---
title: Breaking Down the Salesforce/Drift Breach – An Attacker’s POV
description: Join experts Matt and Clint as they analyze the Salesforce/Drift breach, revealing how attackers exploited weak SaaS fundamentals and what defenders must change to enhance security.
---

[Skip to content](https://page.reveal.security/breaking-down-the-salesforce/drift-breach-an-attackers-pov#main-content)

[![Color_logo_rgb-Feb-27-2025-04-07-06-8665-PM](https://page.reveal.security/hs-fs/hubfs/Color_logo_rgb-Feb-27-2025-04-07-06-8665-PM.png?width=225&height=74&name=Color_logo_rgb-Feb-27-2025-04-07-06-8665-PM.png)](https://www.reveal.security/)

Open main navigation

Close main navigation

- [Let’s meet up!](https://calendar.app.google/pY9MxxshaMokHWRAA)

[Let’s meet up!](https://calendar.app.google/pY9MxxshaMokHWRAA)

[![Reveal_Purple](https://page.reveal.security/hs-fs/hubfs/Reveal_Purple.png?width=300&height=38&name=Reveal_Purple.png)](https://www.reveal.security/)

Open main navigation

Close main navigation

# Breaking Down the Salesforce/Drift Breach – An Attacker’s POV

On-Demand Webinar

### Overview

The Salesforce/Drift breach wasn’t about zero-days or advanced malware — it was about weak SaaS fundamentals. Attackers leveraged stolen credentials, abused OAuth integrations, and quietly exfiltrated Salesforce data across multiple enterprises.

 

In this exclusive session, two offensive security experts will take a look at the recent breach from an adversary’s perspective. Matt and Clint will give raw insights from offensive tradecraft, real-world anecdotes, and a candid discussion of what defenders need to change if they want to stop the next SaaS-driven breach.

#### What you will learn

- How threat actors turned SaaS misconfigurations into a months-long breach
- Why OAuth tokens and SaaS integrations are the new attacker goldmine
- Where defenders consistently miss detections in SaaS environments
- Practical steps to harden SaaS identity and integration security

### Watch the Webinar Now!

## Speakers

![mattM headshot](https://page.reveal.security/hs-fs/hubfs/mattM%20headshot.jpg?width=800&height=595&name=mattM%20headshot.jpg "mattM headshot")

**Matt Mullins**

Head Hacker

**Reveal Security**

 

Matt brings years of red team and offensive security experience. At Reveal, he helps organizations understand attacker tradecraft and adapt defenses for a SaaS-first world.

![C (1)(1)](https://page.reveal.security/hs-fs/hubfs/C%20(1)(1).jpg?width=800&height=595&name=C%20(1)(1).jpg "C (1)(1)")

**Clint Kehr**

 Security Architect and Senior Instructor

**Cybrary**

 

 Clint brings deep experience in both offensive security operations and security architecture, bridging attacker insight with practical defense.

**Reserve Your Spot**

Don’t miss this opportunity to hear the unfiltered attacker perspective on one of the year’s most impactful SaaS breaches.

[![Reveal_White](https://page.reveal.security/hs-fs/hubfs/Reveal_White.png?width=300&height=38&name=Reveal_White.png "Reveal_White")](https://page.reveal.security/?hsLang=en)

[linkedin-in icon](https://www.linkedin.com/company/revealsecurity/)

[Platform](https://www.reveal.security/platform/)

[Technology](https://www.reveal.security/identity-journey-analytics/)

[Solutions](https://www.reveal.security/insider-threats/)

[Account Takeover](https://www.reveal.security/account-takeover/)  
[Insider Threats](https://www.reveal.security/insider-threats/)  
[Third Party Risks](https://www.reveal.security/third-party-risks/)  
[Protect SaaS Applications](https://www.reveal.security/protect-saas-applications/)

[Resources](https://www.reveal.security/resources/)

[Blog](https://www.reveal.security/blog/)

[Company](https://www.reveal.security/about-us/)

[About Us](https://www.reveal.security/about-us/)  
[Partners](https://www.reveal.security/partners/)  
[Careers](https://www.reveal.security/careers/)  
[Contact Us](https://www.reveal.security/contact-us/)

© 2025 Reveal Security, Inc.