What is the SSO tax - and is it putting your business at risk?

The ‘SSO tax’ is forcing businesses to choose between affordability and security. Cutting corners on cyber security to save costs may seem practical in the short term, but it exposes organisations and everyone they interact with to financial and operational risks.

So, what is the SSO tax? Why is it bad for business and consumers? And what can you do to minimise your exposure to it?

Table of contents

1. What is the SSO tax?
2. Why charging extra for SSO holds businesses back
3. Why things need to change
4. Here's what you can do about the SSO tax

What is the SSO tax?

The term ‘SSO tax’ refers to the practice of SaaS and software vendors only including single sign-on (SSO) authentication in their premium subscription tiers.

‘Single sign-on’ enables users to access multiple services or software applications with a single set of login credentials.

Rather than remembering a password for every service, the user logs into a single identity provider. This provider then identifies the user to other services, such as SaaS platforms, by exchanging secure, cryptographic tokens rather than usernames and passwords.

The benefits of switching to SSO over old-fashioned passwords and usernames include:

• Users no longer have to remember dozens of passwords.
• Reduced risk of credential theft, with only encrypted tokens exchanged online.
• Logging into new services is simple, fast and easy for users.
• Automatically recording login activity makes it easier to spot potential breaches.
• Your helpdesk has to field far fewer ‘reset my password’ calls.

If SSO is only available to premium subscribers, everyone else is less productive and less secure. To fix this, they have no option but to pay more.

For instance, if you want to subscribe to the project-management platform Trello, SSO is only included as standard in the top-tier subscription, which costs $17.50 per user per month. Users with any other subscription must pay an additional $4 per user per month for SSO authentication. This is the SSO tax in action.

Why charging extra for SSO holds businesses back

According to one study, nearly a third of data breaches involved weak, stolen, or improperly shared passwords.

In addition to its other benefits, using SSO significantly reduces the risks associated with poor password management and weak password security.

This is why secure access should never come at a premium:

1. Restricted access to SSO weakens your overall security posture and disrupts the user experience.
2. If you pay a premium for SSO every time, you’re almost certainly paying for many other features you don’t need. 
3. Dealing with the complexity of different disparate systems, levels of security, and authentication protocols makes your IT ecosystem rigid and less scalable.
4. Poor password hygiene and old-fashioned authentication technologies can make you look less credible to customers and partners.
5. It puts small businesses at a competitive disadvantage to larger competitors who can pay the SSO premium.

It’s also worth remembering that if your users can sign up for SaaS services without oversight, you may be paying the SSO tax without your IT team realising it. 

Why things need to change

In the long term, the SSO tax simply can’t continue. SSO pricing models shouldn’t treat security as a luxury add-on. 

Here's why things need to change:

• It's detrimental to customers, increasing their risk of falling victim to cybercrime.
• It introduces avoidable insecurity into entire supply chains.
• It undermines efforts to get everyone to adopt security best practices.

The SSO tax also works against the interests of software and SaaS vendors by undermining trust in their products.

However, SSO is not the only option businesses have to strengthen their cyber security stance. Cyber Essentials (CE) guidance states that "Your organisation must implement Multi-Factor Authentication (MFA), where available – authentication to cloud services must always use MFA".

Here's what you can do about the SSO tax

Texaport is one of the UK’s leading managed service providers (MSPs). Drawing on our experience, we can help you choose the best licences, subscriptions, and technologies to get both the features and security you need, without overpaying.

As noted by the UK’s National Cyber Security Centre (NCSC), choosing the right SSO provider with a security posture that aligns with your organisation's specific needs is essential. Otherwise, you may not realise the full benefits of switching to SSO.

Contact us to learn more about how you can get the right mix of software and SaaS platforms for your needs, without increasing your exposure to risk.