For ten days in August 2025, attackers ran bulk export queries against the Salesforce instances of more than 700 organizations — Cloudflare, Zscaler, Palo Alto Networks, Google among them. No malware fired, no user was phished, no login looked suspicious. Every query arrived through the Drift chatbot integration those companies had deliberately, legitimately connected — using OAuth tokens stolen from Drift’s infrastructure months after the attackers had first slipped into Salesloft’s GitHub. The tokens didn’t care about MFA. The traffic didn’t trip alarms, because it was indistinguishable from the chatbot doing its job. The attackers’ actual target, buried in those support cases: AWS keys, Snowflake tokens, and passwords that customers had helpfully pasted into tickets.
Twelve parts into this series, every control we’ve built has been inside your perimeter. This part is about the uncomfortable remainder: your security posture is now the union of yours and every vendor you’ve ever clicked “Authorize” for — and you can’t patch them. Verizon’s 2025 DBIR put third parties in 30% of breaches, double the prior year. The Salesloft-Drift chain is the anatomy lesson of why.
The chain is the lesson
Every hop in that breach was a trusted relationship, which is precisely why it worked:
Note the failures, because they’re all mundane. Tokens with sweeping scopes lived for months unrotated. Bulk SOQL exports against hundreds of tenants looked like normal integration behavior because nobody was watching integration behavior. And at most victim companies, nobody owned the Drift connection end-to-end — it was connected by someone in sales ops, approved once, and forgotten. Salesforce eventually revoked every token and delisted the app; the victims got to discover their exposure in a notification email. The sequel arrived in November with Gainsight’s Salesforce-integrated apps, same pattern. This is not an incident type. It’s the new default attack shape: Unit 42’s 2026 report says supply-chain risk has expanded from vulnerable code to the misuse of trusted connectivity — and that identity, once again, is the mechanism.
The inventory nobody can produce
Ask a room of SaaS operators “what third-party services currently have access to your environment?” and watch the confident faces fall. Procurement knows what you pay for. Nobody tracks what employees connected: the calendar plugin with Gmail read access, the AI notetaker in the Zoom, the analytics snippet a marketer authed into the data warehouse. The Drift integration lived in this shadow tier at most of its 700 victims.
The fix starts with an inventory built from the access side, not the expense side: enumerate OAuth grants in Google Workspace and Microsoft 365, connected apps in Salesforce and Slack, API tokens in your own admin panel. Then tier by reach, never by spend — a $200/month widget holding a Salesforce-wide token outranks your six-figure storage vendor. Tier 1 (processors holding customer data) gets the full treatment: SOC 2 review, contract SLAs, continuous monitoring. Tier 2 (integrations with scoped access) gets least-privilege scopes and behavior alerts. Tier 3 gets a browser policy and a shrug. And the shadow tier gets discovered, quarterly, because it regenerates.
Integrations are identities — govern them like it
Part 2 gave every human a lifecycle: joiner, mover, leaver. The Drift breach is what happens when the non-human identities get none. OAuth tokens are credentials that bypass MFA, often outlive the employee who created them, and accumulate scopes nobody re-examines. OWASP’s Non-Human Identity Top 10 reads like the incident’s postmortem: long-lived tokens, over-privileged grants, vulnerable third-party NHIs. The governance that would have blunted it is the same lifecycle, applied to machines:
- Scoped at grant time — the chatbot that reads chats doesn’t need
fullon your CRM. Most vendors request broad scopes because it’s easier; pushing back is a negotiation you’re allowed to have. - Owned — every integration has a named human owner who gets the vendor’s security emails and feels the pager.
- Monitored for behavior — bulk exports from an integration that normally reads single records is the Drift tell. Your audit pipeline from Part 3 already produces these events; the alert rule is the missing piece.
- Rotated and expired — tokens that can’t rotate get scheduled reviews; tokens unused for 90 days get revoked. Ghost integrations are free attack surface.
The contract layer that actually matters
Paper doesn’t stop breaches, but it decides what happens after — and regulators have started grading the paper. DORA, applicable since January 2025, requires financial entities to keep a register of information on every ICT arrangement, assess concentration risk, and hold pre-written exit strategies. GDPR’s Article 28 makes your subprocessor list a legal artifact. Your enterprise customers’ questionnaires (Part 2) ask for both. The clauses that earn their keep:
- Breach notification SLA in hours, not “without undue delay” — your Part 6 disclosure clocks (72 hours, 24 hours) are running while the vendor deliberates; the contract decides whether you learn about their incident from them or from the news.
- Audit and evidence rights — the annual SOC 2 (read it the Part 5 way: opinion, deviations, CUECs), plus the right to ask questions when the report is late.
- Security minimums with teeth — termination rights if controls lapse. DORA makes this mandatory for its sector; it’s good hygiene everywhere.
- Subprocessor flow-down — their vendors become your fourth parties; you want notification when the chain changes, because TikTok-grade transfer problems (Part 10) hide exactly there.
One honest caveat: attestation is not observation. The most useful signal in modern vendor review is the divergence — a vendor whose questionnaire glows while their external posture (exposed services, leaked credentials, patching cadence) says otherwise. Trust, then verify from the outside.
Offboarding is where the risk retires
Vendor relationships end; vendor access rarely does. The offboarding checklist is short and non-negotiable: revoke every token and OAuth grant, rotate anything they ever held, confirm deletion of your data (Part 8’s crypto shredding, if you planned ahead, makes this a verifiable event rather than a pinky promise), and note the date. “We stopped paying” is not an offboarding — the tokens didn’t get the memo.
And keep one inventory, not three: DORA’s register, GDPR’s Article 28 list, and your public subprocessor page should be the same document rendered three ways. The companies that got Drift right were the ones who could answer, in minutes: are we connected, with what scopes, and what do we revoke first?
Where the series goes next
One door left, and it’s the frame around all the others: the capstone — twelve parts distilled into a maturity map, the cadence that keeps controls alive after the blog posts end, and the annual self-audit that turns the whole series into a checklist. That’s next, and it’s the last one — the series was always meant to be open-ended, but every good door deserves a frame.
Practice
- Build the access-side inventory today: export every OAuth grant, connected app, and API token across your core systems. Tier each by reach. Revoke anything nobody recognizes — the ghost tier regenerates, so calendar the next sweep.
- Take your top three vendors by data access and check the contract: notification SLA in hours, audit rights, termination-for-control-lapse, subprocessor flow-down. Missing clauses are next renewal’s agenda, in writing.
- Tabletop the Drift scenario: “our chat vendor just announced their OAuth tokens were stolen last quarter.” Who revokes what, in which order? What do you tell customers, on which clock? If the answer involves finding the person who set up the integration, you’ve found the ownership gap.