Notifications
Clear all
Topic starter
21/08/2026 4:56 pm
TL;DR: Cloudflare’s disclosure that attackers reached 104 API tokens through the Salesloft Drift compromise shows how a single SaaS breach can cascade into downstream credential exposure, according to Nightfall’s analysis of the incident. The pattern confirms that vendor questionnaires and periodic reviews are too slow for modern supply chain risk, where credentials, tokens, and API access are the real prize.
NHIMG editorial — based on content published by Nightfall covering the Cloudflare and Salesloft breach chain: The Cloudflare Breach: Why Supply Chain Security Can't Be an Afterthought in 2025
By the numbers:
- Cloudflare confirmed that attackers accessed 104 API tokens through the Salesloft Drift breach.
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers.
Questions worth separating out
Q: What breaks when a vendor stores or relays my organisation’s credentials?
A: The trust boundary breaks first, because a vendor compromise can turn stored tokens, API keys, or passwords into reusable access paths into your environment.
Q: Why do third-party integrations increase identity risk so quickly?
A: Third-party integrations increase identity risk because they extend trust through credentials, tokens, and delegated access rather than through direct human oversight.
Q: How do security teams know if build-time secret exposure is actually contained?
A: Containment is real only when the exposed identities are revoked, not merely detected.
Practitioner guidance
- Inventory credential-bearing integrations Identify every third-party platform that can store, relay, or access API tokens, passwords, or access keys, then classify each integration by blast radius and revocation path.
- Expand secret discovery beyond code Scan Slack, Jira, Confluence, support tickets, documentation, and AI prompt workflows for live secrets, because repository-only scanning misses a large share of exposure.
- Automate token revocation on exposure Connect detection to revocation so confirmed tokens are disabled immediately across cloud, SaaS, and VPN systems instead of waiting for manual triage.
What's in the full article
Nightfall's full report covers the operational detail this post intentionally leaves for the source:
- How Nightfall maps data exfiltration paths across SaaS, collaboration tools, and Shadow AI workflows
- The report's product-level explanation of Data Detection & Response and Data Exfiltration Prevention in vendor environments
- Implementation detail for identifying exposed secrets in unstructured content and automating response
- The report's data lineage angle for tracing which vendors can access sensitive credentials
👉 Read Nightfall's analysis of the Cloudflare and Salesloft breach chain →
Cloudflare and Salesloft breach: what vendor credential risk means now?
Explore further
21/08/2026 5:13 pm
Vendor compromise is now a credential problem, not only a procurement problem. The Cloudflare and Salesloft chain shows that third-party risk becomes operational the moment tokens, API keys, or password-bearing workflows cross organisational boundaries. Security teams that still treat vendor review as a compliance artefact are missing the real attack surface. The governance question is not whether the vendor passed review, but whether its integrations can propagate access into your environment. Practitioners should manage vendors as identity-bearing extensions of the enterprise.
A question worth separating out:
Q: Who is accountable when a supplier breach exposes customer API tokens?
A: Accountability usually sits with both the supplier and the customer because one party manages the compromised system while the other owns downstream access governance. That means contracts alone are not enough. Security, IAM, and risk teams must define who can revoke, who must notify, and how exposure is measured across shared integrations.
👉 Read our full editorial: Cloudflare and Salesloft expose why vendor credentials are the real target
