Topic starter
04/12/2025 3:08 pm
TL;DR: The Salesloft and Gainsight breaches show how compromised OAuth and refresh tokens can let attackers enter SaaS environments as trusted non-human identities, then harvest downstream secrets and pivot into cloud systems, according to Hush Security. The pattern confirms that identity governance now has to cover integrations, token scope, and downstream credential exposure, not just human access.
Editorial analysis by NHI Mgmt Group, based on content published by Hush Security: “Why Storm the Castle When You Already Hold the Keys to the Kingdom?”.
Key questions
Q: What breaks when a stolen OAuth token is used against a trusted integration?
A: The trust model breaks because the system still sees a valid credential, even though the actor behind it is no longer trustworthy.
Q: Why do SaaS integrations with standing privilege increase breach impact?
A: They expand the blast radius because one compromised token can reach multiple systems, data stores, and business processes.
Q: How do security teams tell whether integration governance is actually working?
A: Look for evidence that every integration is inventoried, scoped, owned, and reviewed on a regular lifecycle.
Practitioner guidance
- Inventory every premium-scope integration Build a complete register of service accounts, bots, OAuth apps, and connected integrations that can touch critical systems.
- Tighten token scopes and offboarding Review whether each integration still needs the privileges it currently holds, then remove unused scopes and revoke access when the business relationship changes or the app is no longer required.
- Map downstream secret pathways Identify which integrations can access cloud keys, Snowflake tokens, support data, or other sensitive secrets, then reduce those paths to the minimum required for operation.
Bottom line: The core risk is not a Salesforce weakness but the abuse of trusted non-human identities that hold delegated access into SaaS and cloud estates.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/10/2026 4:30 pm
Compromised integrations are now identity failures, not application anomalies. The Salesloft and Gainsight cases show that OAuth and refresh tokens can function as durable delegated identities with broad authority. Once that delegation is abused, the issue is no longer who logged in, but which non-human identity was trusted to act. Practitioners should treat integration governance as core identity governance, not an adjacent SaaS concern.
A few things that frame the scale:
- 68% of organisations do not know how to fully address NHI risks, according to the Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should organisations treat third-party integrations like privileged accounts?
A: Always, when the integration can read data, call APIs, or unlock downstream secrets in production systems. At that point it is not a passive connector but an external privilege holder with a lifecycle, scope, and offboarding requirement. The governance standard should be the same discipline used for other high-risk identities.
👉 Read our full editorial: Salesloft and Gainsight breaches expose the NHI trust gap