, you've got now to track what is going on with the user, right? You have to look at user behavior. You have to track everything those users do to understand what they're up to and if there's anything unusual happening with them. And when there's unusual things happening, that requires investigation.
[00:07:59] And if there are enough variables that are wrong, what you should have in place is technology that sees the trend and automatically locks an account. And one frightening stat is that before we even think about adding AI agents into the mix, right here, right now, the report found that guest accounts now outnumber the license users by more than two to one, which again is incredibly frightening. So, why has this become such a significant security issue?
[00:08:29] What are organizations doing wrong? What should they be doing differently? What they should be doing is every time a guest user account is set up, they should have a time, especially a point in time where that guest account should be terminated, right?
[00:08:48] And what happens is they issue the permissions to the guest account user and then the user ends up, you know, going away in some way, shape or form. Maybe their contract is up, maybe they're no longer a part-time employee, whatever the case may be. And MSPs and IT departments fail to then terminate those guest user accounts.
[00:09:16] So, they just keep, the number keeps getting bigger and bigger and bigger as a percentage of the overall environment. So, and this is again a trend that we've seen grow over the last four to five to six years. And, you know, there are technologies in place. Like if you use, you know, SaaS sorts for instance, because we actually, we created a technology within our stack, within our security stack.
[00:09:44] You have the ability to actually identify those guest user accounts and disable them automatically to make this a much easier approach. But again, the initiative needs to happen from the environment owners.
[00:10:03] AI is creating enormous opportunities, but also introducing machine identities, our author applications, autonomous services that all need access or an identity to business systems. So, how's this changing the way organizations should be thinking about identity security? Is this message getting through? Yeah, obviously there's a lot of hype around AI.
[00:10:28] I mean, it's like, you can't really go anywhere without hearing about it. Yeah. And there's certainly a lot of advantages to it and people want to take advantage of those advantages. I think what we need to start doing is thinking about AI agents, just like we think of users. Right.
[00:10:49] So, if a, you know, if I'm logging in to an environment as a user, but there's also an agent, an AI agent that's doing, you know, workflow management, they should be monitored. That agent should be monitored just like they're a user. Yeah, 100% with you.
[00:11:09] And looking at your research, it also suggests that attackers are increasingly hired inside trusted cloud infrastructure rather than just trying to break through the front door, which makes perfect sense from an attacker's point of view. But does this mean that some of the more traditional security controls that organizations have relied on for years are just no longer enough from what you're seeing?
[00:11:31] So, you know, as bad actors become more and more sophisticated, and they are very sophisticated, and they're leveraging AI quite well at this point. You just need to essentially combat that with different layers of protection within your environment. So, again, I've been in this industry for a long time, since 2003.
[00:11:55] The technologies that we had available to ourselves back then, obviously were for a much more simple time. Yeah. As attacks and bad actors become more sophisticated, we need to level up. And, you know, so to answer your question, Neil, no.
[00:12:21] You know, technology, you know, the technologies that with traditional technologies are no longer adequate to thwart the threats that are in today's, you know, landscape. So, we need to constantly be evolving the technologies themselves, but also the categories.
[00:12:47] Like, end user companies need to understand that while I know that it costs more, you're going to have – if you want to keep your environment safe, you're going to have to continue to invest in new and different technology categories. To ensure that your business will not be compromised.
[00:13:12] The leading issue of agentic AI in businesses right now is ensuring agents act with compliance guidelines. And Denodo applies guardrails across your entire data estate. By aligning your company's data infrastructure under one system, these guardrails perform consistently across your platform. So, start scaling your business and start with Denodo. Denodo. Simply visit Denodo.com to learn more.
[00:13:40] And for every managed service provider or internal IT team that's listening to this conversation today, what would you say are the biggest mistakes that you see that organizations making when trying to secure their increasingly complex SaaS environments? Any tips or advice here that we can maybe help try and change some of that behavior? I would say, more than anything, pay attention to the fundamentals. It's not glamorous. It's not exciting.
[00:14:10] It's just common sense. Understand where most of your users live. Understand the applications they're leveraging. Identify where the biggest holes are.
[00:14:25] And then make sure that you have a layered approach to your cybersecurity posture to make sure that you are blocking as many of those holes and gaps as you possibly can.
[00:14:43] And if you could leave every business leader that is listening with maybe a practical action plan that they can take and run with, what are the first three signs that they should be prioritizing over the next few months to better reduce that security risk and better prepare for the AI-driven threat landscape, which will probably be in our next conversation? Yeah. Most companies don't understand everything they have in their environment.
[00:15:12] And again, this is not going to be a sexy, glamorous answer, Neil. Yeah. But it really comes back to fundamentals. You need to understand everything that is going on in your environment if you're going to be able to protect your environment. And I can tell you through years of experience, and this goes back decades now to now, the theme has been consistent.
[00:15:36] Most organizations don't have a good handle on everything that is happening in their organization. So what you're going to need is you're going to need a real assessment from top to bottom. And most likely that's not going to happen from one company or one tool. And you're going to need a real assessment from top to bottom.
[00:16:00] And you're going to want to actually double check some of the tools that are running and providing information for you. So it's a second opinion that really is important because there are gaps in technology in terms of what they can pick up and what they see. So you want to make sure that you are providing, in some cases, maybe overlap.
[00:16:25] But that overlap makes sure that you don't miss anything in understanding what's in the environment. And once you understand it fully, where the users are, what the applications they're leveraging, where their vulnerability points that you need to address, then you're in a better position to protect it all.
[00:16:52] And just to finish exactly where we started there, more than a half of monitored accounts in your report show that they're still not protected by multi-factor authentication. If we can change one thing today, hopefully it's that. So for anyone listening that would like to find out more information, contact you or your team or the work that you're doing, the help that you offer. Where would you like me to point everyone? So you can go to caseya.com.
[00:17:17] And obviously, there's a lot of information that we share there about our products, about the research that we do. We can see this report there in full. So as you mentioned before, 27 billion events monitored last year. Over 50,000 organizations globally that we see. So the data is actually pretty comprehensive.
[00:17:44] And you'll see some trending data there that I think will probably shed a light in some of the things that you should be thinking about. One of the things we haven't talked about is, you know, the number of organizations that are sharing data via, you know, Google Workspace or Microsoft 365, sharing information, sharing documents outside their org. One of the great things about SaaS applications is, it's really easy to share information.
[00:18:15] So 34% of organizations or 34% of all file sharing, I should say, goes outside the org. So that is something that people need to pay attention to and make sure that you have data loss prevention technologies in place to make sure you know where that is going and who's seeing it. And I think that is a powerful moment to end on.
[00:18:45] I will include links to the website, to the social channels and that report. I would urge everyone listening to at least go check that report out. There's some enlightening stats in there. So please check that out in the show notes to this episode over at techtalksnetwork.com. Feedback to me. Let me know your takeaways from everything you've heard today. But more than anything, thank you, Jim, for coming on here, talking about this in a language everyone can understand and delivering a very powerful message.
[00:19:11] Hopefully when we talk next year, there'll be some movement in some of these stats. But thanks again. Great, Neil. Thank you. Appreciate it. I think Jim's message is refreshingly direct today. Before buying yet another sophisticated security product, understand who and what already has access to your environment. Guest accounts, they need owners, expiration dates and automated removal.
[00:19:40] Human users and AI agents require monitoring. While MFA should be standard rather than the optional improvement that remains on next quarter's to-do list. And I think Kaseya's report also reminds us that convenience can create exposure.
[00:19:59] The exact same SaaS tools that make collaboration easy has enabled 34% of monitored file sharing to travel outside of the organization. And security fundamentals, they never win the glamour contest. Especially in an age of AI and everyone's chasing the next big thing, the new shiny tech. But attackers, they're quite happy when companies ignore them.
[00:20:27] So let's get back to that belts and braces approach to protecting IT. And indeed the wider business. So thank you to Jim for joining us today. Remember, you can find the complete report and further information at Kaseya.com. And over to you. Can your team confidently identify every active account, every machine identity and every externally shared file if you were asked today?
[00:20:57] Let me know your thoughts. Maybe you can. I'd love to hear from you if you can, if you can't. And any experiences that you've had around this. TechTalksNetwork.com. That's where you'll find me. If you've enjoyed yourself today, please tell your friends, like and subscribe. And please, if you have a chance, leave a review for the podcast. I know every podcast host says the same at the end. But it is because reviews and ratings are like currency to every show out there.
[00:21:25] But that is it for today. So thank you for listening. And I'll be back again real soon with another guest. Bye for now.