Your supplier's back door: why third-party breaches quadrupled

The most effective way into a company in 2026 is not through its firewall. It is through something that company already trusts.

IBM's X-Force Threat Intelligence Index 2026 found major supply chain and third-party breaches quadrupled over five years, as attackers shifted from breaking through defences to targeting vendors, dependencies, identity integrations and CI/CD pipelines. As X-Force's Nick Bradley put it, they can "walk right in through your supplier's back door with valid credentials." ibmibm

The Salesloft and Drift case

Attackers used compromised Drift OAuth tokens to reach Salesforce environments — two SaaS products no security team had listed as critical infrastructure. Nothing was exploited in the traditional sense. A token issued for a legitimate integration was reused by someone else, and in the logs it looked authorised, because it was. ibm

Why it works

Trust is transitive; security is not. You audit your vendor — your vendor does not audit theirs. And the flaws involved are rarely exotic: of nearly 40,000 vulnerabilities X-Force tracked in 2025, 56% needed no authentication at all, while exploitation of public-facing applications rose 44% year over year. ibm

AI tooling widened the surface further. X-Force found over 300,000 ChatGPT credentials for sale on dark web markets in 2025. Every agent wired into a workflow is another credential store with internal access. ibm

What a small team can actually do

• Inventory every integration holding a token — including the marketing tools nobody counts as infrastructure

• Scope and expire those tokens; a permanent broad OAuth grant is a standing invitation

• Log third-party API activity separately, so odd access from a trusted integration stands out

• Patch unauthenticated flaws and harden identity in parallel, not in sequence

The takeaway is not to trust fewer vendors. It is that trust should never be permanent, unlimited, or unlogged.