The Vendor Risks You Can't See: Connected Apps, Fourth Parties and AI
One set of stolen Salesloft Drift tokens put more than 700 organizations' Salesforce data at risk in ten days. How to find the connected apps, your vendors' own vendors, and the vendor AI that sit outside your view.
Why now
700+ organizations potentially affected
Between August 8 and 18, 2025, attackers used Drift's OAuth tokens to pull Salesforce data. Cloudflare, Zscaler, Palo Alto Networks and Proofpoint were among those confirmed.
One breach led to the next
In November 2025 attackers reached more than 200 Salesforce instances through Gainsight, and said they got in with secrets stolen in the Drift breach. In June 2026 tokens tied to 195 organizations were taken through Klue.
A third party in 30% of breaches
Verizon's 2025 breach report found third-party involvement doubled in a year, from 15% to 30%.
72% only partly know which vendors use AI
In a 2026 survey of 173 financial services risk professionals, most could not say for certain which of their vendors run AI on their data.
What you will learn
Agenda
Who should attend
Third-party risk and vendor management teams, SaaS and identity security engineers, procurement, and contracts counsel.
Speakers
Speakers will be announced. The panel will include:
Virtual expo hall
When the session ends, the expo hall opens for an hour. Step into a sponsor's booth in a new tab to watch their short session and pick up their resources, then come back to the main stage whenever you like.