SaaS security, PAM vaults, and backups protect users and data, not the tenant-level roles, policies, and configurations that attackers target.