Identity for B2B SaaS

The job identity does in B2B SaaS

For a B2B SaaS company, identity has two jobs at once. Inside the product it is a feature and a deal qualifier: organizations, members, roles, tenant isolation, enterprise SSO and SCIM. Inside the company it is the control that decides whether one phished employee, one support console or one integration token becomes access to every customer. The breach record says the second job is where SaaS vendors fail.

B2B SaaS is the largest named industry in the Identity Breach Database: 19 of the 123 incidents (15.4%), rising from 4 in 2021-2022 to 7 in 2023-2024 and 8 in 2025-2026, per the Identity Breach Report 2026. None of the 19 records describes a break in a product's tenant isolation. Attackers came in through the vendor's own people, tools and machine credentials.

The identity threat picture, from the incident record

Phished staff with access to customer data. 8 of the 19 began with phishing or social engineering of an employee. Mailchimp lost control of an internal support and account administration tool three times in under ten months: April 2022 (319 accounts viewed), August 2022 (214 accounts) and January 2023 (133 accounts). Twilio lost employee logins to SMS phishing in 2022, and its internal tools exposed data of 209 customers and 93 Authy users. The pattern continued with Workday's CRM, Mixpanel, whose smishing breach exposed some OpenAI API users, and RingCentral in July 2026.

MFA that was present but defeatable. Only 2 of the 19 records say MFA was on the abused account, and both say it was bypassed. At Retool, an employee read a one-time code to a caller with a deepfaked voice, and Google Authenticator cloud sync handed the attacker the employee's other factors; 27 cloud customer accounts were taken over. At CircleCI, malware stole an SSO session cookie that had already passed 2FA, and every customer had to rotate every stored secret. The techniques are OTP relay social engineering and session cookie theft.

Non-human identities and fan-out. 7 of the 19 abused a non-human identity, and in 9 of the 19 there was no interactive login for MFA to protect at all. Integration tokens are the sharpest case. UNC6395 used Salesloft Drift OAuth tokens to export data from numerous Salesforce tenants in August 2025, and three months later Gainsight-published app tokens were abused against what Google described as more than 200 potentially affected instances (a scope Gainsight disputes). In October 2026 a stolen ConnectWise app credential produced confirmed unauthorized sign-ins in 162 Microsoft 365 tenants by Huntress's count. Both follow the refresh token abuse pattern.

Stored machine credentials round it out: a Dropbox Sign service account with production privileges, a hard-coded token reported at Sisense that prompted a CISA alert, and Zeabur, where a cluster admin token created in January 2024 with no expiry sat in plaintext and exposed 321,810 accounts. See secrets in repositories and CI and static API key abuse.

The regulatory floor

Most pressure on SaaS vendors is contractual: SOC 2 and ISO 27001 reports gate enterprise deals, and customer security reviews push MFA, access review and logging duties onto you. Statute still applies:

• GDPR and UK GDPR for EU and UK user data, and CCPA/CPRA in California. Large businesses owe their first CCPA cybersecurity audit, which covers MFA, access controls and privileged accounts, by 1 April 2028.
• NIS2 names ICT service management and digital infrastructure as covered sectors, with MFA and privileged access as baseline measures. Member States next review their entity lists by 17 April 2027. See identity controls for NIS2.
• If you sell to EU banks or insurers, you appear in their DORA register of information on ICT third parties, reported each year (next cycle 31 March 2027).
• If you ship installable software, agents or SDKs into the EU, the Cyber Resilience Act main obligations apply from 11 December 2027, including protection against unauthorized access through authentication, identity or access management. The CRA covers products with digital elements and their remote data processing solutions, meaning backend processing a shipped product needs to perform its functions; SaaS with no shipped product behind it is generally outside its scope.

The identity controls that matter most

1. Phishing-resistant MFA for every employee and contractor with a support or admin console. FIDO2 keys or device-bound passkeys would have failed on the fake login pages behind the Twilio, Mailchimp and Retool incidents. Start with MFA rollout and the Phishing-Resistant MFA Matrix 2026.
2. Support tools scoped per ticket. A support agent should see one customer for one reason, with just-in-time access and logged justification, not a search box over every tenant.
3. Short-lived, device-bound sessions for production and source code. CircleCI shows MFA protects the login, not the session after it. Device-bound session credentials and token replay protections limit what a stolen cookie can reach.
4. Treat every connected app as a privileged non-human identity. Inventory OAuth grants, minimize scopes, IP-restrict tokens, and be able to revoke every token for one vendor in one action. See non-human identity security.
5. No static secrets in code or config. Runtime-issued, scoped credentials and secrets rotation, per the API key rotation guide.
6. Product identity built for enterprises. Multi-tenant org models, self-serve SAML and SCIM 2.0, and fine-grained authorization remain the deal qualifiers. Customers who federate in also bring their own MFA policy, which narrows your exposure.

Vendor categories and named vendors

• Product identity (CIAM for B2B): WorkOS as an enterprise-readiness layer, Frontegg for multi-tenant admin portals, Auth0 for broad protocol coverage, Clerk for React-first teams. Compare in best CIAM for B2B SaaS and best SSO and SCIM platforms for B2B SaaS.
• Phishing-resistant workforce MFA: Yubico hardware keys and Beyond Identity device-bound credentials.
• SaaS and integration security: Obsidian Security and Valence Security for SaaS posture and connected-app risk; Push Security for browser-level phishing and session detection.
• Non-human identity: Astrix Security, Oasis Security and Token Security; see best NHI security platforms.
• Secrets: GitGuardian for detection, HashiCorp Vault and Infisical for issuance.
• Production access: Teleport for short-lived, certificate-based infrastructure access.

The broader shortlist is in best identity tools for B2B SaaS. Weigh building product identity yourself with the build vs buy tool, and see identity for B2B SaaS for requirements in depth.

Common pitfalls

• Hardening the product login while internal support consoles run on passwords and SMS codes.
• Treating OAuth integrations as configuration rather than identities with owners, scopes and expiry.
• Admin and service tokens with no expiry, as at Zeabur.
• Bolting multi-tenancy on later; retrofitting org models is painful.

Where it is heading

Expect enterprise buyers to ask for evidence of phishing-resistant MFA on vendor staff and a connected-app inventory in security reviews, not only SSO and SCIM. Identity for AI agents acting inside SaaS, as in the hijacked AI coding assistant case, is becoming a product requirement. See securing AI agent identities.

Frequently asked questions

How do most identity breaches at SaaS companies start?

In the database, 8 of the 19 B2B SaaS incidents began with phishing or social engineering of an employee, and 7 abused a non-human identity such as an OAuth token, service account or stored secret. None of the records describes a break in product tenant isolation.

Does MFA stop these attacks?

Code-based MFA did not. Both SaaS records with known MFA status show it bypassed, once by relaying a code and once by stealing a session that had already passed 2FA. Phishing-resistant MFA and device-bound sessions address both paths.

What is a fan-out breach?

One compromised identity at a provider reaching many customer organizations. Salesloft Drift, Gainsight and ConnectWise are SaaS examples: each vendor's integration credential opened many customer tenants.