Zero standing privileges for NHI access after the Drift breach

At a glance

What this is: This is an analysis of the Drift OAuth breach and the NHI governance gaps it exposed, especially hidden standing access, excessive privilege, and poor token visibility.

Why it matters: It matters because IAM, PAM, and NHI programmes now have to govern tokens, service accounts, and AI-connected access paths as first-class identities, not as incidental integrations.

By the numbers:

• All signs point to the incident affecting over 700 organisations.

Context

The core issue is not just token theft. The Drift incident shows what happens when OAuth tokens, API keys, and other non-human credentials are left with standing access, limited visibility, and broader permissions than the workflows truly need.

In NHI governance terms, the failure is lifecycle control. If tokens can persist unseen, retain privilege after their original purpose, and remain embedded in business workflows, a single compromise becomes an identity problem across multiple systems.

That is why the breach matters beyond one SaaS integration. It is a practical example of how unmanaged non-human identities can widen blast radius faster than conventional access reviews can catch up.

Key questions

Q: What breaks when OAuth tokens are compromised in connected SaaS environments?

A: When OAuth tokens are compromised, attackers can inherit delegated access without defeating passwords or MFA. In connected SaaS environments, that access can spread into multiple applications, cached data sets, and embedded records. The failure is not only token theft, but the assumption that one app boundary contains the blast radius. That assumption rarely holds once integrations are chained.

Q: Why do compromised NHI tokens often create more damage than the initial breach?

A: Because the token usually carries delegated trust into multiple systems, not just one app. If the credential can read mail, files, tickets, or cloud metadata, attackers can harvest additional secrets and identity material that unlock further access. The damage scales with scope, persistence, and lack of offboarding discipline.

Q: What are the signs that non-human identity governance is starting to slip?

A: Warning signs include reliance on manual upgrade paths, ad hoc secret handling, and fragmented access management across tools and environments. The article mentions caveats, dispatch limits, SSO support, and automated update channels, all of which point to the need for controlled operational discipline. When teams cannot explain how identities are provisioned, updated, and constrained, governance is already weaker than it should be.

Q: How should security teams respond when a third-party integration token is stolen and starts accessing cloud data stores?

A: Treat it as an integration-layer incident, not a product flaw. Contain the blast radius by inventorying every connected integration, identifying the non-human identities and permissions they use, and revoking or rotating any exposed secrets. Then hunt for abnormal activity such as new IPs, off-hours access, unusual query spikes, and unexpected exports. Preserve logs early so investigators can reconstruct scope and timeline.

Technical breakdown

How compromised OAuth tokens become reusable access paths

OAuth tokens are delegated credentials, not passwords, but they still act as bearer-style access for connected applications. When attackers steal a token from one integration, they can often replay it against the connected service without needing the original user’s password or MFA. In a SaaS chain, that turns one trusted integration into a reusable access path across data stores, messaging platforms, and cloud services. The governance mistake is assuming delegated access is inherently safer because it is issued for automation. In practice, the token’s effective power depends on scope, lifetime, and whether the organisation can see where it is used. Practical implication: treat every OAuth token as a governed principal with explicit scope and expiry.

Practical implication: treat every OAuth token as a governed principal with explicit scope and expiry.

Why standing privilege expands the blast radius

Standing privilege means access exists before anyone needs it and remains available after the original task is done. For non-human identities, that creates a long exploitation window because tokens, service accounts, and app connections are often left active to avoid breaking workflows. The Drift case shows why excess privilege matters as much as exposure: once a token is obtained, broad permissions let attackers search for more secrets, pivot into adjacent systems, and compound the impact. Least privilege is not enough if the privilege never goes away. Practical implication: reduce not only permissions, but also the duration and persistence of those permissions.

Practical implication: reduce not only permissions, but also the duration and persistence of those permissions.

Why legacy IAM and PAM models miss non-human identities

Traditional IAM and PAM were built around human users and relatively static privileged accounts. Non-human identities behave differently: they are numerous, embedded in tooling, and frequently hidden inside integrations that teams do not inventory well. That is why conventional recertification and manual access review processes miss them so easily. The breach exposes a governance gap where identity controls exist, but the organisation does not have a reliable inventory of what should be reviewed in the first place. Practical implication: govern non-human identities with discovery, ownership, and lifecycle controls designed for machine-scale access.

Practical implication: govern non-human identities with discovery, ownership, and lifecycle controls designed for machine-scale access.

Threat narrative

Attacker objective: The objective was to turn one stolen integration credential into broader access, additional secrets, and downstream compromise across multiple connected environments.

1. Entry occurred through compromised OAuth tokens tied to the Salesloft Drift integration, which gave the attackers access to Salesforce-connected data.
2. Credential access followed as the attackers extracted credentials such as AWS keys and Snowflake tokens from the exfiltrated Salesforce content.
3. Escalation and lateral movement came from searching the stolen data for additional tokens and credentials that could unlock more systems and accounts.
4. Impact expanded beyond one environment, affecting more than 700 organisations and extending into connected services such as Google Workspace, Slack, AWS, and Microsoft Azure.

Breaches seen in the wild

• Palo Alto Networks Salesforce data theft 2025: Stolen Drift OAuth tokens exposed Palo Alto Networks CRM data, including support notes where some customers had shared credentials.
• 230M AWS environment compromise: 230M AWS environments compromised via exposed .env files with cloud credentials.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Zero standing privilege is the correct control lens for NHI governance after Drift: The breach worked because access remained available before and after the useful task window. Standing access creates a persistent blast radius that tokens, app connections, and service accounts can all inherit when organisations optimise for convenience instead of expiry. Practitioners should treat persistence itself as the risk condition, not just theft.

Ephemeral credentials without lifecycle governance still leak privilege: Short-lived access reduces exposure, but only when issuance, scope, and revocation are tightly governed. The Drift pattern shows that delegated non-human access can still be broad enough to unlock multiple systems and secret stores, so the real control variable is not just token lifetime but whether the credential is owned, discovered, and retired on time.

Hidden non-human identities are now a supply chain governance problem: The article shows how one vendor integration can expose many customer environments because access relationships chain across SaaS and cloud services. That means third-party NHI inventory, scope review, and offboarding are no longer optional hygiene. The practitioner conclusion is simple: if you cannot inventory the principal, you cannot defend the path.

Legacy IAM review cycles are too slow for machine-scale access: Manual recertification assumes people can notice, classify, and remove risky access before abuse. Non-human identities move faster, appear in more places, and often lack a clear human owner, which makes traditional review cadences structurally misaligned. Security teams need governance built around continuous discovery and privilege reduction, not periodic paperwork.

Ephemeral credential trust debt: This breach shows how organisations accumulate hidden risk when integrations are trusted to operate indefinitely without active governance. The debt is not only technical; it is operational and ownership-related, because every unmanaged token becomes another place attackers can start chaining access. The practitioner implication is that token sprawl must be treated as a board-relevant identity risk.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
• Read next: Guide to NHI Rotation Challenges

What this signals

Zero standing privilege for integrations is becoming the practical baseline: Teams that still leave OAuth tokens, service accounts, and app connections active after use are carrying a hidden identity debt. The Drift pattern shows that the real issue is not token existence, but token persistence after the business need has ended.

Non-human identity inventory now needs ownership, not just discovery: Discovery alone tells you what exists; it does not tell you who must revoke it, review it, or retire it. Organisations that cannot map each principal to a business owner will continue to miss the access paths attackers exploit.

NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs. That scale explains why manual review cycles fail and why lifecycle governance has to move to the point of issuance, not the point of audit.

For practitioners

• Audit all OAuth-connected principals Inventory every token, app connection, and service principal tied to Salesforce, Slack, AWS, Azure, and Google Workspace so you know what can still authenticate.
• Revoke standing access after the task ends Replace persistent integration access with shorter-lived, task-scoped privileges wherever the workflow does not require continuous access.
• Reduce OAuth scopes to actual use Remove permissions that are not exercised in normal operation, especially where a token can reach email, file stores, or cloud consoles.
• Create ownership for every machine credential Assign a named business and technical owner for each non-human identity so discovery, review, and offboarding do not depend on tribal knowledge.
• Quarantine suspicious principals quickly Isolate tokens and integrations that show dormant use, unusual privilege breadth, or evidence of exfiltration before you permanently delete them.

Key takeaways

• The breach exposed a governance failure in how organisations manage non-human access, not just a one-off token theft.
• Attacks on one integration can cascade into multiple environments when OAuth scopes and standing privileges are too broad.
• Zero standing privilege, tighter scope control, and reliable ownership are the controls most likely to limit the next incident.

Key terms

• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• OAuth Token: A short-lived access credential issued by an OAuth 2.0 authorisation server granting an NHI scoped access to specific resources for a defined period. Preferred over static API keys because their short lifetime limits the exploitation window if intercepted.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Token Offboarding: Token offboarding is the process of discovering, revoking, and retiring credentials that are no longer required. For machine identities, offboarding matters as much as provisioning because stale tokens often remain active inside SaaS integrations, cloud workflows, and automation pipelines long after ownership has faded.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.