HireACISO

ConnectWise breach shows how app identities get you into someone else's tenant

October 20, 2026. From issue 11 of The Compliance Brief, one story for founders and executives who own security.

Last reviewed 2026-10-20Written by Jacob Masse, TrazTech Inc.

Issue 11 of The Compliance Brief was published on October 20, 2026. One of its 5 stories bears on breaches, incidents and security leadership, and they are below in short form. The full issue, with every take in full, is on traztech.ca.

Source: BleepingComputer

ConnectWise shut off customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after attackers reached application identities and used them to compromise Microsoft 365 tenants. The service held the standing access needed to do its job, and that access became the attack path.

Our take, in short

Every SaaS product that asks a customer for an OAuth app registration is holding the same kind of key, and most teams I work with have never inventoried what their own app actually requests. Go look at the consented permissions in your Azure tenant this week, both the ones you granted to vendors and the ones your customers granted to...

Read the full take on traztech.ca

Also in issue 11

Outside breaches, incidents and security leadership, but in the same email:

Older: issue 10 All issues on HireACISO