A surge of large-scale breaches and extortion campaigns against SaaS CRM platforms in retail, technology, aviation, and finance is overwhelming current defenses.
AppOmni, an enterprise SaaS application security firm, has introduced an innovative defensive feature powered by its Zero Trust Network Access (ZTNA) platform. This solution addresses a common weakness in SaaS applications: their inability to easily share risk and user activity data with an organization’s broader security stack.
Without real-time signal sharing, Zero Trust policies can’t adapt quickly enough to stop breaches. AppOmni’s Shared Signals Framework (SSF) closes this gap by enabling SaaS platforms to send standardized updates on risk and user activity to enforcement points, transforming SaaS from a blind spot into a powerful source of threat intelligence.
CRM systems — particularly SaaS-based platforms like Salesforce — serve as the central nervous system of modern business, holding sensitive customer data, intellectual property, and even access credentials such as AWS keys and Snowflake tokens, according to Chad Knipschild, director of product marketing at AppOmni.
“This makes them a desirable target to groups like ShinyHunters and UNC6395 due to their inherent flexibility and complexity,” Knipschild told CRM Buyer.
Combating Two Major Threat Groups
ShinyHunters and UNC6395 are among the most dangerous cyberattack groups, exploiting human vulnerabilities like sophisticated social engineering and phishing schemes, Knipschild explained. AppOmni built its Zero Trust Bridge solution assuming these mistakes are inevitable, focusing on minimizing their impact.
Director of Product Marketing
ShinyHunters, a black-hat hacking and extortion group formed in 2020, pressures victims to pay ransoms. When companies refuse, it sells or leaks stolen data on the dark web.
UNC6395 specializes in sophisticated voice phishing (vishing) attacks targeting organizations that use Salesforce. These attacks rely on social engineering to bypass security controls and steal sensitive data for later extortion.
“By default, many SaaS CRMs allow users to easily connect third-party apps via OAuth, creating a vast, often unmanaged attack surface,” Knipschild explained. “Attackers don’t need to break through firewalls — they exploit how easily these trusted apps can be connected.”
Without centralized IT oversight, attackers use social engineering to trick employees into authorizing malicious apps, then abuse OAuth workflows to gain persistent access to sensitive data. They target overprivileged tokens, forgotten admin accounts, and excessive app permissions, knowing manual oversight often falls short in these complex ecosystems, he added.
Enables Real-Time Detection
When users unknowingly authorize a malicious app or experience a hijacked session, Zero Trust Bridge monitors in-app behavior and configurations to detect early warning signs such as unusual geographic access, suspicious token reuse, or unexpected login paths.
The system can then automatically respond by requiring stronger authentication, re-authenticating the user, or revoking the session—cutting off attacker access before damage occurs.
This blind spot exists because SaaS platforms often lack native support for real-time risk exchanges, such as SSF, CAEP (Continuous Access Evaluation Protocol), or RISC (Risk Incident Sharing and Coordination). Even when telemetry is available, it’s rarely packaged into signals that authorization systems can act on in real time, Knipschild noted.
“Critical risk indicators must be derived from complex configuration changes and correlated behaviors,” he said. “This creates a broken feedback loop between what happens inside SaaS and the controls that should respond to it.”
Zero Trust Bridge Closes This Gap
AppOmni’s solution is built around the open-source Shared Signals Framework (SSF). Most SaaS applications operate in silos, making it difficult for security teams to see what’s happening inside each one.
Knipschild emphasized that a standardized, open framework for sharing security signals is essential in today’s fragmented SaaS ecosystem.
SaaS platforms hold valuable security data — like configuration changes, login patterns, and token use — but can’t share it in a way other tools can easily consume.
Traditional security efforts rely on periodic, point-in-time audits using perimeter tools like firewalls and Cloud Access Security Brokers (CASBs), leaving long gaps where configuration drift and app sprawl go unnoticed.
Zero Trust Bridge normalizes identity data, enriches security context, and emits SSF-compliant signals that integrate seamlessly with an organization’s existing security stack, eliminating the need for every vendor to build native support.
“Your entire ecosystem becomes more responsive, connected, and capable of enforcing Zero Trust in real time — without custom integrations or manual work,” he said.
Beyond Supply Chain Attack Defense
Zero Trust’s shared signals solution addresses more than just attacks from groups like ShinyHunters and UNC6395. Knipschild said the new framework can help mitigate a wide range of sophisticated threats.
It’s particularly effective against broader threats like session hijacking, which targets the application itself and can bypass both identity provider and network controls. Zero Trust Bridge detects suspicious token reuse, device or user-agent mismatches, and geo-improbable access, enabling real-time responses.
"Essentially, any nuanced indicator of compromise or risk that arises from how users interact with SaaS applications can be detected and shared, enabling a proactive defense so security teams can prevent breaches," Knipschild assured.
Future of Adaptive Security
Knipschild views shared signal technology as the future of adaptive security. He said this evolution will be critical for addressing today’s rapidly shifting cybersecurity landscape, especially as threat actors collaborate more frequently and continually adapt their tactics.
“In the future, we’ll see more granular signal subscriptions covering a wider range of in-app user activities, configuration drift, and threat intelligence,” he predicted. “These signals will extend across all identity types — employees, external users, and nonhuman identities like bots and API keys.”
Knipschild said the real opportunity lies in creating a hyper-responsive Zero Trust fabric where every system can identify risk in real time, enabling continuous and adaptive policy enforcement.
"This will empower security operations to shift from a reactive stance to a predictive one, by leveraging cross-application correlation to detect subtle attack patterns that single apps might miss," he concluded.
Loading ...
