In a new study on software-as-a-service (SaaS) adoption, Forrester Research reported the majority of IT decision-makers have a false sense of comfort with existing controls for SaaS security. The study also revealed many organizations view “shadow IT” practices, IT solutions deployed without the approval or involvement of an organization’s IT department, as problems that are “here to stay and cannot be ignored.”

Forrester noted 43 percent of respondents said they believed shadow IT practices were major threats to their respective organizations. In addition, 46 percent of respondents said they believed SaaS providers make unrealistic or overstated claims.

“To securely implement SaaS products and take full advantage of the benefits they afford, it’s not enough to know what threats and vulnerabilities this delivery and consumption model presents. It’s also critical to hold a firm understanding of which party is responsible in the event of a breach,” Forrester said. “The combination of this new technology and its unique vendor-customer relationship, however, makes this easier said than done.”

Other study findings included:

So what are the best ways for organizations to protect their digital assets? Forrester offered the following recommendations:

In January 2014, SaaS-based security company Adallom commissioned Forrester to conduct the study by evaluating IT decision-maker attitudes toward security in the context of bring-your-own-device (BYOD) policies, SaaS and shadow IT. The study, “SaaS Adoption Requires a New Approach to Information Security,” included responses from 150 IT professionals responsible for information security.