SaaS Breaches Start with Tokens - What Security Teams Must Watch

Token theft is identified as a leading cause of SaaS breaches, with attackers abusing OAuth access tokens, API keys and session tokens to access systems without triggering MFA. The piece notes that just one stolen token can bypass security measures and that attackers increasingly rely on token theft rather than exploiting direct vulnerabilities.

It cites real-world breaches including Slack in January 2023, CircleCI in January 2023, Cloudflare/Okta in November 2023, and the Drift/Salesloft incident in August 2025, where stolen tokens enabled access to code repositories, CI platforms and customer data across SaaS integrations. A common thread is SaaS sprawl—many organisations run hundreds of cloud apps and unauthorised or poorly secured third‑party connections create blind spots for token visibility and control.

The article advocates token hygiene practices such as maintaining an OAuth app inventory, enforcing app approval, rotating tokens regularly and monitoring token activity to reduce the risk of token compromise. It also highlights the need to revoke unused tokens, integrate token management into offboarding and use dynamic SaaS security platforms to gain visibility and governance over app-to-app connections.