When buying a SaaS software having the requirement of BYOK to protect your data into the SaaS? How would you prefer to implement it?
Pass the keys to be applied periodically to the SaaS provider 21%
Have a third party tool to manage an intermediate keys model 71%
Let SaaS applications call your Key Vault or HSM 5%
No need if SaaS provider use CSP key managed services (let hyperscaler do and manage keys)3%
66 PARTICIPANTS

You mitigate risk by having a third-party. If you get attacked, they are not. If they get attacked. You isolate them and create a new key.