# Article Name What Is a Toxic Combination in SaaS? # Article Summary SaaS toxic combinations are risky permission combos that enable breaches and fraud and ways to detect and prevent them effectively # Original HTML URL on Toriihq.com https://www.toriihq.com/articles/toxic-combination-saas # Details SaaS security incidents often come from risky combinations of permissions inside enterprises. When a single account holds multiple rights that together grant administrative, billing or approval powers, it creates a single point of failure attackers or compromised insiders can exploit to commit fraud, exfiltrate data, or make unnoticed system changes. Accounts with two or three overlapping entitlements can create a critical risk. Security teams miss these risks because role catalogs and access reviews typically evaluate permissions one at a time instead of assessing the risk those combinations produce in real scenarios. This article shows how to find dangerous permission pairings across your SaaS estate. You'll learn how to measure real-world impact and apply practical detection and remediation steps that reduce the chance of breaches and curb fraud. ## What is a toxic combination in SaaS security? A toxic combination is a specific pairing of permissions that creates a single, risky failure point. The term refers to two or three entitlements held together by one identity that create far more risk than each permission alone. A user with admin rights in one app and approval authority in another can become the pivot for fraud or data theft, especially where systems and workflows meet. They often show up across applications and identity constructs, for example delegated admin plus billing approval, or between human roles and machine/service accounts. A person who can install third-party integrations and also approve vendor onboarding or payments creates a direct path from a malicious app to real money. A simple chain looks like: - The attacker installs a rogue or compromised app and grants it broad scopes that expose data and permissions; - They approve the vendor onboarding or payment terms, letting invoices flow to attacker-controlled accounts and masking the activity as normal business expense; - The same identity accepts or overlooks automated billing changes, because it controls both integration installs and approvals. That sequence converts separate low-to-medium privileges into a single, high-impact control failure that often goes unnoticed until money or data is gone. Traditional role catalogs and flat permission lists miss these risks by treating entitlements in isolation. They report who has which role, not which combinations collide when an attacker or accident happens. Shared service accounts, single-approver workflows and delegated admin setups make the blind spot worse, and about 80% of breaches start with compromised or misused credentials so those collision points matter. Public patterns like OAuth consent phishing against platforms such as Google Workspace [https://workspace.google.com] and abuse of Office 365 app tokens show how cross-application consent and approval chains are weaponized. Looking for combinations, not just single privileges, is the reliable way to spot where a breach or fraud path can form. ## What real-world incidents demonstrate these risks? Real incidents show how paired permissions let small mistakes become major security failures. These examples show how small misconfigurations can cascade into multi-million dollar breaches when over-privileged identities are abused. One clear pattern is an app admin who can also approve payments. That combination lets a single person install a rogue app and funnel invoices to attacker accounts. The 2017 case where attackers tricked employees at Google [https://www.google.com] and Facebook [https://www.facebook.com] into paying fraudulent invoices illustrates how payment approval rights can be abused, even without a direct product compromise. When procurement and app installs are tied to the same identity, fraud becomes low-effort and high-impact; attackers just need one pathway to both install and pay. A second scenario is a developer with both repo write access and production config privileges who introduces malicious code that reaches production without independent review. The Codecov [https://codecov.io] incident shows how a compromised CI tool or uploader script can exfiltrate tokens and let attackers push changes or access downstream systems, turning a small credential leak into supply-chain compromise. That kind of integrity risk often bypasses normal change-control because the same persona controls commit, CI, and deployment steps. A third common case involves leaked OAuth tokens and exposed service credentials that act like master keys across services. Publicly committed tokens and keys have powered real intrusions. For example, exposed AWS keys have been abused to spin up crypto miners on corporate accounts, as happened at companies including Tesla [https://www.tesla.com] when credentials were accidentally published. These incidents show how monitoring and alerts often fail when the attacker already controls the identities that would trigger them. - Typical consequences seen in breaches include direct financial loss, data exposure, extended cleanup costs, and regulatory penalties: - Large financial losses from diverted vendor payments and invoice fraud, often requiring lengthy recovery and audits - Extensive PII exposures that trigger regulatory investigations, fines, and costly notification and remediation processes for affected customers - Lateral movement across environments when leaked tokens or credentials allow attackers to access multiple connected applications and services Costs add up fast, and breach averages hit the millions. IBM found an average cost of about $4.45 million in 2023, a sharp reminder that blocking dangerous permission pairings reduces both risk and cleanup expense. ## How can organizations detect toxic combinations? Detecting toxic combinations starts with a simple, cross-system map of who can do what and where. Build a centralized inventory that pulls entitlements from every SaaS app and your identity directory, then stitch those identities into a permission graph showing paths between roles and functions. Run automated segregation-of-duties scans that check for cross-application pairings, not just local role overlaps, and link findings to logs so you can see if a risky pairing is being used. Long-lived tokens, admin actions, approval records and billing events are the signals to correlate; finding a pairing with no activity is one thing, seeing the pairing and related actions lets you prioritize fixes. Choose tools that make cross-application relationships obvious and provide APIs to query entitlement data across systems. Look for these detection capabilities: - Cross-application entitlement mapping and clear visual permission graphs that reveal privilege paths - Continuous risk scoring for risky entitlement combinations rather than only individual privileges present - Change-history logging and drift detection for roles, approvals, and entitlement assignments - Access-review workflows with approval gates and APIs to support automated entitlement queries Track a few focused KPIs so your team can measure progress and reduce risk. Count the number of active toxic combinations, measure privileged accounts without activity for 90 days, and track median time-to-remediation after a risky pairing is flagged. Even simple metrics like percentage of entitlements with recent activity help surface false positives and focus remediation. Run simulated attack paths and blast-radius analysis regularly to validate tool findings. Follow up with attestation drives that ask owners to confirm or revoke entitlements. Automate where you can: schedule periodic exports of entitlement data, wire tool alerts into ticketing systems, and run scripts that revoke known risky pairings until a manual review confirms they are safe. These practical steps turn detection into measurable control rather than just another report. ## What controls prevent and remediate toxic combinations? Start by removing risky permission pairings and designing controls that stop them from forming. Enforce least privilege with narrow, task-based roles and stop giving broad admin rights; require multi-party approval for any cross-domain action so no single identity can both onboard vendors and approve payments. Keep roles tied to tasks rather than titles, and require role templates to map to specific, testable actions so access creep becomes visible quickly. Automate controls where possible to reduce human error and approval fatigue. Use just-in-time elevation, time-bound approvals, and policy engines that block known risky pairings at assignment while logging each elevation and approval for audit trails and investigative review. Integrate break-glass flows that require recorded justification and post-event review, and make sure emergency access reverts automatically after a short window unless a formal exception is logged. Run regular entitlement certifications and automated playbooks to fix drift quickly. Make multi-person approvals mandatory for procurement and vendor onboarding, and tie developer privileges to CI/CD gates so repository and production access follow change control and signed approvals. Build automated remediation playbooks that remove risky pairings, rotate shared credentials, or disable stale privileged accounts on detection, and include these runbooks in your incident response plan to make fixes repeatable. Start with a few fast wins you can complete this week to lower overall exposure quickly. - Remove legacy shared admin accounts and convert them to named, logged identities that are tied to individual users and activity logs. - Map the top-10 risky permission combos across your most-used SaaS apps and prioritize fixes based on real usage and risk. - Enforce approval gates for new apps, vendors, and billing changes with documented multi-person signoff and tracked evidence for audits. - Turn on JIT elevation and break-glass auditing for all high-risk roles, and log every emergency elevation for review. Institutionalize a formal separation-of-duties matrix and a documented risk-acceptance process to keep controls in place. Add automated policy checks, enforce policies automatically, and run periodic attestations so issues do not recur while protection scales without adding daily friction. ## Conclusion Toxic permission combinations open the door to breaches, fraud and outages. They quietly give a single account the power to change configurations and move money across systems, raising risk in ways teams often miss. The guide explains how those dangerous pairings appear, how to find them across apps and directories, and lists concrete steps teams can take to stop and fix them. Start with fixes you can do this week. Map entitlements across apps and directories and scan for pairings that span multiple systems. Enforce separation of duties and require approvals from more than one person before changes go live. Run scheduled reviews and remove or lock any combination that lets one identity both change systems and pay vendors. ## Audit your company's SaaS usage today If you're interested in learning more about SaaS Management, let us know. Torii's SaaS Management Platform can help you: - Find hidden apps: Use AI to scan your entire company for unauthorized apps. Happens in real-time and is constantly running in the background. - Cut costs: Save money by removing unused licenses and duplicate tools. - Implement IT automation: Automate your IT tasks to save time and reduce errors - like offboarding and onboarding automation. - Get contract renewal alerts: Ensure you don't miss important contract renewals. Torii is the industry's first all-in-one SaaS Management Platform, providing a single source of truth across Finance, IT, and Security. Learn more by visiting Torii [https://www.toriihq.com].