Introducing New Software as a Service (SaaS) Security Assessments

SaaS threat update: UNC6040 (ShinyHunters/Scattered Spider) runs credential attacks and OAuth phishing; suspected nation-state UNC6395 spread beyond Salesloft to 700+ customers.

AppOmni CTO Brian Soby on two active SaaS threats: UNC6040 ransoms stolen Salesforce data; UNC6395 breached Salesloft Drift and hit 700+ customers, harvesting secrets for Workspace, M365, and AWS.

The AppExchange origin story: Salesforce's 2007 trust bet, the first Chief Trust Officer, reviews evolving into automated security tooling, and economics that let thousands of developers sell in.

Wiz for Microsoft 365 is GA: M365 posture, data, and access risks join the Security Graph, linking SharePoint/OneDrive exposure, Entra identity risk, and Copilot Studio agents to cloud attack paths.

Follow-up nOAuth research: two of 38 newly tested SaaS apps were still vulnerable, one with permissions enabling a pivot back into Microsoft 365 — and why Semperis rates the risk severe.

ForceHound is an open-source Python collector that renders Salesforce profiles, permission sets, and sharing rules as a BloodHound CE identity graph, bringing AD-style attack path analysis to CRM.