Authorization Sprawl

The recent Salesloft compromise is a clear example of how attackers exploit gaps in visibility—not just vulnerabilities. By stealing access tokens from a third-party chatbot integration, threat actors quietly accessed Salesforce environments and exfiltrated sensitive data, including cloud credentials. The breach went undetected for days, primarily as a result of a lack of cloud-level logging and monitoring.

This kind of attack—where legitimate tokens are abused—highlights an emerging issue some researchers have dubbed “authorization sprawl”. As organizations connect more SaaS platforms and integrations, it becomes harder to track who has access to what, and when. A stolen M365 SSO token can be used to access a developer’s mailbox, from which a Github personal access token could be found, which may lead to full code base enumeration and malicious script injection, and on and on.  Without detailed logs and centralized visibility, detecting misuse becomes nearly impossible.

Cloud service providers vary widely in the quality of logs they offer. Some provide robust and actionable data; some offer little more than basic access records; others offer nothing at all. Logs are the foundation for detecting unusual behavior, investigating incidents, and responding quickly. Inadequate logging and insufficient log monitoring will likely lead to abuse of cloud tokens which—due to ever metastasizing authorization sprawl—could lead to nearly undetectable malicious activity across the IT environment.

Managed Detection and Response (MDR) can help here—but only if the right data is available. MDR platforms rely on logs to detect threats in real time. Without them, even the best detection tools are flying blind.

The takeaway? Organizations need to push for better logging from their cloud vendors, audit third-party integrations regularly, and ensure they have the visibility to detect and respond to abuse—before it turns into a breach.