Software as a service (SaaS) platforms and third-party applications form the backbone of productivity in any organisation. From finance and HR to marketing and operations, organisations rely on a network of tools that work well together. However, as convenience increases, so does complexity. Within that complexity lies a growing threat. Attackers are more frequently bypassing organisations directly and finding ways in through trusted applications.
The modern supply chain is digital, decentralised and often invisible.
The new attack surface no one fully sees
Cyber security strategies typically focus on protecting internal systems such as firewalls, endpoints and networks. Today, however, the perimeter has vanished. Employees log in from anywhere, applications exist in the cloud and data continuously flows between systems through application programming interfaces (APIs) and integrations.
Each integration, whether it’s linking a customer relationship management (CRM) system to a marketing platform or connecting finance tools to payroll software, brings a new access point. These connections usually rely on OAuth tokens or API keys that provide ongoing access without requiring repeated logins. While this helps create seamless workflows, it also opens the door for attackers.
Imagine an employee authorising what seems like a harmless third-party app to access their e-mail or cloud storage. If that app gets hacked, the attacker doesn’t need to breach the organisation directly; they gain access through the trusted integration. Often, this access is broad and long-lasting, making it hard to detect.
Trust: The most exploitable vulnerability
One of the biggest risks of SaaS-based supply chain attacks is that they exploit trust rather than technical weaknesses. Organisations usually believe that if an app is popular or officially approved, it is secure. But attackers know how to use that trust just as they would a vulnerability.
There have been cases where hacked vendor accounts sent seemingly legitimate communications within organisations, leading to further breaches. In other situations, attackers can inject harmful code into widely used software updates, thereby impacting thousands of users down the line.
The challenge lies not only in figuring out which applications are connected but also in understanding the level of access they have and whether that access is still necessary.
The problem with 'set and forget' access
Many SaaS integrations are set up once and then mostly ignored. Over time, employees change roles, projects shift and some applications become obsolete, yet the permissions granted to those integrations often stay the same.
This "set and forget" approach creates a growing number of unused or excessive access rights. An application that was once essential might now be outdated but still has access to sensitive data or can change system settings.
Attackers actively seek these neglected entry points. A forgotten integration with high-level permissions is much easier to exploit than a well-protected core system.
Why visibility is the first line of defence
You can’t secure what you can’t see. One of the biggest hurdles organisations faces is gaining a clear view of their SaaS landscape. Shadow IT, which refers to apps that are adopted without formal approval, make this situation even more complicated.
A thorough audit of all connected applications is an important first step. This includes identifying:
- Which apps have access to core systems.
- What level of permissions they have.
- Who approved them and when.
- Whether they are still in use.
Without this visibility, security teams operate in the dark.
From broad access to precision control
After establishing visibility, the next step is applying the principle of least privilege. This means ensuring that every application and user has only the bare minimum access needed to do their job – nothing more.
For instance, a reporting tool doesn’t need full control over a database. A scheduling application shouldn’t have open access to the entire e-mail system. By tightening these permissions, organisations can greatly lessen the potential impact of a compromised integration.
Importantly, this isn’t a one-time task. Access controls should be reviewed regularly to keep up with changes in roles, tools and business needs.
Monitoring the invisible movements
Even with robust access controls, ongoing monitoring is essential. SaaS environments generate huge amounts of activity: logins, data transfers and permission changes; and within this activity are the subtle signs of a potential breach.
Unusual login patterns, unexpected data access or changes in integration behaviour can all suggest something is amiss. The key is to catch these anomalies early, before they escalate into a major incident.
For instance, if a third-party app suddenly starts accessing large amounts of data outside its usual patterns, that should trigger an immediate investigation. These signals often point to larger issues.
Rethinking security for a connected world
The rise of SaaS and third-party integrations has changed cyber security significantly. It’s no longer enough to protect the organisation’s core systems; security must extend throughout the entire digital ecosystem.
This requires a shift in thinking, from reactive defence to proactive risk management. IT consultants and security teams need to work together to continually assess third-party access, enforce strict controls and monitor activity across all connected platforms.
Ultimately, the goal is not to eliminate integrations, as they are vital to modern business. Instead, organisations must ensure they are not the weakest link in the chain.
Closing the backdoor before it’s too late
As organisations move further into digital transformation, the number of SaaS applications and integrations will keep increasing. Each new connection brings both opportunity and risk.
The question is no longer if attackers will target these entry points, but when.
By treating third-party access as a crucial part of cyber security strategy rather than an afterthought, organisations can close the backdoors that attackers are increasingly exploiting. In doing so, they not only protect their data but also strengthen the trust that underpins their digital ecosystems.
Share
Editorial contacts