August 2025. Attackers compromise OAuth tokens inside Salesloft's Drift platform. Those tokens carry permissions to customer Salesforce instances - permissions granted once, never audited, never revoked. The attacker group, tracked as UNC6395, moves through integration after integration using nothing more than trusted credentials against trusted connections. Within weeks, over 700 organizations were breached. The victim list includes Google, Cloudflare, Palo Alto Networks, Zscaler, and CyberArk - some of the most security-sophisticated enterprises on earth. More than 1.5 billion records are exfiltrated.
November 2025. The same playbook, run by the same actors - ShinyHunters - hits Gainsight. Two hundred more Salesforce instances were compromised. Same trusted OAuth tokens. Same ungoverned integrations. Same result.
What connects these incidents is not a sophisticated zero-day exploit or an advanced persistent threat toolkit. It is something more fundamental and more troubling: fragmentation. A SaaS ecosystem where individual applications carry permissions they were never audited against. A security architecture where the tool protecting the network edge is not the same tool watching what happens inside the SaaS environment. Separate stacks. Separate policies. Separate data. Gaps at every seam.
