SaaS API integration security has become the most systematically neglected attack surface in the small and mid-sized business technology stack. Security conversations still center on phishing emails and ransomware – but threat actors spent the last two years quietly exploiting a different entry point: the forgotten API connections between line-of-business applications that were configured once, granted broad permissions, and never reviewed again. CISA advisories from 2024 and 2025 make clear that most organizations have zero ongoing oversight of these connections. This post unpacks what those advisories reveal, maps the breach patterns to real-world small business infrastructure, and gives you the exact questions to bring to your IT firm.
- The Integration Layer Defined
- What CISA Is Saying in 2024 – 2025
- How Attackers Exploit Forgotten APIs
- Real Breach Patterns Matching This Profile
- Why Alerts Never Fire
- Who Is Most Exposed
- Building a Defense Posture That Addresses the Integration Layer
- Questions to Ask Your IT Firm
The Integration Layer Defined
Modern small business software stacks are not monolithic. A 15-person professional services firm might run a cloud-based accounting platform, a CRM, a project management tool, a document signing service, a payroll processor, an email marketing platform, and a cloud file storage environment – all at once. These applications are rarely islands. They communicate through application programming interfaces, most commonly via a protocol called OAuth, which lets one application act on behalf of a user inside another application without sharing that user’s password.
This connectivity is the integration layer. It is enormously useful. It is also, in most small business environments, completely unmonitored after the day it was configured. The person who clicked “Allow Access” to connect the CRM to the email platform three years ago may no longer work at the company. The permissions granted during that setup often far exceed what the integration actually needs. And the activity flowing through that connection is logged – if at all – inside a vendor dashboard that no one checks.
That is the gap. And that gap is now being systematically targeted. Meaningful SaaS API integration security governance starts with understanding what lives in this integration layer – and who, if anyone, is watching it.
What CISA Is Saying in 2024 – 2025 About SaaS API Integration Security
The Cybersecurity and Infrastructure Security Agency has grown increasingly specific about third-party integration risks in recent guidance. The CISA Secure by Design initiative, expanded significantly in 2024, places heavy emphasis on what the agency calls “third-party dependency risks” – specifically the danger of OAuth token sprawl and overprivileged application-to-application connections.
CISA’s 2024 cloud security advisory – published alongside Five Eyes alliance partners – called out a specific failure mode: “persistent OAuth tokens with excessive scopes granted to third-party applications that are no longer actively managed.” The advisory is precise: these connections do not expire automatically, do not require re-authentication when a user account is deprovisioned, and can survive password resets. An attacker who obtains a valid OAuth token for a connected integration does not need credentials. They already have authorized access. For a complementary framework for assessing these risks, the NIST Cybersecurity Framework provides a widely adopted structure organizations can apply immediately.
CISA’s March 2025 guidance on identity and access risks in cloud environments went further, explicitly naming SaaS-to-SaaS API connections as a priority attack surface. It documented adversary techniques that include enumerating connected applications through a compromised account, identifying the integration with the broadest permissions, and pivoting through that integration rather than continuing to operate through the initially compromised account – precisely because the pivot creates less noise.
How Attackers Exploit Forgotten APIs
The attack chain is worth walking through step by step, because understanding it changes what “securing your accounts” actually means in the context of SaaS API integration security.
Initial access is usually conventional – a phishing email, a credential stuffing attack using passwords from a previous breach, or a vulnerability in a public-facing application. The attacker gains access to a single account. In most small business environments, that account is a cloud email account.
From inside that email account, the attacker does not immediately start pulling mail. They enumerate. Modern cloud platforms expose a list of all connected third-party applications and their granted permissions directly inside the account settings panel. The attacker reviews that list, identifies which connected applications hold the broadest access – often “read and write access to all files” or “send email on behalf of user” – and maps the integration topology of the organization.
The next move is to authenticate to a downstream application using the OAuth tokens that already exist. If the email account is connected to a cloud file storage platform, the attacker can access all files without ever logging into that platform directly. If the file storage platform is connected to a contract management system, that too is reachable. Each hop uses a legitimate, pre-authorized connection. No new authentication event occurs. No password is entered.
Data exfiltration then happens through the integration channel itself – passing files or records through the API connection back to infrastructure the attacker controls. Because the data movement looks like normal application-to-application traffic, it does not trigger user-facing alerts in most standard configurations.
Real Breach Patterns Matching This Profile
Public breach disclosures from 2023 and 2024 surfaced several incidents that match this pattern closely, even when victim organizations described the breach in more general terms.
The Sisense breach disclosed in April 2024 – which prompted a specific CISA alert – involved attackers accessing the company’s data pipeline infrastructure and harvesting credentials and tokens that Sisense customers had provided to enable data integrations. The mechanism was the integration layer, not a direct attack on the customers themselves. Downstream customers had no indication anything had happened until CISA issued the alert.
The Midnight Blizzard (also known as Cozy Bear) Microsoft breach, disclosed in early 2024 and detailed in subsequent Microsoft transparency reports, showed a similar pivot pattern: initial access through a low-privilege test account, followed by enumeration of connected applications, followed by lateral movement into high-value email accounts belonging to senior leadership and security teams. The attacker moved through OAuth application permissions rather than through additional credential attacks.
The Snowflake customer breach wave of 2024 – which affected organizations including Ticketmaster and Advance Auto Parts – involved attackers using credentials harvested from information-stealing malware to authenticate to cloud data platforms. Once inside, they moved through the data connections those platforms maintained with other business systems. The initial credential was often the only one needed to reach data across multiple connected environments.
None of these are small business incidents in the headline sense. But the attack technique – enter through one connected application, move laterally through the integration fabric, exfiltrate without triggering a single user-facing alert – is fully replicable against a 20-person company running the same category of cloud applications. The attacker’s toolkit does not change based on company size. The defense posture, unfortunately, often does. This is precisely why SaaS API integration security cannot be treated as an enterprise-only concern.
Why Alerts Never Fire
This is the part most business leaders find genuinely surprising. The absence of alerts is not a malfunction. It is the expected behavior of systems that were never configured to treat integration-layer activity as suspicious.
Cloud email platforms, by default, log authentication events for user logins. They do not, by default, generate alerts when an OAuth-connected application accesses mailbox content. That behavior is authorized. Generating an alert would require a deliberate configuration choice to monitor that activity, establish a baseline, and flag deviations – a choice most small businesses have never made because no one told them to make it.
File storage platforms log file access. They do not, by default, alert when a connected third-party application downloads a large volume of files, because that is also authorized behavior from the platform’s perspective. The CRM integration was told it could read files. It is reading files. The fact that it is reading six thousand files in forty minutes is not, by default, an alert condition.
This is the core problem CISA describes when it refers to “monitoring gaps at the integration boundary.” The boundary between one application and another is, in most environments, a visibility blind spot. Attackers know this. The advisories are explicit about it. Closing this gap is a foundational requirement of any serious SaaS API integration security program.
Who Is Most Exposed
Exposure to this attack pattern correlates with a specific combination of factors – not company size or industry alone.
- Organizations that have added cloud applications incrementally over several years without a formal process for reviewing or revoking API connections
- Organizations where the person who originally configured an integration no longer works there, and the connected application still has access to that departed employee’s account data
- Organizations using automation platforms such as Zapier or Make to connect multiple business applications, where the automation was built by a non-IT employee and has never been reviewed for permission scope
- Organizations where single sign-on has been partially but not fully implemented, creating a mix of directly authenticated accounts and OAuth-connected accounts with inconsistent oversight
- Organizations in regulated industries – healthcare, financial services, legal, pharmaceutical consulting – where the data accessible through a compromised integration chain carries significant legal exposure
The pharmaceutical consulting and professional services sectors deserve specific mention. These organizations frequently handle client data under confidentiality agreements and face security questionnaires from their own enterprise clients. A breach originating in the integration layer is no less serious because it was technically caused by a forgotten OAuth token rather than a stolen password. The client whose data was exposed does not draw that distinction.
Building a Defense Posture That Addresses the Integration Layer
Addressing SaaS API integration security requires a systematic, ongoing review process – not a one-time fix. The integration layer changes every time a new tool is adopted, a new automation is created, or a new employee configures a connection. Your defense posture has to match that pace.
The essential components are:
- A complete inventory of every OAuth connection and API token authorized within your cloud environment, reviewed at least quarterly and immediately following any employee departure
- Least-privilege principles applied to every integration – each connected application should have access only to the specific data it needs, not the broadest scope the platform offers by default during initial authorization
- Monitoring configured at the integration boundary, not just at the user login event – specifically, alerts for anomalous API call volume, unusual data transfer patterns, and access originating from connected applications outside expected business hours or geographic regions
- Token expiration policies that force periodic re-authorization of third-party connections, preventing indefinitely persistent access through abandoned integrations
- Identity provider integration where feasible, so that when a user account is deprovisioned, connected third-party application access is revoked automatically rather than remaining active indefinitely
- Regular review of automation platform connections – tools like Zapier or Make often accumulate credentials and API keys far broader than the original automation required
This is where the difference between a managed IT environment and an unmanaged one becomes concrete. An organization with active oversight has someone who knows the integration map, reviews it on a schedule, and receives alerts when something in that map behaves abnormally. An organization without that oversight has a map no one has looked at in two years – and that is exactly the environment this attack pattern targets.
To learn more about how a managed approach closes these SaaS API integration security gaps, see our cybersecurity services overview or explore our managed IT services to understand how continuous oversight fits into a broader security program.
Questions to Ask Your IT Firm
If you are evaluating your current exposure – or your IT firm’s awareness of this attack surface – the following questions are diagnostic. A firm with genuine visibility into your environment should answer most of them without hesitation.
- Can you produce a current list of every third-party application authorized to access our cloud email environment, including the permissions each application holds?
- When an employee leaves, what is the process for revoking their connected third-party application access – and how quickly does it happen?
- Are we configured to alert on anomalous API activity, or only on anomalous user logins?
- Have you reviewed the OAuth token scope of the automation tools we use – specifically any connections built by non-IT staff?
- What is the oldest third-party integration currently authorized in our environment, and is the application it connects to still in active use?
- If an attacker compromised our cloud email account today, which other applications could they reach through existing authorized connections – and what data lives in those applications?
That last question is the most revealing. If your IT firm cannot answer it, or if the answer surprises you, you have a visibility gap at the integration layer. Visibility gaps at the integration layer are precisely what the 2024 and 2025 CISA advisories are warning organizations to close.
The attack surface has shifted. The defenses have to shift with it. Organizations that continue to treat SaaS API integration security as a configuration-day concern – rather than an ongoing monitoring responsibility – are accepting a risk that threat actors are actively exploiting: quietly, without triggering a single user-facing alert, often for weeks before anyone notices anything is wrong.
If that description fits your current environment, Book a Free Cybersecurity Strategy Call. We will show you exactly where your integration layer stands – and what it would take to close the gaps.
Let’s Talk About Your IT Strategy
If anything in this post raised a question about your own environment, the fastest path to an answer is a 20-minute strategy call. We’ll look at your specific situation and tell you what we’d actually do about it.