Topic starter
06/09/2026 6:21 pm
TL;DR: The late-August threat landscape was defined by AI-assisted developer reconnaissance, OAuth token abuse, signed-driver evasion, and active exploitation of Git and SaaS supply chain weaknesses, according to FireCompass’s weekly report, with more than 700 organisations affected by the Salesloft Drift breach. The pattern is clear: attacker speed, persistence, and trust abuse are now outpacing quarterly control cycles.
Editorial analysis by NHI Mgmt Group, based on content published by FireCompass: “Weekly Report: New Hacking Techniques and Critical CVEs 09 Sep – 15 Sep, 2025”.
By the numbers:
- More than 700 organisations were affected by the Salesloft Drift breach, according to FireCompass.
Key questions
Q: What breaks when OAuth access is not governed like a non-human identity?
A: Access persists beyond the user session that created it, so the organisation loses the usual sign-in checkpoints that would normally bound use.
Q: Why do third-party integrations increase risk in SaaS support environments?
A: Third-party integrations expand the attack surface because each connected app can expose data, permissions, or workflows outside the core platform.
Q: How do security teams detect when developer tooling is being used for reconnaissance?
A: Look for unusual credential searches, environment variable access, repository enumeration, and scripted scans across build and CLI workflows.
Practitioner guidance
- Inventory delegated SaaS connections Build a complete register of OAuth apps, third-party integrations, and automation paths that can access production data, then classify them by business owner and scope.
- Shorten token lifetime and scope Limit OAuth scopes to the minimum required functions, revoke unused tokens, and remove integrations that can still operate after the business need has ended.
- Monitor developer environments for secret exposure Inspect build logs, local CLI workflows, and repository hooks for secrets, environment variables, and credential material that attackers can harvest during reconnaissance.
Bottom line: The article’s central warning is that SaaS, supply chain, and OAuth abuse are no longer separate threat stories but one connected trust problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 6:22 pm
OAuth persistence is now a governance problem, not just an authentication problem. Once a token can act across Salesforce, Google Workspace, and connected apps, the real control question becomes scope, lifetime, and revocation. Organisations that still treat OAuth as a plumbing detail are missing the fact that delegated access is now a primary attack surface. Practitioners should govern tokens as non-human identities with lifecycle controls, not as disposable integration artifacts.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations respond when a SaaS integration is compromised?
A: Treat it as an identity incident first. Revoke tokens, disconnect the integration, isolate affected tenants or workspaces, and review related service accounts and consent grants. Do not wait for a software patch if the access path is already active, because the attacker may be operating through valid authorization.
👉 Read our full editorial: SaaS, supply chain and OAuth abuse are converging in 2025