An open-ended series on securing a SaaS: tenant isolation, identity and SSO, billing and abuse, compliance and incident response — no fixed table of contents, planned one part at a time.
Part 1 of an open-ended SaaS security series: the multi-tenant mindset, three isolation models, the four rules that stop cross-tenant leaks, and the footguns that bypass them.
Part 2 of the SaaS security series: social login vs enterprise SSO vs SCIM, SAML 2.0 vs OIDC in procurement reality, the build-vs-buy landscape, and the controls buyers actually check.
Part 3 of the SaaS security series: what belongs in an audit event, what must never be logged, the write path that can't drop events, tamper-evidence with hash chains, and why the export is the actual product.
Part 4 of the SaaS security series: webhook signature verification and replay defense, the entitlement write path, PCI DSS 4.0.1's payment-page script rules, card testing in the VAMP era, and what a merchant of record actually moves.
Part 5 of the SaaS security series: attestation vs certification, what auditors actually sample, the observation window that can't be cram-studied, subservice providers and CUECs, and why evidence is a pipeline rather than a scramble.
Part 6 of the SaaS security series: the disclosure clocks that start at awareness, the first-hour sequence that decides the postmortem, containment as a business decision, and why a tested IR plan is the cheapest control you own.
Part 7 of the SaaS security series: why most of your traffic isn't human, the economics of trial farming, the graduated friction ladder, detection over prevention, and why your users' stolen passwords are your roadmap item.
Part 8 of the SaaS security series: envelope encryption as the only architecture that matters, per-tenant keys and crypto shredding, what BYOK and HYOK buyers actually want, and the post-quantum migration already underway.
Part 9 of the SaaS security series: the 2025–2026 npm attack wave, what provenance proves and what it can't, the consumer-side checklist that costs an afternoon, and the CI trust boundaries where the real bugs live.
Part 10 of the SaaS security series: the enforcement backdrop in 2026, minimization as architecture, retention that actually deletes, the DSAR as a distributed query with a deadline, and the transfer problem that owns the biggest fines.
Part 11 of the SaaS security series: the lethal trifecta every useful agent ships with, config files as execution vectors, MCP as the new npm, agents in CI as exfiltration channels, and the guardrails that are controls rather than instructions.
Part 12 of the SaaS security series: the Salesloft Drift breach anatomy, the inventory nobody can produce, integrations as non-human identities, the contract layer that actually matters, and why offboarding is where risk retires.
Part 13, the capstone of the SaaS security series: the twelve parts distilled into one map, the maturity order that is a strategy rather than a shopping list, the principles that survived every part, and the cadence that keeps controls alive.