Sep 7, 2026 · 29 min · 9 segments
SSPM is dead, long live SaaS Security and AI Governance. When Matthias and Matthew last spoke in February, SaaS Security Posture Management was the topic. Six months on, the market has moved…
Matthias ReinwarthHostWe want to identify whether a SaaS application, something in the cloud, those nice applications that are so helpful are used within your company without permission.
If people are using AI in a way within your organization that is really not expected.
whether they're connecting any data sources, any other cloud services to your AI that you did not expect to do so and where you do not want the data to go there.
So it's even a recursive acronym because the first S stands for S-A-A-S for SaaS.
And when you joined me, Matthew, in February for the very first time for an episode, this was also our first topic.
So we were looking into SaaS Security Posture Management and how it was evolving so that it was changing.
It was encompassing shadow SaaS configuration drift or auth risk and anything like that.
So I came up with the name for this space, SaaS Security and AI Governance, the and being critical.
And, and, um, there's a lot of parallels between those two worlds, the shadow SAS and shadow AI are sort of happening in the same way.
Um, The way that things are discovered shares a lot of the same functionality.
You have this new type of identity called an AI agent, but nonetheless, the identity and the controls and the monitoring around identities, both human and non-human, share a lot of commonality.
So you have this more complete solution space for what is a very sort of interrelated security challenge between SaaS applications and AI systems.
if I understand you correctly, you mean this and in between really, really as important.
We want to identify whether a SaaS application, something in the cloud, those nice applications that are so helpful are used within your company without permission.
If people are using AI in a way within your organization that is really not expected.
whether they're connecting any data sources, any other cloud services to your AI that you did not expect to do so and where you do not want the data to go there.
So it's even a recursive acronym because the first S stands for S-A-A-S for SaaS.
And when you joined me, Matthew, in February for the very first time for an episode, this was also our first topic.
So we were looking into SaaS Security Posture Management and how it was evolving so that it was changing.
It was encompassing shadow SaaS configuration drift or auth risk and anything like that.
So I came up with the name for this space, SaaS Security and AI Governance, the and being critical.
And, and, um, there's a lot of parallels between those two worlds, the shadow SAS and shadow AI are sort of happening in the same way.
Um, The way that things are discovered shares a lot of the same functionality.
You have this new type of identity called an AI agent, but nonetheless, the identity and the controls and the monitoring around identities, both human and non-human, share a lot of commonality.
So you have this more complete solution space for what is a very sort of interrelated security challenge between SaaS applications and AI systems.
if I understand you correctly, you mean this and in between really, really as important.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
