Topic starter
14/08/2026 6:37 pm
TL;DR: Cross-tenant analysis of the Salesloft-Drift supply chain breach identified every impacted organization in its customer base within 30 minutes and surfaced Google Workspace scope before others reported it, showing how SaaS integrations can hide cross-service compromise across 700+ victims, according to Obsidian Security. The lesson is that integration-layer visibility, not isolated log search, now determines whether SaaS identity risk can be investigated at all.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “How Obsidian Security Found What 700 Companies Couldn't: A SaaS Supply Chain Investigation”.
By the numbers:
- The attack affected 700+ organizations through downstream customer environments.
- Obsidian Security said the blast radius was 10x greater than previous incidents where attackers infiltrated Salesforce directly.
Key questions
Q: What breaks when SaaS incident response stays limited to a single tenant?
A: Teams lose the ability to see whether the same compromised integration is affecting multiple customers at once.
Q: Why do delegated SaaS integrations create cross-customer breach risk?
A: Because one OAuth grant or connected app can inherit trust across many downstream environments.
Q: How do security teams know whether an integration compromise is spreading?
A: They look for the same user-agent, source IP, token activity, or entity pattern across multiple services and tenants.
Practitioner guidance
- Map delegated SaaS trust chains Inventory every connected application, OAuth grant, and integration token that can touch multiple services or tenants.
- Correlate identity across platforms Normalize email, UPN, display name, IP, and user-agent fields before hunting across SaaS logs.
- Baseline integration behaviour by tenant Establish what normal user-agent strings, source IP ranges, and event timing look like for each high-trust integration.
Bottom line: The Salesloft-Drift case shows that a compromised integration can turn SaaS delegation into a multi-tenant exposure problem rather than a single-tenant incident.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:43 pm
Cross-tenant visibility is now a core control for SaaS supply chain risk: once a third-party integration becomes the access path, single-tenant monitoring cannot define the true blast radius. The article shows that the compromise was visible only when events were compared across customers and services at once. That means investigations need an analytic plane that spans tenants, not just better logging inside each tenant. Practitioners should treat cross-tenant correlation as a governance requirement, not an advanced detection feature.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should teams do when a third-party app is confirmed in a SaaS breach?
A: Expand the investigation to every service that shares the same delegated trust, then review which identities, tokens, and integrations inherit that access. The question is not just whether one tenant is affected, but whether the same integration pattern has created exposure elsewhere. That broader view is what prevents under-scoping.
👉 Read our full editorial: Cross-tenant intelligence exposed the full Salesloft-Drift blast radius