Topic starter
25/06/2026 12:54 am
TL;DR: The Drift breach showed that non-human identity governance failed beyond simple token theft, with Apono pointing to broad standing access and weak oversight. OAuth-connected systems can let one compromised integration spill into Salesforce data and other secrets.
Editorial analysis by NHI Mgmt Group, based on content published by Apono: “Beyond the Drift Breach: Securing Non-Human Identities with Zero Standing Privileges”.
By the numbers:
- All signs point to the incident affecting over 700 organisations.
Key questions
Q: Why do compromised NHI tokens often create more damage than the initial breach?
A: Because the token usually carries delegated trust into multiple systems, not just one app.
Q: What are the signs that non-human identity governance is starting to slip?
A: Warning signs include reliance on manual upgrade paths, ad hoc secret handling, and fragmented access management across tools and environments.
Q: What breaks when OAuth tokens are compromised in connected SaaS environments?
A: When OAuth tokens are compromised, attackers can inherit delegated access without defeating passwords or MFA.
Practitioner guidance
- Audit all OAuth-connected principals Inventory every token, app connection, and service principal tied to Salesforce, Slack, AWS, Azure, and Google Workspace so you know what can still authenticate.
- Revoke standing access after the task ends Replace persistent integration access with shorter-lived, task-scoped privileges wherever the workflow does not require continuous access.
- Reduce OAuth scopes to actual use Remove permissions that are not exercised in normal operation, especially where a token can reach email, file stores, or cloud consoles.
Bottom line: The breach exposed a governance failure in how organisations manage non-human access, not just a one-off token theft.
Glossary terms: Non-Human Identity (NHI), OAuth Token, Standing Privilege, Token Offboarding
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 9:58 am
Zero standing privilege is the correct control lens for NHI governance after Drift: The breach worked because access remained available before and after the useful task window. Standing access creates a persistent blast radius that tokens, app connections, and service accounts can all inherit when organisations optimise for convenience instead of expiry. Practitioners should treat persistence itself as the risk condition, not just theft.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
A: Treat it as an integration-layer incident, not a product flaw. Contain the blast radius by inventorying every connected integration, identifying the non-human identities and permissions they use, and revoking or rotating any exposed secrets. Then hunt for abnormal activity such as new IPs, off-hours access, unusual query spikes, and unexpected exports. Preserve logs early so investigators can reconstruct scope and timeline.
👉 Read our full editorial: Drift breach shows standing access is the real NHI weak point
This post was modified 1 day ago by NHI Mgmt Group