Threat mitigation for SaaS