Topic starter
25/06/2026 12:54 am
TL;DR: A compromised OAuth path in the Drift integration let attackers access Salesforce data and pull additional secrets from more than 700 organisations, showing how hidden non-human identities can turn a vendor compromise into a broad credential-exposure event, according to Apono. Standing access, not just token theft, is the real governance failure here.
Editorial analysis by NHI Mgmt Group, based on content published by Apono: “Beyond the Drift Breach: Securing Non-Human Identities with Zero Standing Privileges”.
By the numbers:
- All signs point to the incident affecting over 700 organisations.
Key questions
Q: What breaks when OAuth tokens are compromised in connected SaaS environments?
A: When OAuth tokens are compromised, attackers can inherit delegated access without defeating passwords or MFA.
Q: Why do compromised NHI tokens often create more damage than the initial breach?
A: Because the token usually carries delegated trust into multiple systems, not just one app.
Q: What are the signs that non-human identity governance is starting to slip?
A: Warning signs include reliance on manual upgrade paths, ad hoc secret handling, and fragmented access management across tools and environments.
Practitioner guidance
- Audit all OAuth-connected principals Inventory every token, app connection, and service principal tied to Salesforce, Slack, AWS, Azure, and Google Workspace so you know what can still authenticate.
- Revoke standing access after the task ends Replace persistent integration access with shorter-lived, task-scoped privileges wherever the workflow does not require continuous access.
- Reduce OAuth scopes to actual use Remove permissions that are not exercised in normal operation, especially where a token can reach email, file stores, or cloud consoles.
Bottom line: The breach exposed a governance failure in how organisations manage non-human access, not just a one-off token theft.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:58 am
Zero standing privilege is the correct control lens for NHI governance after Drift: The breach worked because access remained available before and after the useful task window. Standing access creates a persistent blast radius that tokens, app connections, and service accounts can all inherit when organisations optimise for convenience instead of expiry. Practitioners should treat persistence itself as the risk condition, not just theft.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
A: Treat it as an integration-layer incident, not a product flaw. Contain the blast radius by inventorying every connected integration, identifying the non-human identities and permissions they use, and revoking or rotating any exposed secrets. Then hunt for abnormal activity such as new IPs, off-hours access, unusual query spikes, and unexpected exports. Preserve logs early so investigators can reconstruct scope and timeline.
👉 Read our full editorial: Zero standing privileges for NHI access after the Drift breach