Protecting SaaS Users Against Phishing: How to Partner Up with Developers
summary
SaaS teams reduce phishing by shipping concrete defenses not memos: implement canary tokens on login pages to detect spoofed copies, wrap outbound links via an email link proxying queue for assessment, add device and behavior signals plus passkeys and step‑up auth to stop credential replay, and run threat modeling with a security champions program that yields small UX changes that cut admin role adoption by 20%. Tools and metrics matter.
AI-written summary · about
chapters (13)
- 0:00Phishing threats in SaaS
- 3:42Security beyond traditional boundaries
- 6:11Shared responsibility with developers
- 9:24Threat modeling for SEO poisoning
- 13:41Authentication defenses
- 17:39Canary tokens and JavaScript
- 21:51Data and honeypots against attacks
- 24:17Brand protection and takedowns
- 26:49Email security with reverse proxy
- 28:58Customer security center and gamification
- 30:27Key takeaways and collaboration
- 33:14Threat modeling and technical debt
- 35:21Q&A
related talks
09mBridging the Gap: Developing Accessible Anti-Phishing Solutions
46mHow to Adapt to Security Changes in Cloud SaaS Transformation
48mTwo Steps Forward for SaaS Adoption, One Step Back for Security
39mCan Saas Ever Be Secure?
26mDon't Blame the User! Stop the Phish Before it is Even Sent
46mCritical SaaS, Critical Blind Spots: A Detection Engineer's Field Guide to SaaS Attacks
52mWho Says Cybersecurity Can’t Be Creative?
41mHook, Line, & Sinker - Addressing the Human Risk of Phishing and How to Avoid the Bait