What the Klue breach reveals about SaaS trust

This report examines incidents where attackers leveraged trusted SaaS integrations (not platform vulnerabilities) to access customer Salesforce data via OAuth/delegated trust. It argues that the core risk is standing, unreviewed trust — integrations and tokens that persist long after their justification — and recommends continuous validation, least-privilege controls, periodic reviews of OAuth grants, and technologies such as Zero Trust Cloud Access and ringfencing to reduce the blast radius of compromised integrations.