Aperio vs FailSafe

Aperio is an open-source SaaS Detection & Response platform for identifying SaaS posture risks, cataloging OAuth shadow IT, and sending findings to security systems. It connects to GitHub, Slack, Google Workspace, Okta, 1Password, Microsoft 365, and Atlassian Jira and Confluence. Listed detections include public GitHub repositories, Slack workspace 2FA enforcement, and multiple Google Workspace sharing, administration, Gmail, delegation, and OAuth risks. Okta, 1Password, Microsoft 365, and Atlassian are connection-only while their rule packs remain pending. Findings retain evidence, receive severity scores, support deduplication and risk exceptions, and can resolve automatically when a later sync no longer detects the signal. SIEM destinations include Splunk HEC, Panther, Panopticon, Elasticsearch, Datadog Logs, webhooks, and JSON Lines files, delivered through a retrying durable outbox. Working remediation handlers cover suspending Okta users, resetting Okta MFA, and revoking Slack OAuth apps. Human approval is required before provider-side writes, with two-person approval for response actions. Aperio is MIT licensed and supports self-hosted Compose deployment with PostgreSQL 15 or later.

FailSafe is an agentless SaaS Security Posture Management platform for small and midsize businesses and managed service providers. It connects to Microsoft 365 and Google Workspace through read-only API access, without device agents. Across connected tenants, it discovers SaaS and AI applications, OAuth permissions, shadow IT, and shadow AI. Its tools include SaaS inventory, AI tool discovery, OAuth grant visibility, license waste detection, stale access review, and drift detection. FailSafe scores posture from A to F and produces PDF reports mapped to NIST CSF, CIS v8, SOC 2, and ISO 27001. Financial transaction cross-reference and endpoint inventory are additional discovery layers; Shadow IT Complete includes endpoint posture. MSP features include a portfolio dashboard, white-labeled PDF reports, role-based isolation, API keys, PSA webhooks, and SIEM export. The maker says customer data is encrypted in transit and at rest, but FailSafe is not currently SOC 2 attested and has not had a third-party penetration test. Free is available for up to 80 users in one organization; Shadow IT is $9 a month on a 12-month term.