How Enverus Stopped a Large-Scale SaaS Attack with Varonis

Enverus is a decision-support platform serving the energy and energy infrastructure space, from small independent operators to the world's largest supermajors, managing large volumes of geophysical, petrophysical, operational, and infrastructure data alongside proprietary IP. As the company expanded, its security team, led by Vice President of Security Alex Acosta, needed visibility into its entire data estate and confidence that security controls were being enforced consistently — especially within Salesforce, one of its most business-critical platforms.

CHALLENGE

A Distributed Data Estate with Salesforce at Its Center

With data spread across cloud platforms, SaaS applications, and on-premises data centers and databases, each carrying its own permissions model and operational team, Enverus needed a consistent way to answer fundamental questions: what sensitive data exists, where does it live, who can access it, and are controls consistently enforced across every environment?

Salesforce presented a uniquely difficult version of that challenge. Overlapping profiles, permission sets, roles, sharing rules, and connected apps had accumulated over time, making it hard to understand a user's effective permissions or spot excess access. The problem was compounded by the many apps, agents, APIs, and sandboxes moving data in and out of production — often retaining long-lived tokens or creating unintended backdoors. Without a centralized view, answering these questions meant manual analysis and spreadsheet-driven reviews that were difficult to sustain.

SOLUTION

Unified Visibility and Identity Security Applied to Salesforce

Varonis gave Enverus unified data security across AWS, Azure, Salesforce, and Microsoft 365 — a comprehensive view of what sensitive data exists, where it lives, who can access it, and whether controls are consistently enforced. Varonis mapped identities across platforms and significantly reduced the organization's blast radius, turning what had been difficult to operationalize into a straightforward process: identify the highest-risk access, right-size permissions, and report progress against enterprise policy.

What surprised us most was Varonis' insight into the data plane from an identity and access perspective. That wasn't what we initially came for, but it's proven to be critical.

Applying identity threat detection and response (ITDR) principles directly to Salesforce transformed what had been static, spreadsheet-driven reviews into clear prioritization of high-risk access, actionable remediation guidance, and simple, repeatable reporting aligned to enterprise policy.

We now have a far more complete picture of Salesforce than we ever had before.

As Enverus' security operations team processed hundreds of alerts per day in 2025, Salesforce stood out as a particularly important attack surface given its scale, connectivity, and data sensitivity. Varonis' Salesforce-specific detections, guidance from a dedicated threat research team, and new detection strategies helped Enverus investigate novel activity, validate behavior, and proactively design new detections to reduce future risk.

Spotlight: Stopping a Large-Scale SaaS Supply Chain Attack

In early 2025, a threat actor known as UNC6395 compromised Salesloft's GitHub repositories and stole OAuth tokens that allowed Drift — a widely used chatbot owned by Salesloft — to connect to customers' Azure, Salesforce, Google Workspace, and other integrated platforms. Between August 8 and 18, the attacker used those tokens to impersonate the trusted Drift application, bypass MFA, and exfiltrate data from more than 700 organizations, including Cloudflare, Zscaler, Palo Alto Networks, and Proofpoint. For most victims, the attack went undetected because OAuth abuse looks like normal API traffic, and most organizations only learned of the breach when Salesforce and Salesloft notified them more than two weeks later.

Enverus was the exception. With Varonis deployed across the environment, the attack was detected, contained, and neutralized before it fully materialized:

• Cross-platform detection: Varonis flagged Drift activity in Azure as abnormal, with OAuth token refreshes from unusual IP addresses and API call volumes exceeding Drift's baseline — triggering an alert and a check of Drift activity across other systems.
• Salesforce telemetry confirms the threat: Salesforce Shield Event Monitoring gave Varonis the detailed logs needed to identify abnormal activity from the Drift connected app, including logins from suspicious IPs and unusual API queries.
• Varonis MDDR responds: correlating the Azure and Salesforce signals, Varonis' Managed Data Detection and Response (MDDR) team engaged alongside Enverus' security operations to suspend the compromised identity, revoke OAuth tokens, classify potentially exposed sensitive fields and attachments, remove excess high-risk permissions, and remediate overly permissive sharing rules and misconfigured Salesforce Sites.

Within two hours, Enverus had full containment and forensic proof that no sensitive data had been exfiltrated.

RESULTS

A Partnership That Keeps Expanding

Following that success, Enverus continues to deepen its partnership with Varonis, building further on Salesforce-specific detections, monitoring, and threat prevention strategies while extending visibility and governance across additional platforms.