Ship an AI feature and you become someone's AI risk. Buy one and you inherit someone else's. Over the past twelve months both directions produced real breaches, and enterprise security reviews now treat SaaS vendors' AI accordingly.
Twelve months that rewrote the questionnaire
Four incidents, in sequence.
Between August 8 and 18, 2025, a threat actor Google tracks as UNC6395 used OAuth tokens stolen from Drift (Salesloft's AI chatbot platform) to log into customers' Salesforce instances and mass-export data. Google Threat Intelligence Group put the impact at over 700 organizations. The named victims read like a security-industry conference agenda: Cloudflare, Google, PagerDuty, Palo Alto Networks, Proofpoint, Tanium, Zscaler. The attackers ran targeted SOQL queries against Users, Accounts, and Cases objects, then harvested the secrets people had pasted into support tickets: AWS keys, Snowflake tokens, passwords. Salesloft and Salesforce revoked every Drift token on August 20, and Drift came off the AppExchange. FINRA issued a cybersecurity alert about it, which tells you an AI chatbot vendor's breach is now a financial-regulator matter.
Earlier that summer, Asana's MCP server, launched May 1, 2025 with LLM integration, shipped with an access-control logic flaw that let users see other organizations' data: task details, project metadata, comments, uploaded files. Discovered June 4. Offline June 5 through 17. Roughly 1,000 customers exposed to each other for over a month.
Then the near misses. EchoLeak, CVE-2025-32711 at CVSS 9.3, was the first known zero-click indirect prompt injection against a production AI agent: a crafted email with a payload hidden in an HTML comment could make Microsoft 365 Copilot exfiltrate anything in its reach, with no user interaction at all. Microsoft patched it server-side and confirmed no in-the-wild exploitation. Three months later, Noma Labs disclosed ForcedLeak in Salesforce Agentforce, CVSS 9.4: malicious Web-to-Lead form submissions could steer the agent into exfiltrating CRM data through a content-security-policy bypass. The exfiltration domain cost the researchers $5. Salesforce shipped Trusted URLs enforcement on September 8, 2025.
Two actual data exposures at SaaS companies, plus critical injection flaws in the two flagship enterprise AI assistants. Different vendors, different architectures, same lesson. This is structural, not a story about any one company's engineering culture.
Your enterprise customers' security teams read the same incident reports you do. That is why the questionnaire changed.
The risk runs both directions at once
Most SaaS security leads still file "AI risk" under product security. It belongs in two ledgers, because you are simultaneously the vendor whose AI feature gets reviewed and the buyer whose employees use everyone else's AI.
| Risk surface | You as the vendor | You as the buyer |
|---|---|---|
| Data exposure | Customer data flowing through your AI feature to a third-party LLM; tenant-isolation flaws like Asana's MCP bug | Employees pasting source, secrets, and customer records into external AI tools; CSA finds 56% of orgs report sensitive uploads to unauthorized apps |
| Contracts and notice | Adding an LLM provider is a subprocessor change; DPAs typically require list updates, customer notice, and sometimes grant objection rights | Your own vendors adding AI subprocessors under the same mechanics, with notice windows you have to actually track |
| Prompt injection | Indirect injection through any content your feature ingests: emails, form fills, uploaded files (EchoLeak, ForcedLeak) | Assistants you deploy internally carrying the same class of flaw against your tenant's data |
| Integration credentials | OAuth tokens your AI product holds into customer systems: the exact asset stolen in the Drift attack | Tokens third-party AI tools hold into your Salesforce, your Slack, your code hosting |
| Audit evidence | Buyers and SOC 2 auditors asking for prompt logs, model inventories, and vendor reassessment records | Producing the same evidence about your workforce's AI use for your own audit |
Last verified: September 8, 2026.
The subprocessor row deserves the most attention because it is the least intuitive. When your product team wires an LLM into a feature, they think they shipped a capability. Contractually, you changed your processing chain: the model provider, the cloud it runs on, possibly a moderation service behind it. Under a standard general-written-authorization DPA, that obliges you to update your public subprocessor list and notify enterprise customers within the DPA's window, and some of those customers hold objection rights. A feature launch is now a legal event. Plan the notice before the launch date, not after the first customer email.
The buyer side is quieter but bigger. The Cloud Security Alliance's 2025-2026 survey of 420 IT and security professionals found 63% of organizations reporting external data oversharing, while only 44% prioritize security for all sanctioned apps and a bleak 17% for unsanctioned ones. By the end of 2025, in CSA's framing, AI had stopped being a separate tool category and was embedded directly in core CRM, HR, engineering, and finance platforms. There is no "AI vendors" column in your vendor register anymore. Every vendor is one.
What auditors and enterprise buyers now want to see
Vanta's State of Trust 2025, a survey of 3,500 IT and business leaders across five countries, measured the squeeze from both ends. Teams now spend nine working weeks a year on vendor security reviews and risk assessments, up from seven the year before. Only 36% of organizations have or are building a company AI policy. 59% say AI cyber threats are advancing faster than their security team's expertise, and 61% say they spend more time proving security than improving it.
Nine weeks. That is the tax before anyone remediates anything.
SOC 2 is where the pressure lands first for most SaaS companies, specifically CC9.2 on vendor risk. Guidance circulating in the audit ecosystem now expects third-party LLM providers to appear in vendor reassessments with their reports on file, model versions and fine-tuning activity logged immutably, and drift checks in the pipeline. One AI-governance vendor's audit-prep guide frames the auditor's question bluntly: what inputs are your employees sending to AI systems, and what happens when someone submits content that violates your data-handling policy? Auditors want evidence the control evaluated the data before it left the boundary, not a policy that says it should have. Vanta launching a dedicated AI Security Assessment product in April 2025 is the clearest signal that this review layer is formalizing rather than fading.
On the buyer-facing side, questionnaires have moved past "do you use AI?" They ask where it runs, whether it is customer-facing, what the failure modes are, and what "our AI is secure" means in terms of encryption, access control, audit logging, and pentest results. One security-review vendor's guidance puts it plainly: a vendor that can't explain when their model is likely to fail isn't ready for production use. We compared how AI agents handle security questionnaires, and if you are building your own review process, our 50-question AI vendor questionnaire is the working template. AccuroAI sits on both sides of this burden for technology companies: evidence for the reviews you receive, mapped across 8 frameworks, generated from the same telemetry that governs the AI your own staff uses.
The code your team ships is part of the surface
Coding assistants get treated as a productivity line item. They are also a supply-chain input into everything you sell.
Veracode's 2025 GenAI Code Security Report tested more than 100 LLMs on 80 real-world coding tasks across four languages. AI-generated code introduced security vulnerabilities in 45% of test cases. Java was the worst offender at over 70% failure. Cross-site scripting defenses failed 86% of the time, while SQL-injection handling passed at 80% and crypto at 86%, the models are unevenly bad, which is worse than uniformly bad because it defeats intuition about where to look.
None of this argues for banning assistants. It argues for scanning AI-generated code in CI like any other untrusted contribution, and for knowing which assistants your engineers run and what leaves the laptop with each completion request: source, config, and the secrets embedded in both. That endpoint layer is what our endpoint AI governance product covers, with 60+ secret-pattern detectors inline at under 38ms p99, and our Cursor enterprise security review walks through what one of these tools actually transmits.
Nine controls, in rough order of regret
Grounded in OWASP's Top 10 for LLM Applications 2025, where prompt injection holds #1 for the second consecutive edition with the threat shifting to indirect injection, and NIST's Generative AI Profile (AI 600-1), which defines twelve genAI risk categories including data leakage and confabulation:
- Inventory every AI feature and map its data flow, including exactly which third-party LLMs receive customer data
- Update the subprocessor list and DPA notice process before an AI feature ships, not after
- Log prompts and responses with sensitive-data controls; this doubles as your CC9.2 evidence
- Minimize OAuth scopes and rotate tokens for every AI integration, the Drift lesson, learned at 700 companies' expense
- Test tenant isolation on AI endpoints and MCP servers specifically, per Asana
- Red-team for indirect prompt injection and enforce URL allowlisting on agent outputs, the control that would have blunted ForcedLeak
- Scan AI-generated code in CI with the same rigor as third-party dependencies
- Meet EU AI Act Article 50 transparency for any EU-facing AI feature
- Write the AI policy and keep questionnaire-ready documentation current, since only 36% of organizations have one and buyers notice
The deadline that already passed
On August 2, 2026, one month before this post, Article 50 of the EU AI Act took effect, alongside the Act's penalty regime. Users must be told when they are talking to an AI system. Synthetic audio, image, video, and text need labeling, and systems placed on the market before that date were required to comply by it, not from it. Obligations for general-purpose model providers had already begun a year earlier, in August 2025.
If your SaaS product serves EU users and carries an embedded chat or generation feature, these duties are live now. Not on a roadmap. Not in a grace period. The AI-washing era taught vendors to say "AI-powered" everywhere; Article 50 makes the disclosure run the other direction, to the user, with fines attached. Check whether your product says it anywhere a European can see.
Questions SaaS security leads keep asking
Our SOC 2 report is clean. Doesn't that cover our AI features?
A report scoped before your AI features shipped says nothing about them. Auditors are now probing CC9.2 for third-party LLM providers, model change logging, and prompt-level data controls, and enterprise buyers increasingly ask for that evidence directly rather than accepting the report alone.
Do we really have to notify customers before adding an LLM provider?
If your DPA runs on general written authorization, which most commercial SaaS DPAs do, adding a model provider is a subprocessor change: list update, customer notice within the contractual window, and possibly objection rights. Read your own DPA before your customers' lawyers do.
We use a major model provider. Isn't prompt injection their problem?
EchoLeak and ForcedLeak were flaws in how Microsoft and Salesforce products handled untrusted content around the model, not flaws in the model itself. Injection defense lives in your application layer: input handling, output constraints, egress allowlists, and least-privilege scopes for whatever the agent can touch.
Does the EU AI Act apply to a US SaaS company?
It applies based on where your users are, not where you are incorporated. An AI chat or content-generation feature serving EU users triggers Article 50 transparency duties, in force since August 2, 2026. Whether you count as provider or deployer for a feature built on a third-party LLM is genuinely nuanced, so get a legal read on your specific architecture.