CX platforms process billions of unstructured interactions every year: survey forms, review sites, social feeds, call center transcriptions, all of which feed into AI engines that trigger automated workflows spanning payroll, CRM and payment systems. Not a single tool in a security operations center leader’s stack inspects what a CX platform’s AI engine is recording, and attackers have discovered this. They poison the data that feeds it, and the AI does the damage for them.
The Salesloft/Drift breach in August 2025 proved exactly this. Attackers compromised Salesloft’s GitHub environmentDrift chatbot OAuth tokens stolen, and access to Salesforce environments in more than 700 organizations, including Cloudflare, Palo Alto Networks and Zscaler. It then scanned stolen data for AWS keys, Snowflake tokens, and plaintext passwords. And no malware was deployed.
That gap is wider than most security leaders realize: 98% of organizations have a data loss prevention (DLP) program in place, but only 6% have specific resourcesThis is evident from Proofpoint’s 2025 Voice of the CISO report, which surveyed 1,600 CISOs in 16 countries. And 81% of interactive burglaries use legitimate access now instead of malware, according to CrowdStrike’s 2025 Threat Hunting Report. Cloud breaches increased 136% in the first half of 2025.
“Most security teams still classify experience management platforms as ‘survey tools,’ which fall into the same risk tier as a project management app,” Assaf Keren, chief security officer at Qualtrics and former CISO at PayPal, told VentureBeat in a recent interview. “This is a huge miscategorization. These platforms now connect to HRIS, CRM and compensation engines.” Only Qualtrics processes 3.5 billion interactions annuallya figure that the company says has doubled since 2023. Organizations can’t afford to skip steps on input integrity as soon as AI enters the workflow.
VentureBeat has spent several weeks interviewing security leaders who are trying to close this gap. Six control errors emerged in each interview.
Six blind spots between the security stack and the AI engine
1. DLP cannot see unstructured sentiment data leaving via standard API calls
Most DLP policies classify structured personally identifiable information (PII): names, emails, and payment information. Open-text CX responses include salary complaints, health declarations, and criticism from executives. None matches standard PII patterns. When a third-party AI tool retrieves that data, the export looks like a routine API call. The DLP never fires.
2. Zombie API tokens from completed campaigns are still live
An example: Marketing ran a CX campaign six months ago, and the campaign ended. But the OAuth tokens that connect the CX platform to HRIS, CRM, and payment systems have never been revoked. That means each is a lateral movement path that is open.
JPMorgan Chase CISO Patrick Opet identified this risk in his report Open letter April 2025which warns that SaaS integration models create “explicit single-factor trust between systems” through tokens that are “insufficiently secured… vulnerable to theft and reuse.”
3. Public input channels have no bot limitation before data reaches the AI engine
A web app firewall inspects HTTP payloads for a web application, but this coverage does not extend to a Trustpilot review, a Google Maps review, or an open-text survey response that a CX platform records as legitimate input. Fraudulent sentiment flooding these channels is invisible to perimeter controls. VentureBeat asked security leaders and vendors if anyone is covering the integrity of the input channel for public data sources that feed CX AI engines; it turns out the category doesn’t exist yet.
4. Lateral movement from a compromised CX platform is via approved API calls
“Adversaries don’t break in, they log in,” Daniel Bernard, chief business officer at CrowdStrike, told VentureBeat in an exclusive interview. “It’s a valid login. So from a third-party ISV perspective, you have a login page and you have two-factor authentication. What more do you want from us?”
The threat extends to both human and non-human identities. Bernard described the following: “Suddenly there are terabytes of data being exported. It’s non-standard usage. It’s going places this user couldn’t go before.” A security information and event management (SIEM) system sees the authentication succeed. It doesn’t see that change in behavior. Without what Bernard called “software posture management” for CX platforms, the lateral movement is through connections that the security team has already approved.
5. Non-technical users have administrative rights that no one reviews
Marketing, HR, and customer success teams configure CX integrations because they need speed, but the SOC team may never see them. Security must play a facilitating role, says Keren, otherwise teams can ignore it. Any organization that cannot create a current inventory of every CX platform integration and the admin credentials behind it is dealing with shadow admins.
6. Open text feedback enters the database before PII is masked
Employee surveys record complaints about managers by name, salary grievances and health declarations. Customer feedback is just as visible: account information, purchase history, service disputes. None of this hits a structured PII classifier because it arrives as free text. If a breach exposes this, attackers get exposed personal information along the lateral movement path.
Nobody owns this hole
These six failures share a root cause: SaaS security posture management has matured for Salesforce, ServiceNow, and other enterprise platforms. CX platforms have never received the same treatment. No one controls user activity, permissions, or configurations within an experience management platform, and policy enforcement on AI workflows that process that data is nonexistent. When bot-driven inputs or anomalous data exports reach the CX application layer, nothing detects them.
Security teams respond with what they have. Some extend SSPM tools to cover CX platform configurations and permissions. API security gateways provide a different path, inspecting token scopes and data flows between CX platforms and downstream systems. Identity-focused teams apply CASB-like access controls to CX admin accounts.
None of these approaches deliver what CX-layer security actually requires: continuous monitoring of who has access to experience data, real-time insight into misconfigurations before they become lateral paths of movement, and automated protection that enforces policies without waiting for a quarterly review cycle.
The first integration built specifically for that gap connects posture management directly to the CX layer, giving security teams the same coverage over program operations, configurations, and data access that they already expect for Salesforce or ServiceNow. CrowdStrike’s Falcon Shield and the Qualtrics XM Platform are the combination behind it. VentureBeat’s security leaders interviewed said this is the control they’ve manually built – and lost sleep over.
The blast radius security teams are not measuring
Most organizations have mapped out the technical explosion radius. “But not the business boom,” Keren said. When an AI engine triggers a compensation adjustment based on poisoned data, the damage is not a security incident. It’s a bad business decision executed at machine speed. That gap lies between the CISO, the CIO and the business unit owner. Today no one owns it.
“If we use data to make business decisions, that data must be correct,” says Keren.
Run the audit and start with the zombie tokens. That’s where the drift-scale violations start. Start with a 30-day validation period. The AI won’t wait.
