Emerging Threats in Technology & SaaS Mini Report
For our Emerging Threats in Remote Access Security report, RealVNC surveyed 323 IT professionals across seven industries. Technology and SaaS organisations made up the largest share of respondents, and their results turned out to be one of the study’s clearest contradictions, which is why we’ve broken them out into their own mini-report, Technology & SaaS Emerging Threats: The High-Incident Security Paradox.
If any sector had reason to expect a clean bill of health, it was this one: fast adoption of new tools, dedicated security budgets, and teams that constantly analyse the threat landscape for a living.
1. The Confidence Trap
59% of Technology and SaaS respondents who called themselves highly confident in their security had still experienced an incident in the past 24 months. And that’s one of the highest overconfidence rates in the study, sitting alongside a joint-highest incident rate of 54% across every sector surveyed. We could easily say that strong tooling and awareness aren’t preventing incidents on their own.
2. Ambition Without Delivery
60% of Technology and SaaS respondents name Zero Trust a top priority. But then, only 32% have actually implemented it. The blockers aren’t necessarily budget-related, either. Migration risk (47%) and vendor security review delays (45%) both rank higher.
That’s a structural problem more than a financial one, and it’s worth looking into the why. Migrating to a Zero Trust architecture in a live SaaS environment means untangling legacy integrations and getting every vendor relationship re-reviewed, a process that competes directly with the day-to-day demands of running the product.
Phishing remains the sector’s leading fear at 59%, but insider threats and AI-driven cyberattacks tie for second at 50% each, both notably higher than most other sectors report. That combination (broad system access, heavy vendor integration, a workforce large enough that insider risk becomes its own category) is exactly the environment Zero Trust architecture is designed to contain, which makes the 28-point gap between priority and delivery a genuinely costly one to leave open.
Of the organisations that did experience incidents, 60% involved vulnerability exploitation and 51% resulted in data exposure risk, both among the highest of any sector in the survey. Every month that gap stays open is a month those numbers have room to climb rather than shrink.
3. The Tool Sprawl Tax
35% of tech organisations are running four or more tools in their remote access workflow. That’s more surface area to secure rather than more resilience. With every additional tool comes another login, another update cycle, another place a misconfiguration can slip through, and so on. It’s also part of why 52% of Technology and SaaS respondents say they’ve deprioritised security hardening simply due to the time spent managing their existing setup.
Left unaddressed, this is a pattern that gets worse before it gets better. New tools tend to get added faster than old ones get retired, particularly in fast-moving product environments. This means the sprawl problem compounds year over year, unless someone actively does something to reduce or stop it.
The sector’s own stated priorities confirm this: tool consolidation ties with employee training as the joint top priority looking ahead, at 64% each. This is just above Zero Trust implementation – 60%. Teams already know this is where the next round of investment needs to be made.
Put together, these three findings say less about this sector lacking awareness or ambition, and more about it running short on the bandwidth to act on either while keeping a live product running. Your team already knows the threat landscape, it just needs to be able to do something about the threats themselves.
