# A compromise of a single third-party SaaS integration (OAuth app, service principal, delegated credential or integration token held by a vendor), beginning after issuance, is documented as used to access resources in at least three independent customer organizations, by 2027-04-26T12:30Z.

- **Artifact ID:** SO-2026-014
- **Status:** OPEN
- **Public record:** https://record.cybersecurityhq.com/forecasts/so-2026-014
- **Machine-record SHA-256:** `2ff800115bd4d154726276e665dabc80586cd550c84f9fff39435eea7a818f22`

## Complete structured record

```json
{
  "id": "SO-2026-014",
  "class": "EVENT",
  "claim": "A compromise of a single third-party SaaS integration (OAuth app, service principal, delegated credential or integration token held by a vendor), beginning after issuance, is documented as used to access resources in at least three independent customer organizations, by 2027-04-26T12:30Z.",
  "issued": "2026-10-26T12:30:00Z",
  "probability": 0.65,
  "benchmark": 0.58,
  "benchmark_kind": "HISTORICAL_COMPARATOR",
  "benchmark_basis": "Sample rebuilt under the exact rule: Salesloft/Drift (Aug 2025) and Klue (Jun 2026) qualify; Gainsight held (upstream element unestablished); ConnectWise does not qualify at issuance (Microsoft 21 Oct: privileged access \"in several\" cases, not a documented count of three organizations with resource access). Two in 14 months, Poisson 90-day over six months 0.58; sensitivity with Gainsight 0.72. Analyst adjustment +0.07, stated.",
  "adjustment": 0.07,
  "resolution_rule": "YES if a primary source establishes (a) one named upstream integration compromise, (b) resource access in three distinct customer organizations, named or counted on the primary page, (c) upstream compromise began after ISSUED_TS. Tokens without documented access do not resolve YES.",
  "admissibility": "Primary sources only for (a) and (b); Grade A on (a); events after ISSUED_TS; publications to RESOLUTION_TS.",
  "exclusions": null,
  "resolves": "2027-04-26T12:30:00Z",
  "status": "OPEN",
  "outcome_date": null,
  "outcome_basis": null,
  "brier": null,
  "benchmark_brier": null,
  "resolution_source": "EXTERNAL",
  "experimental": false,
  "false_positive_cost": "A YES on a weak victim count would flatter the EVENT card; the access test is the guard.",
  "ledger_hash": "90cb7adf89c670ea",
  "revision_log": [
    "2026-11-06 (CHQ-CORR-2026-033): ledger hash corrected from the shared placeholder c2f1ab40c70d9013 to the per-entry digest 90cb7adf89c670ea, recomputed from the declared serialization of identifier, claim, probability, issued timestamp and resolution rule. Claim, probability, issued timestamp and resolution rule unchanged."
  ],
  "record_links": [
    "CHQ-CORR-2026-033"
  ]
}
```