Do organizations implement enough data security when it comes to their SaaS products?

The issue I've often come across is that people think, "Salesforce is managing this and our prod Salesforce center is totally locked down. That instance is great." But what do our full copy sandboxes look like? Your full copy sandbox is literally all the data in your products that no one has looked at except for 3 Salesforce admins who have unmonitored access—there's your breach. There's your data loss. And if you just make another copy of that sandbox to try to integrate NetSuite or something into it, then there's 2 consultants from NetSuite and 3 other admins and everyone's got access to everything. Why did we just do that? Everyone just gets so narrow-focused on the prod instance of something and has no concept of everything else that's going on.

It’s difficult because for many companies, most of their customer data is sitting in SaaS platforms that they have no access to. So even if they wanted to do something with it, they couldn't. In that situation, how am I going to test Salesforce? It's got my CRM, my investor data—all my stuff is in there. And if they have a vulnerability or loophole in their code, I just don't know how I would protect myself against that.