Topic starter
15/01/2026 4:51 pm
TL;DR: Two 2025 campaigns abused Salesforce-connected trust rather than exploiting Salesforce itself: one used a Salesloft compromise to steal OAuth tokens and access data across more than 700 organizations, while another relied on vishing and malicious app authorization to exfiltrate Salesforce records, according to Valence Security. The lesson is that SaaS integration governance, not perimeter defense, now determines blast radius and response speed.
Editorial analysis by NHI Mgmt Group, based on content published by Valence Security: “Surfing the Salesforce Breach Wave: What SaaS Trust Really Costs”.
By the numbers:
- The Salesloft-linked campaign impacted more than 700 organizations.
Key questions
Q: What breaks when SaaS integrations are created without security oversight?
A: When integrations are created without security oversight, teams lose context on which vendors can access which applications and how much data they can reach.
Q: Why do OAuth tokens increase lateral movement risk in SaaS environments?
A: OAuth tokens increase lateral movement risk because they can remain valid after the initial user session, bypass MFA, and preserve scoped access until revoked.
Q: What are the signs that third-party SaaS integrations are becoming a security problem?
A: Warning signs include large numbers of unused integrations, apps requesting broad read and write scopes, unclear ownership of approved apps, and employees routinely consenting to prompts without review.
Practitioner guidance
- Inventory every SaaS integration and OAuth grant Build a real-time list of user-installed apps, SaaS-to-SaaS connections, token scopes, and ownership so you can see which paths can move data outside the primary platform.
- Treat OAuth tokens as privileged credentials Apply expiry, rotation, least-privilege scoping, and revocation workflows to tokens the same way you would to other high-risk credentials.
- Require approval for high-risk app authorisation Place new or unusual integrations, especially those requesting data export or admin-like scopes, into a review step before consent is granted.
Bottom line: SaaS breaches are increasingly happening through trusted integrations and delegated access rather than direct platform compromise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:13 pm
SaaS integration trust is now an identity perimeter. The old model treats SaaS apps as adjacent systems and identity as something that happens before the app connection. These campaigns show that the connection itself is where control fails, because the token becomes the durable access path. Practitioners should stop treating third-party app governance as a procurement issue and start treating it as a core identity control surface.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams respond when a trusted SaaS integration is compromised?
A: Start by revoking the compromised token, then inventory every related credential, service principal, API key, and downstream system that the app could reach. After that, review scopes, reissue credentials from trusted environments, and monitor for unusual API activity. The goal is to close the trust chain, not just the first entry point.
👉 Read our full editorial: Salesforce trust and OAuth abuse expose the SaaS integration blast radius