Topic starter
16/01/2026 3:33 pm
TL;DR: Legacy security stacks struggle to see risks that now live inside SaaS, where OAuth tokens, service accounts, and AI agents can move access between applications without passing through the controls traditional tools were built to monitor, according to Obsidian Security. The practical shift is toward relationship-aware SaaS governance, because visibility into identities and entitlements matters more than perimeter inspection.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “Legacy Security vs. Obsidian: Why SaaS Security Demands a New Approach”.
Key questions
Q: What breaks when OAuth tokens are compromised in connected SaaS environments?
A: When OAuth tokens are compromised, attackers can inherit delegated access without defeating passwords or MFA.
Q: Why do OAuth integrations and service accounts increase SaaS blast radius?
A: They can carry access across multiple applications without forcing a new human authentication step, so one compromised or over-scoped relationship can be reused repeatedly.
Q: How do security teams know whether SaaS integration monitoring is actually working?
A: Monitoring is working when it surfaces abnormal authentication, unusual API queries, large exports, and suspicious session patterns quickly enough to support containment.
Practitioner guidance
- Map all SaaS-to-SaaS trust paths Identify every OAuth grant, service account and automation integration that can move access between applications without a user login.
- Review delegated scopes and dormant rights Inventory scopes that exceed the workflow they support and flag service accounts with permissions that remain active after the owning use case has changed.
- Classify AI agents as governed access actors Treat agent credentials, inherited permissions and cross-tenant app access as part of the access model, not as separate automation metadata.
Bottom line: SaaS security gaps emerge when OAuth tokens, service accounts and AI agents move privilege inside applications beyond the reach of traditional perimeter tools.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
08/10/2026 4:54 pm
Legacy SaaS controls are now blind to the identity objects that matter most. CASB, EDR and SIEM were built around network, endpoint and event visibility, so they cannot reliably explain token-mediated or service-account-mediated access inside SaaS. That is not a tuning problem. It is a control-plane mismatch that leaves entitlement relationships under-governed.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- The blast radius of the Salesloft-Drift OAuth supply chain attack was 10 times greater than earlier incidents in which attackers breached Salesforce directly.
A question worth separating out:
Q: What should organisations do when an AI agent can chain SaaS permissions?
A: Treat the agent as an access actor with inherited entitlements, not as a benign automation layer. Define which applications it can touch, which scopes it may activate, and where cross-tenant access must be blocked. The goal is to stop chained privilege from turning one workflow into a broad execution path.
👉 Read our full editorial: SaaS security gaps in OAuth tokens and AI agents demand new controls