Web security audits for B2B SaaS, NIS2 / ISO 27001 compliance, procurement-ready reports.https://saasfort.com/en-ushttps://saasfort.com/blog/external-security-checklist-2026-edition-de/https://saasfort.com/blog/external-security-checklist-2026-edition-de/Alles, was ein Unternehmenskunde, eine Prüferin oder ein Angreifer ohne Zugangsdaten über Ihre Domain beobachten kann, in der Reihenfolge, in der es sich zu beheben lohnt.Fri, 02 Oct 2026 00:00:00 GMThttps://saasfort.com/blog/external-security-checklist-2026-edition-fr/https://saasfort.com/blog/external-security-checklist-2026-edition-fr/Tout ce qu'un acheteur entreprise, un auditeur ou un attaquant peut observer de votre domaine sans identifiants, dans l'ordre où il vaut la peine d'être corrigé.Fri, 02 Oct 2026 00:00:00 GMThttps://saasfort.com/blog/external-security-checklist-2026-edition/https://saasfort.com/blog/external-security-checklist-2026-edition/Everything an enterprise buyer, an auditor or an attacker can observe about your domain without credentials, in the order worth fixing it.Fri, 02 Oct 2026 00:00:00 GMThttps://saasfort.com/blog/mittelstand-email-transport-security-nis2-quick-win-2026-de/https://saasfort.com/blog/mittelstand-email-transport-security-nis2-quick-win-2026-de/Zwei DNS-Einträge und eine statische Datei. Extern überprüfbar, Artikel 21(2)(h) zugeordnet, und fast kein Wettbewerber hat es.Thu, 01 Oct 2026 00:00:00 GMThttps://saasfort.com/blog/mittelstand-email-transport-security-nis2-quick-win-2026-fr/https://saasfort.com/blog/mittelstand-email-transport-security-nis2-quick-win-2026-fr/Deux enregistrements DNS et un fichier statique. Vérifiable de l'extérieur, mappé sur l'article 21(2)(h), et presque aucun concurrent ne l'a.Thu, 01 Oct 2026 00:00:00 GMThttps://saasfort.com/blog/mittelstand-email-transport-security-nis2-quick-win-2026/https://saasfort.com/blog/mittelstand-email-transport-security-nis2-quick-win-2026/Two DNS records and a static file. Externally verifiable, mapped to Article 21(2)(h), and almost no competitor has it.Thu, 01 Oct 2026 00:00:00 GMThttps://saasfort.com/blog/msp-certificate-automation-client-estates-2026-de/https://saasfort.com/blog/msp-certificate-automation-client-estates-2026-de/Die Obergrenze des CA/Browser Forum sinkt im März 2027 auf 100 Tage. Für einen MSP mit fünfzig Kundendomains ist das der Unterschied zwischen einem Prozess und einer Störungswarteschlange.Wed, 30 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/msp-certificate-automation-client-estates-2026-fr/https://saasfort.com/blog/msp-certificate-automation-client-estates-2026-fr/Le plafond du CA/Browser Forum tombe à 100 jours en mars 2027. Pour un MSP qui détient cinquante domaines clients, c'est la différence entre un processus et une file d'incidents.Wed, 30 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/msp-certificate-automation-client-estates-2026/https://saasfort.com/blog/msp-certificate-automation-client-estates-2026/The CA/Browser Forum ceiling drops to 100 days in March 2027. For an MSP holding fifty client domains, that is the difference between a process and an incident queue.Wed, 30 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/security-questionnaire-new-questions-2026-de/https://saasfort.com/blog/security-questionnaire-new-questions-2026-de/Lieferantenfragebögen ändern sich langsam, doch fünf neue Fragen kursieren. Die meisten Anbieter beantworten sie schlecht, gerade weil sie neu sind.Tue, 29 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/security-questionnaire-new-questions-2026-fr/https://saasfort.com/blog/security-questionnaire-new-questions-2026-fr/Les questionnaires fournisseur évoluent lentement, mais cinq nouvelles questions circulent. La plupart des éditeurs y répondent mal, précisément parce qu'elles sont nouvelles.Tue, 29 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/security-questionnaire-new-questions-2026/https://saasfort.com/blog/security-questionnaire-new-questions-2026/Vendor questionnaires are slow to change, but five new questions are now circulating. Most vendors answer them badly because the questions are new.Tue, 29 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/external-security-baseline-what-changed-2026-de/https://saasfort.com/blog/external-security-baseline-what-changed-2026-de/Sechs neue Kontrollen: Mailtransport, Post-Quantum-Schlüsselvereinbarung, Zertifikatslaufzeit, Trusted Types und SRI-Durchsetzung. Was jede misst und wie sie bewertet wird.Mon, 28 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/external-security-baseline-what-changed-2026-fr/https://saasfort.com/blog/external-security-baseline-what-changed-2026-fr/Six nouveaux contrôles : transport du courrier, accord de clés post-quantique, durée de vie des certificats, Trusted Types et application de SRI. Ce que chacun mesure et comment il est noté.Mon, 28 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/external-security-baseline-what-changed-2026/https://saasfort.com/blog/external-security-baseline-what-changed-2026/Six new controls: mail transport, post-quantum key agreement, certificate lifetime, Trusted Types and SRI enforcement. What each one measures and how it is scored.Mon, 28 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/supply-chain-script-integrity-cdn-compromise-2026-de/https://saasfort.com/blog/supply-chain-script-integrity-cdn-compromise-2026-de/Ein manipuliertes Drittanbieter-Skript kommt von einer erlaubten Herkunft, über TLS, in eine Seite mit gültiger CSP. Fast jede Kontrolle, nach der ein Anbieter gefragt wird, besteht währenddessen.Sun, 27 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/supply-chain-script-integrity-cdn-compromise-2026-fr/https://saasfort.com/blog/supply-chain-script-integrity-cdn-compromise-2026-fr/Un script tiers altéré arrive d'une origine autorisée, en TLS, dans une page à CSP valide. Presque tous les contrôles sur lesquels on interroge un éditeur passent pendant que cela se produit.Sun, 27 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/supply-chain-script-integrity-cdn-compromise-2026/https://saasfort.com/blog/supply-chain-script-integrity-cdn-compromise-2026/A tampered third-party script arrives from an allowed origin, over TLS, inside a valid CSP. Almost every control a vendor is asked about passes while it happens.Sun, 27 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/csp-maturity-model-saas-2026-de/https://saasfort.com/blog/csp-maturity-model-saas-2026-de/Fast jedes SaaS hat eine Content-Security-Policy. Fast keines kommt über Stufe zwei hinaus. Hier ist die Leiter und was jede Sprosse tatsächlich bringt.Sat, 26 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/csp-maturity-model-saas-2026-fr/https://saasfort.com/blog/csp-maturity-model-saas-2026-fr/Presque tous les SaaS ont une Content-Security-Policy. Presque aucun ne dépasse le niveau deux. Voici l'échelle et ce que chaque barreau vous apporte réellement.Sat, 26 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/csp-maturity-model-saas-2026/https://saasfort.com/blog/csp-maturity-model-saas-2026/Almost every SaaS has a Content-Security-Policy. Almost none get past level two. Here is the ladder and what each rung actually buys you.Sat, 26 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/iso-27001-a8-24-cryptography-evidence-2026-de/https://saasfort.com/blog/iso-27001-a8-24-cryptography-evidence-2026-de/Anhang-A-Kontrolle 8.24 verlangt Regeln zur Kryptografie und deren Umsetzung. Prüfer wollen den zweiten Teil zunehmend vorgeführt bekommen, nicht beschrieben.Fri, 25 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/iso-27001-a8-24-cryptography-evidence-2026-fr/https://saasfort.com/blog/iso-27001-a8-24-cryptography-evidence-2026-fr/Le contrôle 8.24 de l'annexe A demande des règles sur la cryptographie et leur mise en œuvre. Les auditeurs veulent de plus en plus voir la seconde partie démontrée, pas décrite.Fri, 25 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/iso-27001-a8-24-cryptography-evidence-2026/https://saasfort.com/blog/iso-27001-a8-24-cryptography-evidence-2026/Annex A control 8.24 asks for rules on cryptography and their implementation. Auditors increasingly want the second part demonstrated, not described.Fri, 25 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/dora-article-9-encryption-post-quantum-fintech-2026-de/https://saasfort.com/blog/dora-article-9-encryption-post-quantum-fintech-2026-de/DORA verlangt den Schutz von Daten während der Übertragung. Bei Finanzdaten mit jahrzehntelanger Sensibilität reicht diese Anforderung inzwischen bis zur Post-Quantum-Schlüsselvereinbarung.Thu, 24 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/dora-article-9-encryption-post-quantum-fintech-2026-fr/https://saasfort.com/blog/dora-article-9-encryption-post-quantum-fintech-2026-fr/DORA exige la protection des données en transit. Pour des données financières sensibles sur une décennie, cette exigence atteint désormais l'accord de clés post-quantique.Thu, 24 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/dora-article-9-encryption-post-quantum-fintech-2026/https://saasfort.com/blog/dora-article-9-encryption-post-quantum-fintech-2026/DORA requires protection of data in transit. For financial data with decade-long sensitivity, that requirement now reaches into post-quantum key agreement.Thu, 24 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/tls-configuration-audit-what-changed-2026-de/https://saasfort.com/blog/tls-configuration-audit-what-changed-2026-de/Eine TLS-Einrichtung, die vor zwei Jahren ein A erreichte, hat heute drei neue Lücken: Zertifikatslaufzeit, hybride Schlüsselvereinbarung und Mailtransport. Keine davon war damals ein Befund.Wed, 23 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/tls-configuration-audit-what-changed-2026-fr/https://saasfort.com/blog/tls-configuration-audit-what-changed-2026-fr/Une configuration TLS notée A il y a deux ans présente aujourd'hui trois nouveaux trous : durée de vie des certificats, accord de clés hybride et transport du courrier. Aucun n'existait comme constat à l'époque.Wed, 23 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/tls-configuration-audit-what-changed-2026/https://saasfort.com/blog/tls-configuration-audit-what-changed-2026/A TLS setup that scored an A two years ago now has three new gaps: certificate lifetime, hybrid key agreement, and mail transport. None of them existed as findings then.Wed, 23 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/email-security-beyond-dmarc-vendor-questionnaire-2026-de/https://saasfort.com/blog/email-security-beyond-dmarc-vendor-questionnaire-2026-de/Fast jeder Fragebogen fragt nach SPF, DKIM und DMARC. Fast keiner fragt, ob Mail an Sie verschlüsselt ankommt. So beantworten Sie die eigentlich gemeinte Frage.Tue, 22 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/email-security-beyond-dmarc-vendor-questionnaire-2026-fr/https://saasfort.com/blog/email-security-beyond-dmarc-vendor-questionnaire-2026-fr/Presque tous les questionnaires interrogent SPF, DKIM et DMARC. Presque aucun ne demande si le courrier qui vous est destiné arrive chiffré. Comment répondre à la question qu'ils voulaient poser.Tue, 22 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/email-security-beyond-dmarc-vendor-questionnaire-2026/https://saasfort.com/blog/email-security-beyond-dmarc-vendor-questionnaire-2026/Almost every questionnaire asks about SPF, DKIM and DMARC. Almost none ask whether mail to you arrives encrypted. Here is how to answer the question they meant.Tue, 22 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/dane-vs-mta-sts-saas-which-first-2026-de/https://saasfort.com/blog/dane-vs-mta-sts-saas-which-first-2026-de/Beide lösen dasselbe Problem mit unterschiedlichen Vertrauensankern. Eines braucht DNSSEC, das andere geht heute Nachmittag live. Die Reihenfolge zählt mehr als die Wahl.Mon, 21 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/dane-vs-mta-sts-saas-which-first-2026-fr/https://saasfort.com/blog/dane-vs-mta-sts-saas-which-first-2026-fr/Les deux résolvent le même problème avec des ancres de confiance différentes. L'un exige DNSSEC, l'autre part cet après-midi. L'ordre compte plus que le choix.Mon, 21 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/dane-vs-mta-sts-saas-which-first-2026/https://saasfort.com/blog/dane-vs-mta-sts-saas-which-first-2026/They solve the same problem with different trust anchors. One needs DNSSEC, the other ships this afternoon. The order matters more than the choice.Mon, 21 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/nis2-article-21h-cryptography-evidence-2026-de/https://saasfort.com/blog/nis2-article-21h-cryptography-evidence-2026-de/Die Richtlinie sagt Konzepte für Kryptografie und Verschlüsselung. Sie nennt keine Algorithmen. Was die Aufsichtspraxis 2026 tatsächlich sehen will.Sun, 20 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/nis2-article-21h-cryptography-evidence-2026-fr/https://saasfort.com/blog/nis2-article-21h-cryptography-evidence-2026-fr/La directive dit « politiques de cryptographie et de chiffrement ». Elle ne dit pas quels algorithmes. Voici ce que la pratique de supervision attend réellement de voir en 2026.Sun, 20 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/nis2-article-21h-cryptography-evidence-2026/https://saasfort.com/blog/nis2-article-21h-cryptography-evidence-2026/The directive says policies on cryptography and encryption. It does not say which algorithms. Here is what supervisory practice in 2026 actually expects to see.Sun, 20 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/bsi-tr-03108-email-transport-german-saas-2026-de/https://saasfort.com/blog/bsi-tr-03108-email-transport-german-saas-2026-de/Die deutsche Technische Richtlinie behandelt DANE, MTA-STS und TLS-RPT als eine Einheit. Die meisten SaaS-Anbieter haben nichts davon, und das fällt in BSI-geprägten Bewertungen auf.Sat, 19 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/bsi-tr-03108-email-transport-german-saas-2026-fr/https://saasfort.com/blog/bsi-tr-03108-email-transport-german-saas-2026-fr/La directive technique allemande traite DANE, MTA-STS et TLS-RPT comme un ensemble. La plupart des éditeurs SaaS n'en ont aucun, et cela ressort dans les évaluations conduites par le BSI.Sat, 19 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/bsi-tr-03108-email-transport-german-saas-2026/https://saasfort.com/blog/bsi-tr-03108-email-transport-german-saas-2026/The German technical guideline treats DANE, MTA-STS and TLS-RPT as one set. Most SaaS vendors have none of them, and it shows up in BSI-driven assessments.Sat, 19 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/harvest-now-decrypt-later-enterprise-buyers-2026-de/https://saasfort.com/blog/harvest-now-decrypt-later-enterprise-buyers-2026-de/Sicherheitsteams regulierter Kunden haben Post-Quantum-Bereitschaft in ihre Fragebögen aufgenommen. Was sie wirklich fragen, und wie man antwortet.Fri, 18 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/harvest-now-decrypt-later-enterprise-buyers-2026-fr/https://saasfort.com/blog/harvest-now-decrypt-later-enterprise-buyers-2026-fr/Les équipes sécurité des acheteurs régulés ont ajouté la préparation post-quantique à leurs questionnaires. Voici ce qu'elles demandent réellement et comment y répondre.Fri, 18 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/harvest-now-decrypt-later-enterprise-buyers-2026/https://saasfort.com/blog/harvest-now-decrypt-later-enterprise-buyers-2026/Security teams at regulated buyers have added post-quantum readiness to their questionnaires. Here is what they are really asking and how to answer it.Fri, 18 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/integrity-policy-sri-enforcement-supply-chain-2026-de/https://saasfort.com/blog/integrity-policy-sri-enforcement-supply-chain-2026-de/Subresource Integrity wird pro Skript-Tag aktiviert, also verfällt die Abdeckung mit jeder Ergänzung. Integrity-Policy lässt den Browser die Regel global durchsetzen.Thu, 17 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/integrity-policy-sri-enforcement-supply-chain-2026-fr/https://saasfort.com/blog/integrity-policy-sri-enforcement-supply-chain-2026-fr/Subresource Integrity s'active balise par balise, donc la couverture se dégrade à chaque ajout. Integrity-Policy fait appliquer la règle par le navigateur, globalement.Thu, 17 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/integrity-policy-sri-enforcement-supply-chain-2026/https://saasfort.com/blog/integrity-policy-sri-enforcement-supply-chain-2026/Subresource Integrity is opt-in per script tag, so coverage decays every time someone adds one. Integrity-Policy makes the browser enforce it globally.Thu, 17 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/trusted-types-dom-xss-csp-saas-2026-de/https://saasfort.com/blog/trusted-types-dom-xss-csp-saas-2026-de/Content-Security-Policy steuert, woher Skripte kommen. DOM-XSS lädt kein Skript. Trusted Types ist die Direktive, die die Senke schließt.Wed, 16 Sep 2026 00:00:00 GMThttps://saasfort.com/blog/trusted-types-dom-xss-csp-saas-2026-fr/https://saasfort.com/blog/trusted-types-dom-xss-csp-saas-2026-fr/Content-Security-Policy contrôle d'où viennent les scripts. Le DOM XSS ne charge aucun script. Trusted Types est la directive qui ferme le point d'injection.Wed, 16 Sep 2026 00:00:00 GMT