Topic starter
16/01/2026 3:30 pm
TL;DR: SaaS supply chain attacks exploit hidden SaaS-to-SaaS connections, and the article argues that traditional VRM, SBOM, and CI/CD controls only cover part of the exposure picture while integration-layer risk remains under-governed, according to Obsidian Security. The governance gap is now centred on ephemeral OAuth access, shadow integrations, and cross-app privilege drift, not just vendor posture.
Editorial analysis by NHI Mgmt Group, based on content published by Obsidian Security: “Understanding every layer of your SaaS Supply Chain Security: From VRMs to OAuths”.
By the numbers:
- SaaS to SaaS data moves 10x faster than human to SaaS, making integration monitoring far harder than traditional review cycles.
- 15% of all SaaS breaches originate from a third-party or supply chain compromise, according to IBM Cost of a Data Breach Report, 2025, cited by Obsidian Security.
- The average cost of a SaaS breach in the article is $4.91 million per breach, according to IBM Cost of a Data Breach Report, 2025, cited by Obsidian Security.
Key questions
Q: What breaks when SaaS integrations are created without security oversight?
A: When integrations are created without security oversight, teams lose context on which vendors can access which applications and how much data they can reach.
Q: Why do OAuth tokens and API integrations create supply chain risk?
A: They create risk because they let one application act inside another with delegated authority.
Q: What signals show that SaaS governance is not working?
A: Look for delayed offboarding, repeated manual exports, inconsistent access review responses, and inactive accounts that still carry paid licenses.
Practitioner guidance
- Inventory all OAuth and API integrations Build and maintain an inventory of connected SaaS applications, including shadow integrations, with owners, scopes, and business purpose recorded for each connection.
- Classify integrations as governed non-human access Treat each token, automation, and app connection as a non-human identity with a defined lifecycle, revocation path, and approved scope.
- Review scopes against actual data movement Compare granted OAuth scopes and API permissions to the data and actions the integration truly needs, then remove any excess access.
Bottom line: SaaS supply chain attacks are increasingly driven by hidden OAuth grants and API integrations rather than by direct compromise of the target platform.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 4:53 pm
Integration-layer privilege drift is now the core SaaS supply chain problem: vendor posture still matters, but it no longer tells the whole story because the exploitable surface sits in live OAuth grants, API links, and automations. Those connections can outgrow the approval that created them, and the result is access that is technically valid but operationally unjustified. The practitioner conclusion is simple: govern the connection, not just the supplier.
A few things that frame the scale:
- 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams balance vendor risk management with integration monitoring?
A: Vendor risk management should remain the baseline for supplier assurance, but it cannot replace monitoring of live SaaS connections. Teams need both views because supplier posture describes the outside of the relationship, while integration monitoring reveals who can actually move data and actions between applications. Without both, important exposure stays invisible.
👉 Read our full editorial: SaaS supply chain risk is hiding in OAuth and API integrations