Most online business owners still picture a hacker guessing a password. The 2025 data says the bigger risk is an app you connected once and forgot, and a token that never expired. Here are the numbers.
Intro
Overview. Across 2025, the way attackers get into businesses quietly shifted: less password-guessing, more riding the trusted connections you already authorized, the OAuth grants behind every “Connect with Google,” AI tool, and SaaS integration.
Details. The figures below are drawn from the 2025 Verizon Data Breach Investigations Report, IBM’s 2025 Cost of a Data Breach Report, DoControl’s 2026 non-human-identity analysis, and incident data from Palo Alto Unit 42, Obsidian Security, and the Cloud Security Alliance.
Transition. Here is what the numbers say about the doors you have already left open.
The 10 stats that matter most
- 30% of breaches in 2025 involved a third party, double the 15% of a year earlier.
- Stolen credentials were still the single most common way in, used in 22% of breaches.
- 700+ organizations were breached in the Salesloft-Drift attack through stolen OAuth tokens from one connected app.
- The blast radius of that single compromised integration was about 10× larger than comparable direct attacks.
- Attackers had roughly 10 days of active data exfiltration before the activity was detected.
- SaaS and connected apps featured in 23% of 2025 incident-response cases.
- 94 days was the median time it took organizations to remediate leaked secrets found in a public GitHub repo.
- $670,000 is what unmanaged shadow AI added to the average breach, with 97% of AI-related breaches lacking proper access controls.
- Only 15% of organizations feel highly confident they could prevent an attack through these machine identities, while 69% are actively worried about them.
- 40% of edit actions inside Google Drive are actually performed by non-human identities acting on a user’s behalf.
The findings
Breaches through trusted third parties doubled in a single year
The headline shift in the 2025 Verizon DBIR is not a new exotic threat. It is that 30% of breaches now involve a third party, up from 15% the year before. For a solo operator that third party usually is not a vendor with a contract. It is the app you clicked Allow on. When that app’s maker gets compromised, the attacker inherits whatever you granted.
Attackers still prefer the front door: stolen credentials
Even with all the new tactics, 22% of breaches still start with stolen credentials, the most common initial access vector for the second year running. The lesson is not “pick a better password.” It is that the credential and the connected app feed the same attack chain, and an over-permissioned app can hand over access a password never would.
One forgotten app breached 700+ organizations at once
The Salesloft-Drift attack is the clearest illustration. Attackers did not crack passwords or beat MFA. They stole OAuth tokens tied to a single connected app and used them to reach 700+ downstream organizations, a blast radius roughly 10× bigger than a direct attack, with about 10 days of data theft before anyone noticed. Nothing was hacked in the movie sense. An authorization simply worked exactly as granted.
Connected apps now show up in a quarter of real intrusions
This is not theoretical. SaaS and connected apps were relevant in about 23% of incident-response cases. The pattern repeats: an integration with broad scopes, no clear owner, and no review schedule becomes the quiet way in.
The keys you paste into AI tools do not get cleaned up
Verizon found the median organization took 94 days to fix a secret, an API key or token, once it leaked into a public code repository. Three months of a live key sitting in the open. For anyone building with AI coding tools or wiring up automations, this is the everyday version of the connected-app problem: credentials created fast, forgotten faster.
Shadow AI is the newest unmanaged connection
IBM put a price on it: unmanaged AI tools added about $670,000 to the average breach, and 97% of AI-related breaches lacked basic access controls. Every new AI tool you authorize is another non-human identity with permissions, and most are owned by nobody and reviewed by no one.
Almost nobody is confident they could stop this
When asked directly, only 15% of organizations felt highly confident they could prevent an attack that runs through these machine identities, while 69% said they are worried about exactly that. The gap between concern and capability is the opening.
Most of the apps connected to your account are probably ones you no longer use
This is where it gets personal. Ben’s own connected-app review turned up roughly 170 connected apps, including some with no clear naming and at least 15 with what looked like critical access levels. That is not unusual anymore. It is exactly why connected-app sprawl is becoming such a practical risk for small operators.
Each unused grant is a door left open for no benefit. If you want to see your own number, open google.com/permissions and count.
Increasingly, it is not even a person doing the work
The forward-looking stat is this: DoControl’s 2026 analysis found about 40% of edit actions inside Google Drive are actually carried out by non-human identities, automations and AI agents acting on a user’s behalf, often under the user’s own permissions. As agents multiply, the number of things holding keys to your data is growing far faster than the number of people you would think to audit.
What to do about it
You can close most of this in an afternoon, and it starts with one tab. Open google.com/permissions, and for every connected app ask three questions: do I still use it, does it need the access it has, and would I notice if it went rogue? Anything unused or over-scoped gets revoked. Then do the same for your autoresponder, payment processor, hosting, and any AI tool you authorized during a free trial.
That five-minute count is the fastest win. If you want the step-by-step version, grab the free 15-Point AI Security Checklist here. It is built for marketers, affiliates, and small operators with no IT team, and it gives you the exact first moves to lock this down before it turns into a cleanup job.
If you want a broader breakdown of why this access-first angle matters now, read this too: AI Hack Defense Playbook: A Practical AI-Era Security Guide for Online Business Owners.
The doors do not close themselves, and old grants do not expire just because you forgot them.
Sources
- Verizon Business, 2025 Data Breach Investigations Report
- IBM, Cost of a Data Breach Report 2025
- DoControl, 2026 Non-Human Identities Report
- Cloud Security Alliance, Salesloft Drift OAuth Supply-Chain Attack
- Obsidian Security, OAuth vulnerabilities and detection timing
- Obsidian Security, OAuth token vulnerabilities
- Invictus on Palo Alto Unit 42 OAuth incident-response findings
- Cloud Security Alliance and Astrix, State of Non-Human Identity Security
Disclaimer: informational only, not professional cybersecurity, legal, or financial advice.
