Workato configuration hardening security checks
Vendor-recommended secure defaults, patch levels and housekeeping settings that drift as tenants grow and admins change.
On Workato, Black Cat runs 8 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Workato connector needs.
Checks (8)
severity: medium Workspace Recipe Limit fix difficulty: medium #
Remove unused recipes or upgrade the Workato plan to stay within recipe quota
- Log in to Workato and navigate to the Recipes section
- Review the list of recipes and identify stopped or unused ones
- Archive or delete recipes that are no longer needed
- If the recipe count still exceeds the plan limit, contact Workato support to upgrade the plan
- Verify the current recipe count is within the allowed quota
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: high Broken Connection fix difficulty: medium #
Re-authorize or remove the broken SaaS connection in Workato
- Log in to Workato and navigate to Projects > Connections
- Locate the connection flagged as broken or disconnected
- Click the connection name to open its configuration
- Click "Reconnect" or "Re-authorize" and complete the OAuth or credential flow
- If the connection is no longer needed, click "Delete" to remove it
- Verify the connection shows a green connected status
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: low Stale Connection fix difficulty: easy #
Review and remove SaaS connections that have not been used recently
- Log in to Workato and navigate to Projects > Connections
- Review connections and identify those with no recent usage
- For each unused connection, confirm it is not referenced by any active recipe
- Click the connection name, then click "Delete"
- Confirm the deletion to remove the stale connection
Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: high Workspace Trial Expired fix difficulty: easy #
Upgrade the Workato workspace to a paid plan to restore full security controls and SLA
- Log in to Workato and navigate to Workspace Admin > Settings > Plan & Billing
- Review the current trial status and expiry date
- Contact Workato sales or click "Upgrade" to select an appropriate paid plan
- Complete the billing and provisioning steps
- Verify the workspace plan reflects the upgraded tier and trial status is cleared
Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC9.1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: low Recipe Never Executed fix difficulty: easy #
Review and clean up recipes that have never been executed
- Log in to Workato and navigate to the Recipes section
- Open the recipe that has never been executed
- Determine whether the recipe is intentionally dormant or was abandoned during development
- If no longer needed, archive or delete the recipe
- If the recipe should run, verify its trigger and connection configuration then start it
- Confirm the recipe either has a run history or has been removed
Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: medium Recipe Long Stopped fix difficulty: easy #
Review and archive recipes that have been stopped for an extended period
- Log in to Workato and navigate to the Recipes section
- Open the stopped recipe and review its job history and last run date
- Determine whether the recipe is still needed or has been superseded
- If abandoned, archive or delete the recipe and remove any associated connections it exclusively uses
- If it should be restarted, fix any underlying issues and click "Start recipe"
- Confirm the recipe is either running again or has been removed from the workspace
Satisfies: NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: medium Connection Never Authorized fix difficulty: medium #
Investigate connections that show as authorized but have no authorization timestamp
- Log in to Workato and navigate to Projects > Connections
- Open the connection flagged with no authorization timestamp
- Review the authentication method — connections using long-lived service account keys may not record timestamps
- Replace service account keys with OAuth2 or short-lived credentials where possible
- Re-authorize the connection to create a fresh authorization record with a current timestamp
- Verify the connection shows a valid authorization date after re-authorization
Satisfies: ISO 27001:2022 A.8.5 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10
severity: medium Recipe Excessive Application Integrations fix difficulty: hard #
Split recipes with many application integrations to reduce blast radius
- Log in to Workato and navigate to the Recipes section
- Open the recipe flagged for integrating with too many applications
- Review whether all integrated applications are necessary for the recipe's function
- Split the recipe into smaller, purpose-specific recipes that each touch fewer applications
- Use Workato callable recipes or lookup tables to share data between the smaller recipes
- Test the refactored recipes and deactivate the original once confirmed working
Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-314.a NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10