The security work nobody wants to do is the risk nobody's watching

There's a role your security team needs that you'll never post a req for. The job description writes itself: review tens of thousands of OAuth grants, one at a time, forever. Check the scopes. Research the vendor. Confirm it's still used. Chase down the employee who authorized it. Check their access rights. Consider the business impact. Repeat tomorrow, because a few hundred more appeared overnight.

‍

No one is hiring for this job. No one wants this job. And that's exactly why app-to-app integration risk keeps compounding—not because security teams don't care, but because the work to manage that risk is structurally impossible for humans to own.

‍

This is the job agentic AI was built for. Not to make overloaded security analysts marginally faster, but to own work no human team ever could: continuously investigating the long tail of OAuth grants, integrations, extensions—activities that happen at the Workforce Edge—turning that grind into a short list of prioritized decisions, and closing the loop before an attacker finds the forgotten grant first.

‍

Now is the right moment—the risk surface is real and sprawling, and the attack paths are already proven. The only question is whether this work gets done by an agent working for you, or discovered first by one that's working against you.

‍

The math breaks before the budget does

Let's start with the volume. Across the Nudge Security platform, we see that employees average 88 OAuth grants each. That means a 1,000-person company is sitting on roughly 88,000 standing app-to-app connections—most authorized in two clicks, without security review, each one a live credential into corporate systems and data.

‍

Now, let's price the review. A proper investigation of a single grant—scope analysis, vendor reputation, actual usage, a conversation with the person who granted it—takes 30 to 45 minutes, consistent with SOC benchmarks of 20–40 minutes per alert investigation. Triage even the riskiest 5% of that backlog and you've committed over a year of full-time analyst work. At the BLS median for a security analyst, that's real money for one pass at one risk category—before the backlog regrows.

‍

Browser extensions make the math worse, not better. 99% of employees run extensions, and 53% have at least one with high or critical permissions—access to cookies, credentials, and everything on the page. And unlike a grant, an extension doesn't hold still: it silently updates itself, which means every review you complete starts expiring the moment you finish it.

‍

But here's the thing: the math on labor doesn't really matter. You aren't going to go in front of your board of directors to lobby for two or three new FTEs to do this work. The reality is that even with unlimited budget, this work wouldn't get done. Here's why.

‍

Nobody wants this job—and the evidence is everywhere

Look at how the market actually staffs this work. It shows up as a bullet buried in third-party risk analyst postings, or as contract cleanup gigs that literally say "review and clean up OAuth grants and third-party app permissions"—work you bring someone in to do once, after an audit finding, because no one on staff will volunteer for it.

‍

That's not a hiring gap. Security professionals build careers on threat hunting, detection engineering, incident response—not on grinding through permission scopes for a grammar checker someone installed in 2023. Assign an analyst this work full time and you're writing their resignation letter for them.

‍

Already, the average SOC faces nearly 3,000 security alerts a day, and 63% go unaddressed. When everything is triaged by exhausted humans, the work that's tedious, ambiguous, and never urgent loses every single time. App-to-app integrations review is all three. It will always be the cleanup thing your team does "next quarter."

‍

So the honest comparison here isn't really agent versus analyst. It's agent versus nobody.

‍

Managing this risk takes reasoning, not just SOC rules

Here's what makes app-to-app integration risk different from the risks your existing stack handles: when it goes wrong, nothing alerts.

‍

The Salesloft Drift breach is a prime example. In that attack, threat actors used stolen OAuth tokens to pull data from more than 700 organizations over ten days—including some of the most security-mature companies in the world. The activity flew under the radar, because the OAuth tokens between Drift and Salesforce were valid, approved, trusted. Traditional detection watches for someone breaking in. These attackers logged in, through a door the business had opened on purpose.

‍

How do you tune a SIEM rule for, "approved integration that shouldn't be trusted anymore?" That determination requires judgment: What does this app actually do? Who's behind it? Is it still used? Did its risk profile change since someone said yes? That's an investigation, not a signature.

‍

The browser extension threat landscape looks similar. In the 2025 RedDirection campaign, 18 browser extensions shipped clean, earned verification badges, 2.3 million installs, hundreds of positive reviews, and then turned malicious through silent automatic updates. Stanford researchers found malicious extensions sit in the Chrome Web Store for an average of 380 days before removal. Even Cyberhaven—a security company—had its own extension hijacked and pushed to 400,000 users overnight. Marketplace vetting, verification badges, point-in-time allowlists: every static control has failed publicly at some point.

‍

This is what agentic security is built for

Here's what it looks like to properly manage the risks associated with employee-initiated risks like app-to-app integrations and browser extension installs:

• Investigate, not just detect. Evaluating a grant or extension means reasoning about scopes, vendors, usage patterns, and business context. That takes reasoning, not just rules.
• Run continuously. Grants persist beyond their business purpose and extensions update regularly. A review cadence measured in quarters can't govern a risk surface that changes daily. Consider that the median enterprise takes 94 days to remediate an exposed credential, while attackers exploit them within minutes.
• Scale with the backlog, not the headcount. Hundreds of thousands of OAuth grants can't wait their turn in a human queue.
• Act with accountability. Findings without remediation are yet another risk registrar. The loop has to close with revocation and removal at scale, with human oversight.

Agentic AI is the only architecture that satisfies all four of these requirements. An agent does the 30-45 minutes of investigation on every new grant and every risky extension, ranks what matters, recommends the action, and revokes high-risk access once your team approves it. Security analysts retain the final call, while the agent absorbs the grind no person should or will take on.

‍

This isn't about AI replacing security analysts. It's AI doing work security analysts were never going to do, so the risk stops being invisible by default. Even IBM's breach data points the same direction: organizations using AI extensively in security operations cut breach lifecycles by 80 days and saved $1.9 million per breach.

‍

Like it or not, the agentic AI arms race is here

If security teams don't successfully harness agentic AI to manage the sprawl of OAuth grants, integrations, and browser extensions, attackers will. Whether you build your own agents or take advantage of the deep security expertise and embedded context that Nudge Security's AI agents offer, the possibilities for agentic AI to turn an impossible backlog of risk into accountable action are real. There's no reason that the daily activities and risk decisions employees are making at the Workforce Edge should stay invisible until a breach makes them visible.

‍

See what's happening at your Workforce Edge—Nudge Security discovery runs in minutes and shows you every OAuth grant and third-party browser extension installed, analyzes risk, and uses agentic workflows to act on that risk.