JPMorgan Chase Sounds Alarm on SaaS Cybersecurity Threats

JPMorgan Chase Sounds Alarm on SaaS Cybersecurity Threats

Summary

• JPMorgan Chase CISO Patrick Opet published an open letter warning SaaS suppliers about weak security.
• Heavy reliance on a few SaaS providers creates single points of failure.
• He asked providers to make products secure by default and modernize how integrations are controlled.
• The letter puts banks’ concerns about third-party software on the record.
• He called for SaaS providers to take more responsibility for security.

Why JPMorgan is worried about SaaS

Banks rely more and more on Software-as-a-Service tools to run their operations. That reliance brings risk. On April 26, 2025, JPMorgan Chase’s Chief Information Security Officer, Patrick Opet, published an open letter to the company’s third-party suppliers warning that many SaaS products are being shipped with security as an afterthought.

How SaaS changes the risk

SaaS is cheap and quick to adopt. The problem, Opet argued, is concentration. When many companies depend on the same few providers, one breach at a provider can hit all of them, and the way SaaS apps connect to each other through OAuth tokens and direct integrations erodes the boundaries companies used to rely on.

As reported by BankInfoSecurity and others, the letter calls for SaaS vendors to build security in from the start and stop rushing features out ahead of protections.

Responsibility for SaaS providers

Opet’s point is that customers can’t fix this alone. Providers need to make their products secure by default. Banks are big customers and high-value targets, and the letter uses that weight to push vendors to do better.

The consequences of ignoring these risks range from data breaches to financial losses and damaged reputations. For JPMorgan, careful due diligence on every SaaS vendor is part of protecting customer data.

What Opet asked suppliers to do

The letter asks providers to modernize how integrations are authorized, so a connected app gets only the access it needs. It also calls for better detection of abuse inside connected systems.

Opet also pointed to options such as confidential computing, self-hosting and “bring your own cloud” setups. They let customers keep more control over their data.

The takeaway for banks

The message from JPMorgan Chase is clear. As SaaS spreads, one weak vendor can become everyone’s problem.

Other companies can take the same steps JPMorgan describes. List every SaaS app and the access it has, cut permissions that aren’t needed, and ask vendors hard questions about how they secure the integrations their customers rely on.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.