SaaS integrations connect one Software-as-a-Service (SaaS) application to another, enabling data exchange, enhanced functionality, and streamlined workflows. These integrations are commonly established between core SaaS platforms—such as Microsoft 365, Google Workspace, or Salesforce—and third-party SaaS tools. While incredibly powerful, SaaS-to-SaaS integrations also introduce security risks due to their reliance on non-human identities, such as OAuth tokens, API keys, and service accounts which require careful oversight to ensure they don’t expose sensitive data. Additionally, as SaaS-to-SaaS integrations often are set up without IT approval, there are sometimes ‘Shadow SaaS’ risks due to lack of visibility.
Why Are SaaS Integrations Important?
SaaS integrations enhance productivity and efficiency by allowing disparate applications to work seamlessly together. For instance, a SaaS-to-SaaS integration might connect a project management tool to a communication platform, enabling automated task updates and notifications. These integrations reduce manual effort, improve data consistency, and allow organizations to maximize their SaaS investments.
Other examples of SaaS-to-SaaS integrations include:
- Integrating Salesforce with a marketing automation tool for lead tracking
- Connecting Google Workspace with third-party productivity apps for file sharing and calendar synchronization
- Using GenAI tools that integrate directly with SaaS environments to optimize workflows
While these integrations are powerful, they also introduce unique security risks.
Security Risks of SaaS-to-SaaS Integrations
Non-Human Identities and OAuth Tokens
SaaS-to-SaaS integrations rely on non-human identities such as service accounts, API keys, and OAuth tokens. These machine-based credentials act as authentication mechanisms for integrations to access applications and data. However, their inherent nature introduces SaaS security risks:
Vastness of Non-Human Identities
Non-human identities vastly outnumber human users in modern SaaS environments. For example, in Google Workspace, Valence research found that there are an average of 8.6 non-human identities for every human user. It’s important to note that these risks become amplified as SaaS ecosystems grow, with organizations averaging thousands of integrations—each one a potential weak link in the chain.
Lack of MFA
Unlike human identities, non-human credentials cannot leverage multi-factor authentication, making them attractive targets for attackers.
Stolen or Misused Tokens
A stolen OAuth token can grant full access to sensitive resources, as seen in notable breaches like Microsoft’s Midnight Blizzard and CircleCI.
Inactive and Overprivileged Integrations
Many organizations struggle to manage inactive or overly broad permissions for their SaaS-to-SaaS integrations:
Inactive Integrations
65% of an organization’s third-party SaaS integrations are dormant, with valid but unused OAuth tokens still active. These dormant connections are often overlooked by security teams, despite being a common vector for attacks.
Overprivileged Access
Integrations are often misconfigured or frequently receive excessive permissions, such as full access to email, files, and admin functionalities. Valence’s 2024 State of Saas Security Report found that 33% of integrations are granted sensitive privileges, creating a significant attack surface. This overprivileging can lead to massive data exposure if a connected application is breached.
Blind Spots in Monitoring
Unlike human accounts, SaaS-to-SaaS integrations are often not monitored for unusual behavior, making it difficult to detect when a compromised token or service account is being misused.
Real-World Exploitation Examples
SaaS-to-SaaS integrations and non-human identities have played critical roles in high-profile breaches:
Microsoft Midnight Blizzard Attack
Attackers exploited a legacy OAuth application to access sensitive data, then created malicious OAuth apps to maintain persistence.
CircleCI Breach
A stolen OAuth token was used to gain unauthorized access to customer GitHub repositories.
Cloudflare Attack
Following an Okta breach, attackers leveraged compromised service account credentials to access sensitive SaaS resources.
Best Practices for Securing SaaS Integrations
To mitigate the risks associated with SaaS integrations, organizations should adopt the following practices:
- Regularly audit NHIs like service accounts, API keys, and OAuth tokens to ensure they are actively used and securely configured.
- Limit integrations to the minimum necessary permissions to perform their intended functions.
- Periodically review and revoke inactive integrations to reduce the attack surface.
- When adding third-party SaaS tools, assess their security controls, as these will directly impact your environment’s safety.
Use tools like SaaS Security Posture Management (SSPM) to track integration usage and flag misconfigurations.
What are best practices for integrating SaaS applications?
Best practices for SaaS integration include enforcing the Principle of Least Privilege, regularly auditing non-human identities and OAuth tokens, managing the lifecycle of integrations by periodically reviewing and revoking inactive ones, and using tools like SaaS Security Posture Management (SSPM) for continuous monitoring and risk remediation.
What are some future trends in SaaS integration?
Future trends in SaaS integration include a shift toward more automation, with organizations adopting AI and machine learning to manage and secure integrations. We’ll also see increased focus on zero-trust security models, tighter controls on non-human identities, and deeper integrations with GenAI tools to streamline workflows and improve risk management.
How Valence Helps Manage SaaS-to-SaaS Integration Risks
Valence Security provides comprehensive tools to help organizations monitor, manage, and remediate risks associated with SaaS-to-SaaS integrations:
- Continuous Visibility into Integrations: Valence automatically discovers all SaaS-to-SaaS integrations in an organization’s environment, providing detailed insight into permissions, activity, and associated risks.
- Governance of Non-Human Identities: By identifying and analyzing non-human identities such as OAuth tokens, Valence ensures that these credentials are appropriately scoped and not overprivileged.
- Automated Remediation: Valence simplifies the removal of risky or inactive integrations. For example, in a recent case study with Lionbridge, Valence enabled automated revocation of over 95% of unnecessary tokens across applications like Microsoft 365, significantly reducing the organization's attack surface.
- Lifecycle Management: Valence enforces policies to automatically deactivate dormant integrations and mitigate configuration drift, ensuring security remains aligned with business needs.
- Risk Prioritization: Valence flags the most critical risks, such as overprivileged integrations accessing sensitive data, and provides actionable recommendations for remediation.
By addressing these challenges holistically, Valence empowers organizations to secure their SaaS environments without disrupting business workflows.
Final Thoughts
With the average organization managing thousands of third-party SaaS integrations, understanding the security implications is no longer optional. SaaS-to-SaaS integrations bring immense value but also demand rigorous oversight. By learning from high-profile breaches and implementing proactive security measures, organizations can protect their SaaS environments without sacrificing efficiency.
SaaS integrations unlock immense value by enabling automation and cross-platform functionality, but they also demand careful oversight to manage their associated risks. SaaS-to-SaaS integrations, in particular, introduce challenges around non-human identities, permissions, and visibility that traditional security measures cannot address effectively. By adopting best practices and leveraging tools like Valence Security, organizations can mitigate risks while maintaining the benefits of their SaaS ecosystems.
