Cross-tenant intelligence exposed the full Salesloft-Drift blast radius

At a glance

What this is: Obsidian Security shows that cross-tenant analysis of the Salesloft-Drift breach exposed the full downstream blast radius far faster than per-customer log searches could.

Why it matters: IAM, SaaS security, and NHI teams should treat connected apps and OAuth grants as shared investigation surfaces, because isolated logs can miss the same compromise across many tenants.

By the numbers:

• The attack affected 700+ organizations through downstream customer environments.
• Obsidian Security said the blast radius was 10x greater than previous incidents where attackers infiltrated Salesforce directly.

Context

The core issue is SaaS supply chain visibility: when a third-party integration becomes the access path, a single compromise can spread across many customer environments without leaving a clean signal in any one tenant. Traditional log review assumes the affected scope is visible inside one organization’s boundary, but that assumption breaks when the same integration pattern exists across hundreds of downstream customers.

In this case, the article says the attack used compromised OAuth tokens for the Drift integration to pivot into Salesforce and Google Workspace environments. That makes the investigation problem broader than a single application or a single tenant, because the identity trail spans connected services, non-human access, and shared infrastructure behaviour. The starting position is typical of modern SaaS estates, where integration trust is often wider than operational visibility.

The practical lesson is not that logs failed, but that isolated telemetry could not answer a cross-tenant question. Once the breach moved through a common integration layer, only normalized, cross-service correlation could show how far the compromise had reached.

Key questions

Q: What breaks when SaaS incident response stays limited to a single tenant?

A: Teams lose the ability to see whether the same compromised integration is affecting multiple customers at once. Single-tenant logs may confirm local suspicious activity, but they cannot reveal shared access paths, repeated user-agent patterns, or the full downstream blast radius. Cross-tenant correlation is what turns a local anomaly into a defensible scope assessment.

Q: Why do delegated SaaS integrations create cross-customer breach risk?

A: Because one OAuth grant or connected app can inherit trust across many downstream environments. If that delegated access is compromised, the attacker does not need to repeat initial access in every tenant. The shared integration becomes the access point, which means exposure scales with the number of services and customers that trust it.

Q: How do security teams know whether an integration compromise is spreading?

A: They look for the same user-agent, source IP, token activity, or entity pattern across multiple services and tenants. If those signals recur in different environments, the problem is likely broader than one local misconfiguration. Normalized identity and event data are the only reliable way to compare those signals at scale.

Q: What should teams do when a third-party app is confirmed in a SaaS breach?

A: Expand the investigation to every service that shares the same delegated trust, then review which identities, tokens, and integrations inherit that access. The question is not just whether one tenant is affected, but whether the same integration pattern has created exposure elsewhere. That broader view is what prevents under-scoping.

Technical breakdown

How compromised OAuth tokens turn an integration into a shared access path

OAuth tokens can let a connected application act on behalf of many downstream tenants without reauthentication at each target system. When those tokens are stolen or abused, the integration itself becomes the mechanism of access, not merely a route into one account. In this article, the Drift integration was the access point that allowed pivoting into Salesforce and Google Workspace environments. That matters because token scope, token reuse, and delegated trust are all decided before an incident happens, not during the attack. Once the integration is trusted, every tenant inheriting that trust inherits the same exposure window.

Practical implication: Review delegated access paths as shared trust chains, not isolated tenant events.

Why cross-tenant correlation beats single-tenant log search in SaaS incidents

A single tenant’s logs can tell you that an integration behaved oddly, but they cannot tell you whether the same behaviour is happening everywhere else. Cross-tenant intelligence normalizes events across customers, timestamps, identities, and services so the same IOC can be searched once and compared across many environments. In the article, Obsidian used unified entity mapping to connect Salesforce and Google Workspace signals that would otherwise appear unrelated. This is the difference between observing a suspicious event and understanding the full blast radius.

Practical implication: Build detection workflows that compare integration behaviour across tenants and services.

How identity normalization exposes hidden movement across SaaS platforms

SaaS investigations often fail because identity fields do not align cleanly across tools. Email, UPN, display name, IP address, and user-agent can all change by platform, even when the same actor is present. Normalization resolves those differences into one analytic entity so analysts can join audit trails across application boundaries. In this article, that made it possible to identify a new user-agent, sf-export/1.0.0, across multiple victim environments and fold it back into the hunt. Without normalization, the same attacker activity would remain fragmented into separate, low-confidence alerts.

Practical implication: Normalize identity and event fields before attempting cross-service threat hunting.

Threat narrative

Attacker objective: The attackers aimed to use one compromised integration to reach multiple downstream SaaS environments and expand the breach beyond a single tenant.

1. Entry occurred through compromised OAuth tokens tied to the Drift integration, giving the attackers a delegated access path into downstream SaaS environments.
2. Credential abuse followed as the token-based access was used to pivot into Salesforce and Google Workspace across affected customers.
3. Impact scaled across 700+ organizations, with cross-tenant investigation showing the same malicious activity in multiple environments and a broader blast radius than earlier direct attacks.

Breaches seen in the wild

• Trivy supply chain attack 2026: A PAT stolen via a Trivy workflow and a botched rotation let TeamPCP poison Trivy releases and Action tags to steal CI/CD secrets.
• ClawHub malicious skills 2026: Hundreds of malicious ClawHub skills for the OpenClaw agent pushed credential stealers in early 2026; Koi found 341 of 2,857 in the ClawHavoc campaign.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Cross-tenant visibility is now a core control for SaaS supply chain risk: once a third-party integration becomes the access path, single-tenant monitoring cannot define the true blast radius. The article shows that the compromise was visible only when events were compared across customers and services at once. That means investigations need an analytic plane that spans tenants, not just better logging inside each tenant. Practitioners should treat cross-tenant correlation as a governance requirement, not an advanced detection feature.

Delegated SaaS access has become an identity problem, not just an application problem: OAuth grants, connected apps, and integration tokens behave like non-human identities with shared trust and broad reach. The Salesloft-Drift case shows that the trust edge moved to the integration layer, where access can persist and spread without direct human interaction. That shifts governance attention from user sessions to delegated access chains, especially where multiple downstream services inherit the same token authority. Practitioners need to audit who can create, approve, and retain that delegated trust.

Identity normalization is the missing prerequisite for modern SaaS investigation: the same actor can look different across logs, platforms, and event types unless the data model resolves them to one entity. The article’s cross-service finding depended on that normalization, including the ability to connect Salesforce and Google Workspace events to the same behaviour pattern. Without it, teams are left with partial evidence and delayed notification. Practitioners should assume fragmented identity fields will hide real compromise unless the data layer corrects for it.

Integration-layer visibility exposes a new blast-radius metric for SaaS programmes: the relevant question is no longer whether a single app was compromised, but how many downstream services inherit that app’s trust. The article describes a breach where the blast radius was far larger than direct-infiltration incidents because the integration itself widened exposure. That should change how security teams evaluate connected apps, third-party tokens, and tenant-level isolation. Practitioners must measure exposure where delegation meets scale.

Salesloft-Drift proved that SaaS supply chain compromise now demands multi-tenant threat hunting: attackers do not need to own each tenant when a common integration can project the same access pattern everywhere. The article’s 700+ victim scope shows that one noisy environment may actually be part of a wider campaign. Security teams should therefore align detection, incident response, and third-party review around shared integrations rather than isolated accounts. Practitioners should expect the next breach to be equally cross-customer by design.

From our research library:

• 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Cross-tenant intelligence is the control gap hiding behind many SaaS investigations: incident response that stops at one tenant will miss shared access patterns, repeated user-agent behaviour, and scope that spans multiple customers. The article shows that the same delegated integration can present as separate local events unless the data model is designed to compare tenants, services, and identities together.

Delegated access creates trust debt across the SaaS estate: OAuth grants and connected apps expand reach in ways that are hard to see until a breach exposes the same path everywhere. As the 2026 Infrastructure Identity Survey reports, 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, and that shift will raise the value of identity models that can follow non-human trust across systems according to the 2026 Infrastructure Identity Survey.

For practitioners

• Map delegated SaaS trust chains Inventory every connected application, OAuth grant, and integration token that can touch multiple services or tenants. Focus on paths that let one third party read, write, or pivot across Salesforce, Google Workspace, and similar collaboration systems.
• Correlate identity across platforms Normalize email, UPN, display name, IP, and user-agent fields before hunting across SaaS logs. The same actor often appears as different entities unless the data model collapses those variations into one identity.
• Baseline integration behaviour by tenant Establish what normal user-agent strings, source IP ranges, and event timing look like for each high-trust integration. Treat stable integration behaviour as the reference point and investigate deviations as possible compromise indicators.
• Reassess third-party access after breach disclosure When one integration compromise is confirmed, expand the review to every downstream service that inherits the same delegated access. The key question is not which single tenant was hit first, but which tenants share the same trust path.

Key takeaways

• The Salesloft-Drift case shows that a compromised integration can turn SaaS delegation into a multi-tenant exposure problem rather than a single-tenant incident.
• The article’s evidence came from correlating identity and event data across customers and services, which revealed scope that isolated logs did not show.
• Security teams need cross-tenant investigation, identity normalization, and delegated-access review to avoid under-scoping SaaS supply chain breaches.

Key terms

• Cross-tenant Intelligence: Cross-tenant intelligence is the practice of comparing security telemetry across multiple customer environments to identify shared attacker behaviour, not just local anomalies. It matters in SaaS supply chain incidents because the same compromise can look ordinary inside one tenant but reveal its true scale when seen across many.
• Delegated SaaS access: Delegated SaaS access is permission granted to one application, connector, or service account to act on behalf of another identity or data owner. It is often necessary for automation, but it becomes a governance risk when the grant is broad, stale, or poorly owned.
• Agent-layer visibility: The ability to see what an agent installed, what tools it can call, and what it actually does at runtime in one place. This matters because neither registry data nor endpoint monitoring alone can reliably show the full identity and control story for MCP-based workflows.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.