Notifications
Clear all
Topic starter
06/09/2026 5:18 pm
TL;DR: Shadow SaaS, misconfigured sharing, and over-permissioned SaaS-to-SaaS integrations create the main exposure paths in Valence Security’s 2025 overview, with the Salesforce/Drift token-harvesting incident illustrating how trusted connections can outlive initial access. The governance problem is not just discovery, but lifecycle control over app scopes, dormant identities, and external sharing boundaries.
NHIMG editorial — based on content published by Valence Security: Escape the SaaS House of Horrors
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
Questions worth separating out
Q: What breaks when SaaS integrations are not governed as non-human identities?
A: Teams lose visibility into who or what can reach connected systems, and attackers can use trusted credentials to move through those integrations without triggering normal human-account controls.
Q: Why do over-permissioned SaaS accounts increase exposure so quickly?
A: Because excessive roles and stale admin accounts turn a single compromise into broad access across files, integrations, and external sharing paths.
Q: How do security teams know if SaaS identity controls are actually working?
A: Look for evidence that lower-assurance identities are fully segregated from sensitive backend paths, not just authenticated differently.
Practitioner guidance
- Inventory every SaaS connection and shadow application Map unsanctioned apps, identify the users who connected them, and document the data each integration can reach.
- Recertify privileged SaaS roles and dormant accounts Run recurring access reviews for super-admins, app owners, and service accounts that support SaaS workflows.
- Govern integration tokens as NHI credentials Track scopes, expiry, ownership, and revocation for every SaaS-to-SaaS integration token.
What's in the full article
Valence Security's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step SaaS discovery workflow for finding unsanctioned apps and connected integrations
- Operational checklist for reviewing OAuth scopes, external sharing, and dormant administrative access
- Practical remediation sequence for fixing misconfigurations and offboarding unneeded accounts
- Quick survival checklist that maps discovery, governance, and remediation into a single workflow
👉 Read Valence Security's post on SaaS security risks and discovery controls →
SaaS-to-SaaS integrations and shadow apps: where exposure starts?
Explore further
06/09/2026 5:19 pm
Shadow SaaS is an identity governance failure before it is a discovery problem. If security teams cannot see which applications are connected, they cannot govern scopes, ownership, or offboarding. The real risk is not the app alone, but the fact that it can remain a trusted access path outside formal control. Practitioners should treat unsanctioned SaaS as unmanaged identity infrastructure, not just shadow IT.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
A question worth separating out:
Q: What is the difference between SaaS configuration and SaaS governance?
A: SaaS configuration is the on or off state of a feature. SaaS governance is the policy, ownership, monitoring, and cleanup process that determines whether the feature can be used safely. A disabled setting may reduce exposure, but only governance ensures identities, content, and exceptions are managed over time.
👉 Read our full editorial: SaaS discovery and integration governance now define exposure control
