Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability and Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with salesforce, third party assistance with google cloud’s mandiant, and containment measures with disabled salesloft drift application, containment measures with revoked associated integrations, containment measures with rotated integration credentials, and remediation measures with hardened salesforce environment (tenable), remediation measures with collaborated with salesforce and mandiant (qualys), and recovery measures with restored salesloft-salesforce integration (as of 2024-09-07), and communication strategy with public security alerts (tenable: 2024-09-03, qualys: 2024-09-06), communication strategy with nudge security dashboard tracking affected companies, and enhanced monitoring with okta: restricted inbound ip access to salesforce, and remediation measures with advanced filtering, categorization, and prioritization of vulnerabilities; executive-level reporting; seamless upgrade path to fully managed vulnerability program., and communication strategy with executive-level reporting to track risk posture over time; visibility for leadership and compliance efforts., and enhanced monitoring with continuous view of risk through correlation of tenable findings with live detections...

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Salesloft Drift (Compromised in March 2024).

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Business Contact Information, Support Case Metadata and .

Third-Party Assistance: The company involves third-party assistance in incident response through Salesforce, Google Cloud’s Mandiant, .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Hardened Salesforce Environment (Tenable), Collaborated with Salesforce and Mandiant (Qualys), , Advanced filtering, categorization, and prioritization of vulnerabilities; executive-level reporting; seamless upgrade path to fully managed vulnerability program..

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by disabled salesloft drift application, revoked associated integrations, rotated integration credentials and .

Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Restored Salesloft-Salesforce Integration (as of 2024-09-07), .

Key Lessons Learned: The key lessons learned from past incidents are OAuth token security requires stricter monitoring and rotation policies.,Third-party integrations pose significant supply chain risks and must be continuously audited.,Dormant threats can persist for months (initial compromise in March, exploitation in August).,Proactive measures like IP restrictions (Okta) can prevent unauthorized access.Vulnerability management often fails due to overwhelming scan results rather than lack of scanning. Prioritization, remediation, and operational follow-through are critical to reducing risk. Unlimited scanning alone does not solve the problem without proper integration and actionable insights.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Consider managed services to streamline operations and reduce internal resource burdens., Leverage executive-level reporting to track risk posture over time and support compliance efforts., Integrate vulnerability scanning with detection and response workflows for continuous risk visibility., Monetize vulnerability management through layered services like advanced reporting and remediation support., Use advanced filtering, categorization and and prioritization to focus on critical vulnerabilities..

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Tenable Security AlertDate Accessed: 2024-09-03, and Source: Qualys Security AlertDate Accessed: 2024-09-06, and Source: Google Threat Intelligence Group (GTIG) FindingsDate Accessed: 2024-08-26, and Source: Salesloft Update on Compromise TimelineDate Accessed: 2024-09-07, and Source: Nudge Security Dashboard (Tracking Affected Companies), and Source: Okta Statement on Blocked Attack AttemptDate Accessed: 2024-09-02, and Source: MSSP Alert.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Security Alerts (Tenable: 2024-09-03, Qualys: 2024-09-06), Nudge Security Dashboard Tracking Affected Companies and Executive-level reporting to track risk posture over time; visibility for leadership and compliance efforts..

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Public Disclosures By Affected Companies, Nudge Security Dashboard, Tenable And Qualys Notified Affected Customers, No Evidence Of Misuse Reported and .

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Salesforce, Google Cloud’S Mandiant, , Okta: Restricted Inbound Ip Access To Salesforce, , Continuous view of risk through correlation of Tenable findings with live detections..

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Disabled Vulnerable Integrations (Salesloft Drift), Hardened Salesforce Environments (E.G., Tenable), Enhanced Monitoring For Anomalous Oauth Token Usage, Restored Salesloft-Salesforce Integration With Improved Security Controls, , Embedded Tenable scanning in USM platform with advanced filtering, categorization, and prioritization; seamless upgrade path to managed vulnerability program; integration with detection and response workflows..

Most Recent Incident Detected: The most recent incident detected was on 2024-08-26.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2024-09-03.

Most Significant Data Compromised: The most significant data compromised in an incident were Business Contact Information (names, emails, phone numbers, locations), Support Case Subject Lines and Initial Descriptions and .

Most Significant System Affected: The most significant system affected in an incident was Salesforce InstancesSalesloft Drift Integration.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was salesforce, google cloud’s mandiant, .

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was Disabled Salesloft Drift ApplicationRevoked Associated IntegrationsRotated Integration Credentials.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Support Case Subject Lines and Initial Descriptions, Business Contact Information (names, emails, phone numbers and locations).

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Proactive measures like IP restrictions (Okta) can prevent unauthorized access., Vulnerability management often fails due to overwhelming scan results rather than lack of scanning. Prioritization, remediation, and operational follow-through are critical to reducing risk. Unlimited scanning alone does not solve the problem without proper integration and actionable insights.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Enforce least-privilege access for OAuth tokens and revoke unused credentials., Monitor for anomalous activity in integrated applications, especially after dormant periods., Consider managed services to streamline operations and reduce internal resource burdens., Collaborate with vendors (e.g., Salesforce) to share threat intelligence and hardening guidelines., Leverage executive-level reporting to track risk posture over time and support compliance efforts., Adopt zero-trust principles for Salesforce and similar cloud platforms., Integrate vulnerability scanning with detection and response workflows for continuous risk visibility., Implement multi-layered authentication for third-party integrations., Monetize vulnerability management through layered services like advanced reporting and remediation support., Use advanced filtering, categorization and and prioritization to focus on critical vulnerabilities..

Most Recent Source: The most recent source of information about an incident are MSSP Alert, Tenable Security Alert, Qualys Security Alert, Nudge Security Dashboard (Tracking Affected Companies), Salesloft Update on Compromise Timeline, Google Threat Intelligence Group (GTIG) Findings and Okta Statement on Blocked Attack Attempt.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (Collaboration with Salesforce and Mandiant).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Public Disclosures by Affected Companies, Nudge Security Dashboard, .

Most Recent Customer Advisory: The most recent customer advisory issued was an Tenable and Qualys Notified Affected CustomersNo Evidence of Misuse Reported.

Most Recent Entry Point: The most recent entry point used by an initial access broker was an Salesloft Drift (Compromised in March 2024).

Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was March 2024 to June 2024 (Mapping Internal Systems).

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Insufficient Protection of OAuth Tokens in Salesloft DriftDelayed Detection of Initial Compromise (March to August 2024)Lack of Segmentation Between Third-Party App and Salesforce Data, Vulnerability management breakdowns due to overwhelming scan results and lack of prioritization/remediation..

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Disabled Vulnerable Integrations (Salesloft Drift)Hardened Salesforce Environments (e.g., Tenable)Enhanced Monitoring for Anomalous OAuth Token UsageRestored Salesloft-Salesforce Integration with Improved Security Controls, Embedded Tenable scanning in USM platform with advanced filtering, categorization, and prioritization; seamless upgrade path to managed vulnerability program; integration with detection and response workflows..