The 30 Workato security checks Black Cat runs
Black Cat SSPM evaluates 30 security policies against your Workato configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.
How to connect Workato — what access Black Cat needs, and why.
Access control & privilege
10 checks · highest severity: high
Encryption, keys & secrets
7 checks · highest severity: high
Configuration hardening
8 checks · highest severity: high
Access control & privilege (10)
- Excessive Admins severity: high
- Inactive Member severity: medium
- Overprivileged Member severity: medium
- No Custom Roles severity: info
- Empty Collaborator Group severity: low
- Large Collaborator Group severity: medium
- No Custom Project Roles severity: info
- Inactive Admin Member severity: high
- API Platform Client Excessive Keys severity: medium
- Workspace Single Admin severity: medium
Encryption, keys & secrets (7)
- API Client No IP Restriction severity: high
- Excessive API Clients severity: medium
- API Endpoint Inactive severity: low
- API Platform Client Static Auth Token severity: high
- API Platform Client No Active Keys severity: medium
- Developer API Client with Admin Role severity: high
- API Platform Client No Key Rotation severity: low
Configuration hardening (8)
- Workspace Recipe Limit severity: medium
- Broken Connection severity: high
- Stale Connection severity: low
- Workspace Trial Expired severity: high
- Recipe Never Executed severity: low
- Recipe Long Stopped severity: medium
- Recipe Excessive Application Integrations severity: medium
Other checks (5)
severity: medium Recipe Integrates with Sensitive Application fix difficulty: medium #
Review data handling and access controls for recipes connected to sensitive business applications
- Log in to Workato and navigate to the Recipes section
- Open the recipe flagged for integrating with a sensitive application (e.g., Salesforce, Workday)
- Review what data the recipe reads and writes to the sensitive application
- Confirm the recipe uses a dedicated service account with least-privilege access
- Ensure error handling does not log sensitive fields such as PII or financial data
- Document the data flow in your data processing register and confirm compliance with relevant policies
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11
severity: high Recipe High Error Rate fix difficulty: medium #
Investigate and fix the recipe that is producing a high rate of job errors
- Log in to Workato and navigate to the Recipes section
- Open the recipe flagged with a high error rate
- Click "Jobs" to review the job history and identify failure patterns
- Inspect the failed jobs for error messages and stack traces
- Fix the recipe logic, update connection credentials, or adjust error-handling steps as needed
- Re-run failed jobs or restart the recipe and monitor the error rate
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-28.4
severity: medium Stopped Recipe With Errors fix difficulty: medium #
Diagnose and resolve errors that caused the recipe to stop, then restart it
- Log in to Workato and navigate to the Recipes section
- Open the stopped recipe and click "Jobs" to view recent job history
- Review the last failed jobs for error details and root cause
- Update the recipe steps, trigger configuration, or connection credentials as needed
- Click "Start recipe" to restart it after the fix is applied
- Monitor the next few job runs to confirm the recipe is running without errors
Satisfies: NIS2 Directive NIS2-21.d DORA (SaaS Security) DORA-28.4
severity: medium Connection to Sensitive Provider fix difficulty: medium #
Review authorization scope and data access for connections to sensitive SaaS providers
- Log in to Workato and navigate to Projects > Connections
- Open the connection flagged as connecting to a sensitive provider
- Review the authorization scope and verify it follows least-privilege principles
- Confirm the connection uses a dedicated service account rather than a personal account
- Verify the connection is authorized with short-lived credentials or OAuth2 where possible
- Document the connection in your data processing register for compliance audits
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-314.a
severity: low Collaborator Group No Description fix difficulty: easy #
Add a description to collaborator groups to document their purpose for access reviews
- Log in to Workato and navigate to Workspace Admin > Groups
- Open the group that has no description
- Click Edit and add a clear description of the group's purpose, membership criteria, and associated projects
- Save the changes
- Repeat for any other undocumented groups to improve audit readiness
Satisfies: ISO 27001:2022 A.5.15 ISO 27001:2022 A.8.9 SOC 2 Type II CC6.2 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-316.b