**64 Percent of Third-Party Apps Access Sensitive Data Unjustly**
**Introduction**
What if two-thirds of the applications connected to your enterprise systems had access to sensitive data they don’t need — and you didn’t know it? According to new research featured in [The Hacker News](https://thehackernews.com/2026/01/new-research-64-of-3rd-party.html), 64% of third-party applications request or retain access to sensitive enterprise data beyond their core functional requirements. That includes data like customer records, employee information, financial data, and proprietary IP.
That’s an alarming number, especially when these third-party tools — often productivity boosters like CRMs, HR platforms, or collaboration tools — are granted access during onboarding and rarely reviewed again. For today’s CISOs, CEOs, and information security teams, this highlights a silent risk vector that bypasses traditional security perimeters.
In this post, we’ll explore why this over-access occurs, how it creates real risk to your organization, and what you can do right now to reduce your exposure. Whether you oversee security strategy or drive digital transformation, the implications are the same: access without limits is access without control.
Let’s unpack the findings, share real-world examples, and lay out a practical framework to regain control of your data.
—
**Why Are So Many Third-Party Apps Overstepping Their Bounds?**
The appeal of third-party apps is their ready-made utility—tools that save development time, improve user experience, and offer targeted functionality. But as organizations increasingly rely on SaaS ecosystems and integrations, many apps are quietly requesting access to more data than they need.
Several key reasons drive this data overreach:
– **Overgenerous permissions by default**: Many applications request broad API scopes like “read/write all files” or “access all user records” during setup—permissions that may never get reviewed.
– **Lack of visibility** into how apps actually use the data they request. Once an app is approved, there’s little transparency unless actively monitored.
– **Speed over scrutiny**: IT teams under pressure to enable tools prioritize productivity over precise access controls.
Here’s a concrete example: A marketing automation platform needs access to customer email lists. But its API request may include permissions to read all customer histories, purchase behavior, and even internal sales notes. If granted, that app is now a data insider—whether it uses the data or not.
According to the report referenced in [The Hacker News](https://thehackernews.com/2026/01/new-research-64-of-3rd-party.html):
– 64% of third-party apps request sensitive data they don’t need.
– 30% retain access even after being inactive for 30+ days.
– Less than 15% of security teams review app permissions quarterly.
This isn’t just a paper risk. It’s an expanding threat surface hidden behind everyday business tools.
**What’s at Stake: The Risks of Unjustified Data Access**
When third-party apps have unrestricted access to sensitive information, they create multiple points of failure—some technical, others human.
Let’s break down the risk profile:
1. **Data leaks and breaches**: If an app with broad data permissions is compromised, it acts as an exfiltration point. Think OAuth token theft or server-side vulnerabilities used to siphon data.
2. **Shadow IT amplification**: Business units independently install tools without involving security. These apps operate outside documented workflows, making them hard to monitor.
3. **Compliance violations**: Excessive access may breach internal policies, sector-specific regulations (like HIPAA or PCI-DSS), or data residency rules. Regulators won’t accept “we didn’t know” as a valid defense.
Back in 2023, a financial services firm experienced a breach when a compromised third-party project management tool exported thousands of client details. The platform had been granted “read all user accounts” access for ease of integration. No one flagged that those rights remained even after the project ended.
To limit exposure, we need to start treating third-party access with the same sobriety we apply to hiring external contractors. You wouldn’t give a one-time advisor a master key to your office — so why do we let temporary or niche apps read our core datasets?
**How to Regain Control Over Third-Party Data Access**
Reducing unjustified third-party access doesn’t require reinventing your tech stack. It starts with visibility, policy, and routine oversight.
Here’s how CISOs and IT leaders can begin to take back control:
– **Audit current integrations**
Create a central inventory of all third-party tools connected to your systems. Identify what data each app can access versus what it actually uses. Tools like CASBs, cloud security posture management (CSPM), or built-in audit logs from providers like Microsoft or Google can help here.
– **Enforce least privilege policies**
Require that app permissions align only with specific job functions. For example, a scheduling tool might need calendar read access but not email content. Set those rules in identity providers or app marketplaces where possible.
– **Automate lifecycle management**
Deactivate or restrict apps that haven’t been used for a defined period (e.g., 30-60 days). Use scripting or automation platforms to regularly flag outdated authorizations.
– **Implement regular reviews**
Schedule quarterly or bi-annual reviews of app access. Involve application owners, not just IT teams. Define clear KPIs: number of apps reviewed, revoked, or adjusted.
– **Use access monitoring tools**
Invest in tools that show how apps interact with data over time. This helps detect “permission creep” where access requests evolve beyond the original scope.
A cybersecurity firm recently implemented a quarterly audit process and discovered that 20% of connected applications hadn’t been used in over three months, yet still had full access to HR and finance data. That audit led to immediate permission revocation and improved overall posture.
—
**Conclusion**
Sensitive data access shouldn’t be a passive grant — it’s a responsibility that must be actively managed. As the research from [The Hacker News](https://thehackernews.com/2026/01/new-research-64-of-3rd-party.html) reveals, 64% of third-party tools are navigating our enterprise systems with more access than they need, and our oversight has not kept pace.
For CISOs, CEOs, and security teams, the path forward is clear. We need more than reactive policies. We need a living discipline of access governance — one that aligns app permissions with actual business needs, monitors their use over time, and prunes unnecessary connections regularly.
Now is the time to ask: Which tools have the keys to your most valuable data — and why?
Start by auditing your connected apps today. Build the practice into your security program. And insist on transparency, from vendors and your own internal teams alike.
The data belongs to your business. Let’s keep it that way.
0 Comments