Topic starter
16/01/2026 5:39 pm
TL;DR: The Salesloft Drift breach used stolen OAuth tokens to access Salesforce environments, extract sensitive data, and expose more than 100 API tokens across a chain that reached over 700 customers, according to Silverfort. It shows that integration trust, not just perimeter security, has become the control plane that attackers target.
Editorial analysis by NHI Mgmt Group, based on content published by Silverfort: “The Salesloft Drift breach: A cross-vendor lateral movement attack that requires a new shared security model”.
By the numbers:
- Attackers used stolen OAuth tokens to reach Salesforce environments on behalf of over 700 customers.
- Cloudflare said 104 API tokens and sensitive case data were compromised in the incident.
- The breach exposed more than 100 API tokens that attackers could mine for further cloud access.
Key questions
Q: What breaks when third-party SaaS tokens are not continuously governed?
A: The break is ownership, not just visibility.
Q: Why do OAuth tokens increase lateral movement risk in SaaS environments?
A: OAuth tokens increase lateral movement risk because they can remain valid after the initial user session, bypass MFA, and preserve scoped access until revoked.
Q: How should teams govern NHI access in identity platforms?
A: Teams should govern NHI access by linking every non-human identity to an owner, purpose, approval path, and expiry condition.
Practitioner guidance
- Inventory every delegated SaaS integration Document which third-party apps can act on behalf of your tenants, what data they can query, and which internal teams own the relationship.
- Classify OAuth tokens as governed identities Assign ownership, scope, expiry, and revocation responsibility to each integration token instead of treating it as background plumbing.
- Add emergency revocation paths Test whether partner tokens can be disabled quickly across all connected tenants when a compromise is disclosed.
Bottom line: The breach exposed a governance gap in delegated SaaS trust, where third-party tokens could be stolen and reused as access paths across vendor boundaries.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 11:47 pm
Cross-vendor NHI trust failure is now a governance category of its own. The Salesloft Drift breach is not best described as a single-vendor compromise or a generic supply chain event. It is a delegated trust failure in which one partner’s token became a pathway into another partner’s environment, then into customer data and embedded secrets. That pattern belongs in NHI governance because the identity being abused was a non-human credential with cross-organisational reach. Practitioners should treat partner-issued tokens as part of the identity perimeter, not the network perimeter.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams respond when a trusted SaaS integration is compromised?
A: Start by revoking the compromised token, then inventory every related credential, service principal, API key, and downstream system that the app could reach. After that, review scopes, reissue credentials from trusted environments, and monitor for unusual API activity. The goal is to close the trust chain, not just the first entry point.
👉 Read our full editorial: Salesloft Drift breach shows cross-vendor NHI trust failure