Before the proliferation of software-as-a-service applications reshaped the business landscape, SaaS data protection was a lesser-known concern. If data was lost, the first call placed would have been to IT.

But as the SaaS landscape has grown, that picture has changed. It’s been a big shift over the past 10 years, according to Simon Taylor (pictured), founder and chief executive officer of HYCU Inc.

“Unfortunately, over the last 10 years, with the spread of SaaS and the spread of cloud services, IT has been forced to cede a lot of that authority and control to the vendors that are being used by the lines of business,” he said.

Taylor spoke with Christophe Bertrand, principal analyst at theCUBE Research, during a CUBE Conversation with theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed a recent report published by HYCU and the company’s mission to simplify SaaS data protection and recovery. (* Disclosure below.)

SaaS data protection myths and the shift from IT

When evaluating the evolution of the SaaS data protection landscape, it’s essential to reflect on a time before Office 365, when Microsoft Exchange was the standard. That would typically reside in a basement, either in a hosted account or on personal servers within one’s own storage capacity, according to Taylor.

“What that meant was that when something was lost, you’d simply call IT, and IT would know exactly where it was, and they’d restore it,” he said.

According to analysis from HYCU, about 80% of the world believed that once they moved to Office 365, they could pick up the phone and call Microsoft Corp., Taylor added. The thought was that they would be able to get their data or email back.

“You and I know, Christophe, that’s absolutely untrue. The shared responsibility model has set it up so that, just like with cloud, they might back up their data and their infrastructure, but if you call a SaaS vendor and say, for the most part, ‘Hey, I’ve lost my own data, can you recover it for me?’ The answer is going to be, ‘That’s on you. That’s not on us,’” Taylor stated.

Understanding the myth that SaaS vendors can and will restore one’s data is challenge number one. In addition, the situation has progressed to a point where IT isn’t even sure anymore how many SaaS services are being run in their environment, according to Taylor.

“Think about a large organization; think about a large bank. They’ve got thousands of different apps running. If the IT department is only aware of a small fraction of those apps, how can they possibly respond to threats?” he said. “Given what happened with CrowdStrike just a few weeks ago, it’s very, very clear that the SaaS entry point for ransomware attacks and for mistakes and for issues is a massive, massive and critical issue for companies.”

Ceding control of data to third parties does provide many great advantages, according to Taylor. They host the data and make sure the service is up and running.

“There’s some terrific value, amazing value that comes from SaaS. We’re a SaaS vendor. But there are also risks. And those risks need to be understood,” he said.

Here’s theCUBE’s complete video interview with Taylor:

(* Disclosure: HYCU Inc. sponsored this segment of theCUBE. Neither HYCU nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE