Topic starter
16/01/2026 2:18 pm
TL;DR: Shadow AI and SaaS integration sprawl are expanding attack paths that can turn one compromised OAuth token into downstream access across customer environments, according to Wing Security’s analysis of the Salesloft-Drift breach. The governance gap is now visibility and token control, not just perimeter defense.
Editorial analysis by NHI Mgmt Group, based on content published by Wing Security: “Supply chain attacks meet Shadow AI”.
Key questions
Q: What breaks when shadow AI is not included in identity governance?
A: When shadow AI is excluded, the organisation loses discovery, ownership, and enforcement at the same time.
Q: Why do OAuth tokens and SaaS integrations create outsized breach risk in connected environments?
A: OAuth tokens can grant persistent, authorized access that looks normal to security controls.
Q: How can security teams tell whether app-to-app trust is outpacing governance?
A: Look for integrations that were adopted by business users, have broad data scopes, or lack a clear owner, review cycle or revocation process.
Practitioner guidance
- Inventory all SaaS and AI connections Build and continuously refresh a trust inventory for every sanctioned and unsanctioned application, chatbot and integration, including the credentials and scopes each one uses to reach enterprise data.
- Tighten OAuth scope and refresh controls Reduce delegated access to the minimum required, eliminate unnecessary refresh tokens where possible and require explicit review for integrations that can reach sensitive systems or secrets.
- Map trust paths to downstream data stores Document which apps can reach Salesforce, file systems, identity providers and analytics platforms so a compromised integration can be isolated before the compromise fans out.
Bottom line: Shadow AI turns ordinary SaaS integrations into non-human identity risks when they create unmanaged delegated access across customer environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:29 pm
Shadow AI supply chain risk is really a delegated-trust problem. The article is not describing a new class of malware so much as a new way for ordinary SaaS trust relationships to be abused at scale. When an AI-enabled integration can read, relay or synchronise data across customer systems, the attack surface becomes the full trust graph. Practitioners should stop treating integration sprawl as a procurement issue and treat it as NHI governance with direct blast-radius consequences.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat Shadow AI and SaaS supply chain risk as a third-party access problem?
A: Yes. The practical problem is not just AI adoption, but unmanaged third-party access that inherits enterprise trust through tokens and connectors. Treating it as third-party access forces ownership, review, revocation and offboarding into the same process instead of leaving them scattered across app teams and IT security.
👉 Read our full editorial: Shadow AI supply chain risk is widening the NHI attack surface