OAuth grants pile up faster than you can review them. Here's how to keep up.
OAuth grants accumulate faster than security teams can review, creating exploitable data access pathways.
OAuth grants are proliferating across organizations—averaging 88 per employee with 31 carrying data-level permissions—yet they operate outside standard identity controls and can persist long after employee credentials are disabled. Recent breaches like Vercel and Klue exploited forgotten OAuth grants, and Gartner predicts 50% of SaaS breaches will stem from overprivileged OAuth tokens by 2027. Manual review of individual grants takes ~45 minutes each, making it impossible for security teams to audit tens of thousands of grants without automation and agentic capabilities.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonOAuth grants accumulate silently across organizations—averaging 88 per employee—yet they exist largely outside standard identity governance processes, meaning they are rarely reviewed or revoked. When an employee leaves or a third-party app is no longer needed, the associated OAuth token often persists indefinitely, providing a persistent backdoor attackers can exploit. Breaches at Vercel and Klue demonstrate that these forgotten grants are not theoretical risks but active attack vectors. The sheer volume of grants makes manual auditing impractical, leaving organizations blind to overprivileged third-party access at scale. Without automation, security teams cannot maintain visibility or enforce least-privilege across the full OAuth surface area.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- SaaS security posture management (SSPM)
Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.