Salesforce

La campaña de Salesloft Drift contra Salesforce demostró un moderno problema de responsabilidad SaaS: un atacante puede usar tokens OAuth de una integración confiable como autoridad delegada. Esto convierte el consentimiento, los alcances, el almacenamiento de tokens, la gobernanza del mercado de aplicaciones, la visibilidad de registros de clientes y la respuesta a incidentes de terceros en parte de la responsabilidad de Salesforce, a pesar de que el problema no surgió de una vulnerabilidad

Salesforce, el gigante del software, señaló que se espera que el mercado de la IA en el Reino Unido crezca hasta superar el billón de dólares para 2035.

Salesforce said an emergency fix triggered a software issue and a DNS network incident in May 2021. The deeper accountability question is how a globally distributed change, process-restart behavior, recovery dependencies and service-level evidence combined to turn one intervention into a broad continuity failure.

Salesforce's 2019 Pardot permissions incident exposed a hard distinction between restoring a cloud service and restoring confidence in who may do what inside it. The public record supports a careful conclusion: authorization state is operational infrastructure, and continuity is unfinished until that state can be reconstructed, checked, and explained.

The Salesloft Drift campaign against Salesforce customer environments was a clean demonstration of a modern SaaS accountability problem: the attacker did not need to break the front door of every customer. The attacker could use a trusted integration's OAuth access and refresh tokens as delegated authority. That made consent, scopes, token storage, app marketplace governance, customer log visibility, and third-party incident response part of Salesforce accountability even though the public record says the issue did not stem from a vulnerability in Salesforce's core platform.