Brendan O’Connor and the trouble with a trusted cloud

Brendan O’Connor had spent nearly a decade learning Salesforce from the inside. He knew the machinery, the permissions, the ways a powerful business platform could behave. Then he joined ServiceNow as Security CTO and encountered an awkward professional experience: being very experienced, and feeling as though he was starting again.

The technical knowledge travelled less easily than he expected. Familiar-looking enterprise software could have entirely different rules for access, configuration and integrations. Knowing one platform thoroughly did not make the next one legible. For someone whose work was keeping software secure, that was a consequential discovery.

By May 2018, he and Brian Soby had founded AppOmni. The problem they chose was sitting inside an otherwise appealing bargain. Companies could buy sophisticated software without running its infrastructure. They still had to understand what they had allowed that software, its users and its connected applications to do.

The cloud had made purchasing easier. Understanding the keys remained a job.

The expert becomes a beginner

O’Connor joined Salesforce in 2007. His work there included product security and, later, senior responsibility as Chief Trust Officer and Chief Security Officer. He subsequently moved to ServiceNow. His professional biography also includes vulnerability research, security engineering, privacy advocacy, and work in financial services and communications. His route into entrepreneurship ran through the practical business of finding and managing risk.

That background helps explain the particularity of his concern. An application can be well built while a customer’s version of it becomes dangerously permissive. Settings change to accommodate an actual business. Integrations acquire access. Permissions accumulate. The useful question becomes how the customer’s system behaves after people have made it useful.

In his early explanation of AppOmni, O’Connor compared the differences between SaaS platforms to different languages. Fluency in one was insufficient. The proposed business was a way of helping security teams translate.

Two engineers, one unfinished job

Soby brought another view of the same difficulty. He had worked at Salesforce and later founded a consultancy focused on software and SaaS security. He described reconnecting with O’Connor after encountering more examples of the problems customers faced. Together they worked through the underlying issues and started AppOmni to address them.

Their shared history matters. A provider sees the platform it builds. A customer has to operate that platform alongside others, each with its own assumptions and controls. Soby’s account of his work at AppOmni includes meeting customers, explaining responsibilities and pitfalls, and steering the product and technology teams. Education appears alongside engineering from the beginning.

There is a particular kind of business hidden in that relationship: the customer knows the outcome it wants, but needs help describing the problem. Before software can simplify the work, somebody has to make the work understandable. O’Connor and Soby had chosen a field where even deciding who should do it could require a conversation.

Permission is a moving target

O’Connor’s public argument is unusually concerned with ownership. SaaS products can be bought and managed by individual business units. The security team may have little involvement in their daily operation. In his writing, he has described technical teams passing responsibility around, with nobody clearly accountable for the application’s security.

His proposed response starts with accepting the customer’s part of the arrangement. The vendor supplies a secure service; the customer must configure, manage and use it appropriately. An assessment conducted before purchase cannot settle every decision made after deployment. A security review also has a date on it. The business keeps making changes after the reviewer leaves.

He has argued for continuous monitoring of access and configuration, with security involved from implementation. It is a less theatrical proposition than chasing an intruder through a network. Much of the work concerns ordinary administration. But ordinary administration determines what the software permits, and software is admirably indifferent to whether a permission was granted thoughtfully or in a hurry.

In 2020, O’Connor described misconfiguration as the most prevalent SaaS security problem. Different control panels, numerous settings and multiple environments made manual checking difficult. He also pointed to the speed of attacks against exposed cloud data. An intruder taking information directly from an unsecured service gives defenders fewer opportunities to intervene than an attacker moving through a corporate network.

His recommendations were correspondingly concrete: inspect cloud APIs, look for excessive privileges, establish security baselines and detect changes away from them. The baseline matters because a business needs some agreed description of what an acceptable configuration looks like. Without it, a changed setting can be hard to distinguish from a legitimate new requirement.

This is where his engineering background becomes visible in the argument. The proposed work has observable inputs and continuing checks. It asks the security team to examine what is happening inside an application people already trust enough to use every day.

The connection that outlives the click

Consider the third-party application. It offers a useful addition to software the business already uses. Someone connects it. A new convenience arrives, along with a new relationship between systems. The feature is visible. The access behind it can be easier to forget.

O’Connor has explained this problem through OAuth tokens, which allow applications to access other services after authorization. The detail he wants businesses to examine is continuing access. An application can remain connected after the people who installed it have stopped using it. Reviewing who can sign in does not necessarily answer which connected tools can still reach data.

AppOmni’s discussion of these risks calls for an inventory of connected applications, an understanding of their privileges, and removal of access that is no longer needed. This is the housekeeping behind the convenience. The forgotten integration rarely announces its retirement. Someone has to check the cupboard and decide which keys should still work.

“I was always a security engineer.”

Brendan O’Connor

A founder does his homework

For a glimpse of O’Connor away from configurations, consider a football banner. During an early meeting with Thoma Bravo partner Tre Sayle, he noticed the 49ers connection. O’Connor supports the team. He also took the detail as evidence of preparation. He expects his own team to prepare before customer meetings, and appreciated seeing the effort returned.

In June 2022, AppOmni announced a $70 million Series C led by Thoma Bravo, with existing investors including Salesforce Ventures participating. The announcement put total funding at $123 million at that time. The business he had helped build was receiving backing from an investment arm of a company where he had previously worked.

O’Connor’s accompanying message paid attention to a shift in the financial climate. He wrote about the move away from growth at any cost, and set out priorities including a useful product, customer support, sustainable growth and a productive environment for employees. AppOmni reported three years of triple-digit annual recurring revenue growth. He wanted the company judged on how it was built, too.

Confidence gets a difficult exam

At Black Hat in 2023, O’Connor addressed identity risk inside SaaS: employees, guests and machines could all have different routes into the environment. His phrase for the prevailing confidence was sharp enough to survive the conference: “confidently incorrect.” It captured his recurring concern about the distance between believing access is controlled and understanding the access that actually exists.

The distinction is about evidence. A list of installed security products says something about investment. It leaves further questions about configuration, coverage and ownership. O’Connor keeps directing attention towards those questions, where reassuring generalities have to meet specific accounts and permissions.

AppOmni’s 2025 survey supplied an uncomfortable comparison. Among more than 800 security leaders across five countries, 91% expressed confidence in their SaaS security posture, while 75% reported a SaaS-related security incident during the previous year. These were responses to a company survey, with its particular sample and definitions. They still illustrate why confidence alone makes a poor operating measure.

Artificial intelligence adds another occasion for the same oversight. In his forecast for 2024, O’Connor warned about people with good intentions connecting AI to sensitive information before the security around those systems had matured. The attraction is understandable: useful tools improve when they can work with useful data. The permission deserves scrutiny before enthusiasm turns it into an assumption.

That warning fits his earlier work. A tool can be valuable, widely adopted and still require someone to examine what it can reach. New interfaces change the experience of using software. They also create fresh decisions about access. O’Connor’s question follows the data through the change.

A different title, the same question

By February 2025, AppOmni reported 43% year-over-year revenue growth and a customer base including five of the top ten Fortune 500 companies. Its fiscal-year review described a team of 222 people spanning 37 states and 12 countries. The founders’ original problem had become work distributed across a considerably larger organization.

The company now lists O’Connor as Chief Strategy Officer and co-founder, with Neill Occhiogrosso as CEO. Its current figures include more than 131 million SaaS users protected. Those are company figures, and they describe the scale of the operation rather than a guarantee about any individual customer’s security.

O’Connor has said his ambition includes helping the industry understand this problem even when organizations do not buy AppOmni. That is a useful way to read the career: a practitioner discovers that his own expertise has limits, builds a business around helping others navigate theirs, and keeps returning to the question beneath the subscription.

The software is running. Who has the keys?