To say that organizations across all industries have embraced software-as-a-service (SaaS) applications understates the depth of their embrace of them. No longer is it just one or two or even ten or twenty SaaS applications that organizations use. Large organizations may use hundreds of SaaS applications while smaller ones may use dozens of them or more.
However, in adopting SaaS applications, organizations may fail to grasp the risks that using SaaS applications present. HYCU’s recent release of its 2025 State of SaaS Resilience Report helps quantify the risks that SaaS applications can introduce. In so doing, it offers a sobering reality check on the current rush into adopting SaaS applications.
Everyone Embracing SaaS Applications
Both small and large organizations have broadly embraced SaaS applications. That statement may sound like hyperbole. However, pulling back the covers on SaaS application adoption reveals that all size organizations now embrace them.
To perform this research, HYCU engaged Vanson Bourne that contacted about 500 individuals from various size firms. These individuals were from organizations with 1,000 to 10,000+ employees, in different positions, and worked in multiple verticals.
Its findings largely confirmed that adopting SaaS applications has become the norm. Consider the following statistics that this report shares:
- Organizations use an average of 139 SaaS applications.
- 96% of the respondents have increased their SaaS adoption in the last few years.
- 46% have seen a dramatic increase in SaaS use.
The research also found every business sector experienced growth in SaaS adoption, though some grew at a faster rate. IT and retail reported the fastest growth while those business sectors sensitive to compliance challenges grew more slowly. However, all sectors experienced growth.
Source: HYCU State of SaaS Resilience Report 2025
In discussing these statistics with HYCU, the 139 SaaS applications were the average. In larger organizations with 5,000+ employees, the average was typically more in the 250 – 300 range. HYCU also explained that it defined a “dramatic increase” as an increase in the 10-15% range in the last six months. Notably, when HYCU looked at its own internal adoption of SaaS applications, it similarly experienced this type of “dramatic” growth.
Pace of SaaS Resilience ≠ Pace of SaaS Adoption
Now, here comes the bad news for all those organizations quickly adopting SaaS applications. They have failed to similarly account for the resilience, or protection, of the data in the SaaS applications that they use.
This partly stems from not fully understanding how the protection and resilience of their data stored in SaaS applications works. The report uncovered 66 percent still believe that SaaS providers retain sole responsibility for protecting an organization’s data.
That’s unfortunate. Any reputable SaaS application provider will acknowledge it only retains responsibility for protecting its SaaS application. Its client organizations retain responsibility for protecting data they store in its SaaS application.
However, the report reveals that organizations lack confidence in the ability of SaaS providers to protect their data. For example, the report found:
- More than half of respondents lacked confidence in the SaaS provider’s data protection capabilities.
- 43% of respondents said no one truly owns SaaS security, creating gaps in accountability.
- 44% of respondents struggle to respond to audits and regulatory requirements.
The report also contains one statistic that illustrates how organizations struggle with quantifying and understanding SaaS data protection. On page 11, the report shares that 87 percent of respondents have unprotected data in at least one SaaS application.
I found myself questioning that finding. Having covered HYCU for multiple years, I know it currently offers data protection for 90+ SaaS applications. I also know that HYCU currently provides the broadest coverage of SaaS application data protection in the market.
So that 87 percent statistic stands at odds with what I know. That means, at best, the “average” organization with 139 SaaS applications that uses HYCU will still have ~40 unprotected applications. I interpret this statistic to mean one of the following:
- Organizations underestimate or fail to understand how many SaaS applications they use.
- They may use scripting or do data exports to provide rudimentary protection of their data stored in SaaS applications. (How well this method works to protect data in SaaS applications is a topic for another blog entry.)
A Cybersecurity Gateway into Organizations
But let’s set aside the topic of organizations needing to own protecting their data inside SaaS applications for a moment. That certainly presents a risk to organizations. However, SaaS applications can also allow cybersecurity threats to enter organizations, which represents an even greater risk.
The report found that 65 percent of the respondents had experienced a SaaS-related breach in the past 12 months. Further, the more SaaS applications that organizations use, the more likely they will experience a breach.
Source: HYCU State of SaaS Resilience Report 2025
These breaches translated some sobering financial consequences organizations affected by them. The average cost for SaaS downtime was over $400,000. Further, the cost of recovery for organizations running 200+ SaaS applications ran nearly 5x higher than those with under 100.
Source: HYCU State of SaaS Resilience Report 2025
HYCU State of SaaS Resilience Report Provides Reality Check on Rush into Adopting SaaS Applications
I must give credit to HYCU in producing this State of SaaS Resilience Report and its findings. It could have simply preidentified multiple problems that justified implementing HYCU and found statistics to support its premise. Granted, it partly does that as HYCU seeks to protect data in all SaaS applications, not just a select few.
However, this report went well beyond that premise. It provides organizations with an insightful and sobering reality check on the danger of rushing into adopting SaaS applications.
Many organizations already know they retain the responsibility of protecting the data they store in SaaS applications. However, this report uncovered that many organizations still do not fully recognize they have that responsibility across all SaaS applications that they use.
Perhaps the report more importantly reveals the growing cybersecurity threat that the use of SaaS applications represents. Most organizations know that many bad actors use Microsoft 365 as a gateway to enter organizations. They therefore take steps to account for that threat.
However, I wonder how many consider the cybersecurity threat that SaaS applications such as GitHub, Salesforce, or Zoom may present. Losing data inside them would certainly be inconvenient and potentially disruptive. However, having a hacker use any one of them as a gateway into an organization to perform a cybersecurity attack could be catastrophic.
As such, it merits that organizations consider registering for and downloading this report available on HYCU’s site. The report does more than give them an understanding of the importance of protecting the data they store in their SaaS applications. It quantifies and provides a reality check on the cybersecurity threat that the use of any SaaS application potentially presents.
KEEP UP-TO-DATE WITH DCIG
To be notified of new DCIG articles, reports, and webinars, sign up for DCIG’s free weekly Newsletter.
To learn about DCIG’s future research and publications, see the DCIG Editorial Calendar.
Technology providers interested in licensing DCIG TOP 5 reports or having DCIG produce custom reports on their behalf, please contact DCIG for more information.
Author’s note: HYCU is a client of DCIG.