Strengthened Security

Evidence and data. Interviewees said the Obsidian SaaS Security platform provides continuous visibility into activity, configurations, and integrations across their organizations’ SaaS environments, which enhanced their overall security postures, improved visibility, and reduced SaaS-related risks. They said that with earlier detection of misconfiguration and exposure paths and being able to remediate faster, their organizations reduced the likelihood of a SaaS-related breach and the risk of exposure to a breach by 20%. This improved security effectiveness and enabled teams to proactively address risk in a timely manner.

• A SaaS security team lead at a manufacturing company told Forrester: “Since deploying Obsidian, we have significantly reduced our attack surface. It has been a very low effort to remediate critical-level risks that we have identified through the solution.”

• A VP of information security at a biotechnology company shared: “Obsidian gives us a clear, holistic view of where real risks exist across our SaaS environment. It helped us prevent misconfigurations and stop potential data exfiltration before it became a larger incident.”

• A chief information security officer at a healthcare company shared: “As our organization has grown, we have consumed more SaaS. As we have added new SaaS applications into our operations, we have connected them to Obsidian. The solution has instantly exposed misconfigurations we were not aware of. We have been able to remediate them right away, reducing our attack surface and risk.”

• A SaaS security engineer at a financial services company told Forrester, “Obsidian reduced our attack surface and risk exposure.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization has annual revenue of $9 billion.

• The composite organization’s annual breach costs prior to using Obsidian SaaS Security are $3,098,000.²

• The platform reduces the composite’s risk of exposure to a breach by 20%.

Risks. Potential risks that can impact this benefit include:

• The extent to which the organization leverages Obsidian SaaS Security for identity threat detection and response, SaaS security posture management, and identity threat prevention.

• The specific goals and activities of the organization to manage threat detection and response, security posture management, and identity threat prevention.

• The annual revenue of the organization.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.3 million.

Avoided Labor Costs

Evidence and data. Interviewees explained that the Obsidian SaaS Security platform enabled their organizations to avoid incurring development and engineering costs associated with building and deploying supplementary tooling necessary to effectively manage identity threat detection and response, SaaS security posture management, and identity threat prevention. As a result, interviewees’ organizations avoided hiring security experts and scaled SaaS and AI adoption without corresponding increases in headcount.

• A SaaS security team lead at a manufacturing company told Forrester: “If we did not have Obsidian, we would have needed to hire data scientists to normalize the data from all the different platforms, senior engineers and architects to build detection logic, and additional staff to handle day-to-day security operations. Obsidian allowed us to avoid building and staffing that entire capability.”

• A VP of information security at a biotechnology company shared: “Our team does not have expertise in every SaaS application. Without Obsidian, scaling SaaS adoption securely would have required hiring security experts for each platform just to ensure configurations and access were handled correctly.”

• A chief information security officer at a healthcare company shared: “We have a small number of subject matter experts in our organization, but not for every SaaS platform. And as we have expanded our operations and added more SaaS, we would have needed to hire several security experts. Without Obsidian, that headcount would have grown.”

• A SaaS security engineer at a financial services company told Forrester: “Obsidian has enabled our organization to avoid incurring additional labor costs. In the absence of Obsidian, we would have needed to hire senior engineers to build API, scripts, and detection pipelines and dashboards, as well as junior engineers to support configurations and audit preparation.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• By leveraging Obsidian SaaS Security, the composite organization avoids hiring seven FTEs: three senior security engineers with extensive experience building detection pipelines, API, and scripts and four junior engineers/specialists who support security priorities and handle day-to-day operations.

• The avoided FTEs would have spent three years building the tooling needed to manage identity threat detection and response, SaaS security posture management, and identity threat prevention.

• The average fully burdened annual salary (including benefits and taxes paid by the organization) for an FTE is $140,000.

Risks. Potential risks that can impact this benefit include:

• The number of additional FTEs the organization needs to build tooling for managing identity threat detection and response, SaaS security posture management, and identity threat prevention.

• The amount of time required to build tooling.

• The average fully burdened salary for an FTE.

• Whether or not the resulting in-house tooling yields a minimum viable product that offers the same tools and functionality of Obsidian SaaS Security.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $2.2 million.

Avoided Audit Penalties

Evidence and data. Interviewees said the Obsidian SaaS Security platform improved their organizations’ visibility and helped them avoid incremental audit penalties. They explained that it closed posture gaps and helped them discover and highlight every app in their environment while also allowing them to identify app-to-app authentications. Obsidian SaaS Security helped the interviewees’ organizations meet NIST requirements for SaaS, while also aligning to other frameworks, including ISO and PCI.

• A SaaS security team lead at a manufacturing company told Forrester: “Obsidian is a one-stop shop. It leverages vendors’ documentation for best practices as well as standards such as NIST and ISO, connecting these to the Obsidian platform. Obsidian helped us identify misconfigurations and provided specific instructions on how to fix them in the platform without having to contact the SaaS vendor, saving us valuable time.”

• A chief information security officer at a healthcare company shared: “By integrating security posture rules and frameworks into the solution platform, Obsidian helped us monitor our risk management and cybersecurity readiness. We have been able to ensure regulatory compliance.”

• A SaaS security engineer at a financial services company told Forrester, “Obsidian helped us identify open risk and protected us from being in a compromised position.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following the composite organization avoids $1 million in incremental audit penalties with Obsidian SaaS Security.

Risks. Potential risks that can impact this benefit include:

• The extent to which the organization leverages Obsidian SaaS Security to manage compliance risk.

• The specific goals and activities of the organization to manage compliance.

• The ways the organization leverages Obsidian SaaS Security to make strategic decisions about compliance.

Results. To account for these risks, Forrester adjusted this benefit downward by 5%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $2.4 million.

Reduced Audit And Compliance Costs

Evidence and data. Interviewees said Obsidian SaaS Security platform provides continuous visibility into their organizations’ SaaS environments — including applications, integrations and SaaS pathways — and that this helped their organizations standardize and simplify their audit processes, reduce audit risk, and avoid audit penalties. By identifying misconfigurations, undocumented applications, and SaaS-to-SaaS authentications, the organizations closed compliance gaps proactively rather than during audit cycles. This improved readiness helped the organizations align more consistently with regulatory and industry frameworks (e.g., NIST, ISO, PCI), which reduced the likelihood of negative audit findings, remediation delays, and associated penalties.

• A SaaS security team lead at a manufacturing company told Forrester: “Since we started using Obsidian, we have been able to save over 250 hours preparing for audits. With the Obsidian platform and its reporting capabilities, we have simplified the entire audit preparation process and reduced manual, error-prone effort.”

• A chief information security officer at a healthcare company shared, “Obsidian helped us respond much more quickly to inquiries about why we are not passing an ISO or SOC 2 (system and organization controls 2) order and significantly shortened the time it takes to remediate identified issues.”

• A SaaS security engineer at a financial services company told Forrester: “Obsidian allows our team to work more efficiently towards regulatory compliance. We now spend significantly less time preparing for audits.” 

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization has one audit per year.

• Before using Obsidian SaaS Security, the composite organization spent an average of 300 hours preparing for an audit.

• Obsidian SaaS Security reduces the composite’s audit preparation time by 90%.

• The audit preparation cost per internal employee per hour is $67.

• Prior to using Obsidian SaaS Security, external auditors spent an average of 300 hours per year conducting audits.

• Obsidian SaaS Security reduces external auditor time by 20%.

• The external audit consultancy cost per hour is $200.

Risks. Potential risks that can impact this benefit include:

• The extent to which the organization leverages Obsidian SaaS Security to manage compliance risk.

• The extent to which the organization leverages Obsidian SaaS Security to manage audits.

• The specific goals and activities of the organization to manage compliance and prepare for audits.

• The way the organization leverages Obsidian SaaS Security to make strategic decisions about compliance management and audit preparation.

• The number of audits each year.

• The cost of dedicated internal resources.

• The cost of external audit consultancy.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $67,000.

Operational Efficiency Gains

Evidence and data. Interviewees explained that Obsidian SaaS Security helped their organizations become more efficient by allowing them to automate manual tasks, providing centralized data and reporting insights, and simplifying workflows. This saved time and led to increased productivity.

• A SaaS security team lead at a manufacturing company told Forrester: “Obsidian has made our detection, diagnosis, and decision-making faster. Our mean time to resolution has gone from 22 days to 1.75 days.”

• A VP of information security at a biotechnology company shared: “We no longer spend time writing detections or maintaining detection pipelines. Those capabilities are already built into the Obsidian platform, which allows us to focus on other, more strategic areas of our security program.”

• A chief information security officer at a healthcare company said: “Obsidian reduced the need to build and maintain detection pipelines. The solution streamlined our workflows. Our team can now focus on other critical security priorities.” 

• A SaaS security engineer at a financial services company told Forrester: “We used to perform several tasks manually. Since we adopted Obsidian, tasks that were previously manual are now largely automated. This has allowed us to respond more efficiently and rapidly to fast-moving attacks while also reducing the likelihood of human error.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The composite organization’s security team is comprised of eight FTEs, including senior engineers, junior engineers, and specialists.

• Each FTE spends 6 hours daily on security operations and tasks impacted by Obsidian SaaS Security.

• Obsidian SaaS Security saves 25% of this time.

• The fully burdened average hourly salary for a security team member is $67.

• The organization recaptures 50% of productivity because not all hours gained from efficiency translate into additional work being completed.

Risks. Potential risks that can impact this benefit include:

• The extent to which the organization leverages Obsidian SaaS Security to manage security operations and tasks.

• The number of resources (FTEs) the organization dedicates to security.

• The amount of time spent on security operations and tasks.

• The percentage of time saved with Obsidian SaaS Security.

• The fully burdened average hourly salary for a security team member.  

• Productivity capture rate.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $234,000.

Unquantified Benefits

Interviewees also identified the following additional benefits that delivered value to their organizations but were not formally quantified:

• Improved security visibility and administrative control. Interviewees said the Obsidian SaaS Security platform is easy to use, and that it allows their organizations to promptly identify and address potential threats while mitigating vulnerabilities. They said the platform enables their organizations to manage permissions and excessive privileges, prevent SaaS configuration drift, surface shadow SaaS inventory, and detect SaaS spear phishing and token compromise.
  A SaaS security team lead at a manufacturing company told Forrester: “We have found Obsidian’s platform easy to use. It is polished and intuitive.”
  A VP of information security at a biotechnology company shared: “Obsidian’s platform connects SaaS applications, endpoints, and identity data. [This provides] valuable insights that are easy to interpret and act upon.”
  A chief information security officer at a healthcare company said: “With Obsidian, we can see integrations, SaaS activity logs, API keys and tokens, permissions, and configurations. The platform provides an identity-centric dashboard that is straightforward and easy to navigate.”

• Reduced operational complexity and administrative effort. Interviewees said their organizations deployed the solution quickly and integrated it into their overall security infrastructures in a short amount of time. They also noted the solution requires minimal ongoing maintenance, which allows security teams to focus their efforts on executing security strategy.
  A VP of information security at a biotechnology company told Forrester: “Deploying Obsidian was easy. We spent a bit of time on the posture integration side, but overall, the process was swift.” A chief information security officer at a healthcare company shared: “We have been able to deploy Obsidian in multiple regions globally. Deployment and ongoing maintenance have both been relatively effortless.”

• Enhanced vendor partnership and strategic alignment. Interviewees said their TAMs and Obsidian engineers quickly respond to support inquiries, and they explained this helps ensure the platform operates effectively and is aligned with the organization’s strategic objectives.
  A SaaS security team lead at a manufacturing company told Forrester: “Obsidian’s technical support and engineering teams have been truly amazing. Their responsiveness, fast turnarounds on feature requests, and proactive engagement with our team have been truly impressive.”
  A chief information security officer at a healthcare company shared: “Obsidian’s technical support team is outstanding. Whenever we’ve had a question or issue, they have been readily available to help.”

• Greater organizational agility during business change. Interviewees said that leveraging Obsidian SaaS Security allows their organization to engage in business change that reconciles evolving conditions in the cybersecurity space. They noted the solution supports changes in operating models and security processes as organizations prepare for emerging risks.
  A SaaS security team lead at a manufacturing company told Forrester: “My organization understands how the cybersecurity landscape continues to evolve and how AI will play a greater role in cybersecurity. Obsidian functionality that addresses non-human SaaS identities and integrations and shadow AI will continue to be important for the organization as we engage in continued business change.”
  A SaaS security engineer at a financial services company shared: “Obsidian has helped my organization identify security processes that were not conducive to high organizational performance. Obsidian has supported our efforts to improve how we operate, which has had a positive impact across the business at large.”

Flexibility

The value of flexibility is unique to each customer and use case. There are multiple scenarios in which a customer might implement the Obsidian SaaS Security platform and later realize additional uses and business opportunities, including:

• Compliance with regulatory frameworks. Interviewees said it’s challenging to keep pace with expanding SaaS estates while meeting multiple regulatory frameworks and that this leads to slow audits, incomplete evidence, and delayed deployments. They noted that Obsidian SaaS Security provides a centralized system that aligns SaaS configurations with industry standards. They also said the solution maps SaaS configuration and activity to compliance frameworks, automates evidence collection, and monitors what each vendor API permits.

• Management of excessive access, shadow SaaS and AI usage, and identity gaps. Interviewees explained that expanding SaaS and AI usage increases the likelihood of excessive privileges, unmanaged applications, and identity gaps that raise the risk of account abuse. But they noted the Obsidian SaaS Security platform discovers shadow SaaS and AI, detects risky authentication patterns (e.g., multifactor authentication bypass, direct logins), highlights overprivileged and inactive accounts to support enforcing least privilege, and reduces identity-driven risk.

• Visibility into SaaS integrations and third-party connections. Interviewees said SaaS-to-SaaS integrations and third-party connections expand attack surfaces and make it difficult to identify which integrations are risky or how breaches disseminate through interconnected services. They said the Obsidian SaaS Security platform maps all SaaS integrations, scores risk based on scope and usage, establishes behavioral baselines, and enables rapid investigation with normalized logs and end-to-end audit trails.

• Detection and response to account compromise and takeover attacks. Interviewees explained that account takeover attacks and insider misuse often bypass traditional email and web defenses by leveraging SaaS identities and sessions, while insider misuse is challenging to detect without context. They said the Obsidian SaaS Security platform detects anomalous access and suspicious behavior in near-real time, blocks compromised credentials and sessions, and accelerates investigation and remediation with identity-focused logging, alert context, and guided response workflows.

• Browser extension security. Shadow SaaS and AI sprawl increase organizations’ attack surfaces. But interviewees said the Obsidian SaaS Security platform enhances browser-level awareness by analyzing SaaS and AI usage and preventing account takeovers from web-originated attacks. They said the solution detects, warns, or blocks users from submitting credentials to malicious websites and that it applies flexible controls to monitor or block access to risky SaaS and genAI apps.

• AI agent security and governance. As organizations adopt AI agents that act autonomously across SaaS applications, managing access, permissions, and behavior becomes increasingly complex. Interviewees noted the Obsidian SaaS Security platform identifies nonhuman identities, monitors agent activity and permissions, assesses risk across agent-to-SaaS interactions, and provides visibility into how AI agents access data and take action across the SaaS environment.