The SaaS and The Furious

SaaS Breach Trends

Obsidian threat operations lead Ryan Wizoski reframes “The SaaS and the Furious” beyond business-email-compromise clichés. Publicly disclosed SaaS compromises follow a steep upward curve—about 220 cases in the current year at talk time—because SaaS concentrates data while security often lags migration.

Identity-First Adversary Model

Roughly 90% of cases he handles stem from identity compromise rather than exposed APIs. SaaS search, export, and download features become reconnaissance and exfiltration tools; his fastest case went from initial access to full data theft in nine minutes. Average Microsoft tenants show about 1,000 OAuth grants, ~90% unused in 90 days—massive forgotten integration risk.

Hands-On Cloud Intrusion Style

Attackers skip traditional network mapping; they log in and click application tiles. Free SaaS trials let operators train on authentic UIs without victim hardware. Wizoski organizes observed tactics by application type and urges visibility across every integration, user, and fourth/fifth-party dependency—not just primary productivity suites.