In short: Check Point Harmony SaaS, now officially SaaS Security, is an API-based SaaS security product. It combines posture management for SaaS misconfigurations, discovery of the apps, plug-ins and API integrations in use, revocation of risky apps and sharing, and threat prevention and DLP for SaaS data. Posture management is also sold as SSPM add-ons to Email Security.
What Harmony SaaS is
Harmony SaaS is Check Point's product for securing the wider SaaS estate, beyond email. Check Point acquired Atmosec, a SaaS security company, in 2023. Since Check Point's March 2026 reorganisation into four pillars, the product is listed as SaaS Security within the Workspace Security pillar, and the Harmony name no longer appears on its product page.
It connects to SaaS applications by API, and is managed in the Check Point Portal alongside Harmony Email and Collaboration and the other Harmony products.
This page is our guide to SaaS security posture management (SSPM) with Check Point, both as the standalone product and as an Email Security add-on.
What it does
| Capability | What it covers |
|---|---|
| SaaS posture and compliance (SSPM) | Continuously checks SaaS configurations, such as missing MFA or risky sharing defaults, with alerts and guided remediation |
| Ecosystem discovery | Maps every application, plug-in and API integration in your SaaS ecosystem, which brings unsanctioned (shadow) SaaS to light |
| Risky app revocation | Spots third-party apps with access to Microsoft 365 or Google Workspace, detects unusual app behaviour and can revoke access automatically |
| Sharing control | Monitors sharing permissions and can revoke risky access to files and data |
| Threat prevention | Detects and removes known and unknown malware from data at rest in connected SaaS apps, powered by ThreatCloud AI |
| Data protection | DLP that scans files, messages and unstructured content for sensitive data |
| Behavioural detection | Looks for data theft, supply chain attacks through connected apps, and account takeover |
The point of combining these is that many SaaS incidents do not start with malware. They start with a setting nobody changed, an over-permissioned integration someone approved years ago, or a compromised account. Posture, discovery and threat detection in one product address all three.
Standalone product or Email Security add-on
There are two ways to buy Check Point's SaaS posture capabilities:
| Option | Coverage | Best for |
|---|---|---|
| SSPM add-on to Email Security | Microsoft 365 and Google Workspace | Harmony Email and Collaboration customers who want posture checks and risky app control on their core productivity suite |
| SSPM Premium add-on to Email Security | Adds the further SaaS integrations Check Point marks as requiring Premium | Email Security customers who also rely on many other SaaS platforms |
| SaaS Security (Harmony SaaS) standalone | The wider SaaS estate, with DLP and threat prevention alongside posture | Organisations whose risk sits across many SaaS apps, with or without Check Point email |
Check Point's SSPM page lists Microsoft 365 and Google Workspace as integrations, and marks the following as requiring SSPM Premium: Salesforce, ServiceNow, Slack, Zoom, Okta, OneLogin, GitHub, GitLab, Bitbucket, Jira, Asana, monday.com, Smartsheet, HubSpot, Zendesk, Freshdesk, Box, Dropbox and Amazon Web Services. The list changes, so we will confirm the current coverage for the apps you use.
How it differs from CASB, CSPM and email security
SaaS security overlaps with several other categories, which can make buying confusing:
- Email and collaboration security. Harmony Email and Collaboration protects users from phishing and malware in mail, Teams, SharePoint, OneDrive, Google Drive, Slack and file-sharing apps. Harmony SaaS looks at the configuration and connections of the SaaS estate as a whole.
- CASB. A cloud access security broker typically sits in the traffic path to control how users reach SaaS. Harmony SaaS works by API on the apps themselves. Our CASB guide explains the wider category, and Check Point SASE covers the access side.
- CSPM. Cloud security posture management checks infrastructure in AWS, Azure and Google Cloud. That is a different job; see our CSPM guide.
- Employee AI use. Governing ChatGPT, Copilot and AI agents is handled by Workforce AI Security.
Who Harmony SaaS suits
Harmony SaaS is a good fit for:
- Organisations with many SaaS apps and no clear picture of who approved which integration
- Microsoft 365 and Google Workspace tenants with years of accumulated third-party app consents
- Regulated firms that need to show SaaS configurations are reviewed and controlled, supporting UK GDPR's security requirements
- Teams preparing for audits, including Cyber Essentials, where secure configuration is one of the controls
- Existing Check Point Email Security customers, who can start with the SSPM add-on and grow into SSPM Premium or the full product
Licensing and how we help
Harmony SaaS is sold on subscription, either as the standalone SaaS Security product or as the SSPM and SSPM Premium add-ons to Email Security. The price depends on the option, your user numbers, the apps you connect and the term; see the Harmony pricing and licensing guide. If you have data location requirements, tell us and we will confirm Check Point's current hosting options for each product before you buy.
Forever Systems can:
- Connect your Microsoft 365 or Google Workspace tenant and run discovery to see apps, integrations and settings
- Review the posture findings with you and agree which to fix first
- Revoke risky third-party apps and sharing, and set alerts for new ones
- Add further SaaS apps and hand over a regular review process
Contact us for a SaaS security review or a quote.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Check Point Harmony SaaS?
It is Check Point's API-based SaaS security product, now officially called SaaS Security. It combines SaaS security posture management, discovery of SaaS apps and integrations, revocation of risky apps and sharing, and threat prevention and DLP for data stored in SaaS applications.
What is the difference between SSPM and SSPM Premium?
Both are add-ons to Check Point Email Security. SSPM covers Microsoft 365 and Google Workspace. SSPM Premium is needed for the further integrations Check Point lists, such as Salesforce, Slack, Zoom, Okta and GitHub.
What is Harmony SaaS called now?
Check Point's product page now calls it SaaS Security, part of the Workspace Security pillar introduced in March 2026. It is the same API-based SaaS security product, managed in the Check Point Portal (formerly the Infinity Portal).
Is Harmony SaaS the same as a CASB?
Not quite. A CASB usually sits in the access path between users and SaaS. Harmony SaaS connects to the apps by API to check configuration, connected integrations, sharing and stored data. Many organisations use both approaches.
Does Harmony SaaS need agents?
No. Check Point describes it as API-based: it connects to the SaaS applications themselves, so there is nothing to install on devices and no change to how users reach their apps.