Is Your Business Automation a Security Risk? What to Check Before You Connect Another App

If you've connected five or six apps together over the past year with Zapier, Make, or something similar, a form that creates a CRM record, a CRM update that pings Slack, an order that triggers an email, when did you last check who or what still has access to any of it?

For most small businesses the honest answer is: never, since the day it was set up. The automation keeps quietly working in the background, nobody revisits the connection, and it becomes one more thing that's just "on" in the business, the same way nobody re-checks the locks on a door they walk through every day.

That's the part of automation that doesn't get talked about much. We write a lot about what automation can do for a business. This post is about the bit that gets skipped: the access, credentials and permissions sitting behind every connected workflow, and what's actually worth checking.

This isn't about hackers in hoodies

The risk with automation security rarely looks like a dramatic break-in. It looks like an ex-employee's Gmail still being connected to a lead-notification workflow eight months after they left. It looks like an API key that was pasted into three different tools in 2024 and never rotated since. It looks like a Zapier account with a weak password and no two-factor authentication, sitting there with read and write access to your customer database, your invoicing system and your email.

None of that requires a sophisticated attacker. It just requires nobody noticing for long enough.

Why connector tools are specifically worth paying attention to

Tools like Zapier and Make work by storing a connection, an API key or OAuth token, that lets one app act on your behalf inside another. That's the whole value of the tool: it saves you from manually copying data between systems. It's also exactly why the connection itself deserves more attention than most businesses give it.

Two-factor authentication on these platforms is often available but optional, not mandatory, which means it only protects you if someone has actively switched it on. Default account security on connector tools tends to assume reasonable behaviour from the user rather than enforcing it, which is a sensible design choice for a workflow tool and a genuine gap if nobody at your business ever reviews the settings.

None of this means Zapier or Make are unsafe to use. We use these tools with clients every week. It means the responsibility for locking the account down properly sits with whoever set it up, and that step gets skipped far more often than it should.

The numbers are more common than most owners expect

The UK government's Cyber Security Breaches Survey 2025 found that 42% of small businesses identified a cyber breach or attack in the past 12 months, an improvement on 49% the year before, but still nearly one in two. For the businesses that were hit, the average cost of the most disruptive incident was £1,600 including cases that cost nothing to resolve, or £3,550 when you look only at the breaches that actually cost money.

The same survey found that only 21% of small businesses review the cyber security risk of their immediate suppliers, and just 11% look any further up the chain than that. An automation platform connecting your systems together is, functionally, a supplier with access to your data. Most businesses simply haven't thought of it that way.

None of this is about automation being riskier than doing things manually. A spreadsheet emailed around on someone's personal laptop has its own problems. It's that automation concentrates access in one place, which makes it more efficient and means a single overlooked setting covers more ground than it would have in a manual process.

Five things worth checking this week

Who still has access, and should they. Pull up every connected app in your Zapier, Make or equivalent account and check the login against your current staff list. Anyone who's left the business, changed roles, or simply isn't using it anymore should be removed, not just forgotten.

Whether two-factor authentication is actually switched on. Not just available, switched on, on the automation platform itself and on every app it connects to that holds customer data.

How old your API keys and connections are. A key that's a year or two old and has never been rotated isn't automatically a problem, but it's worth knowing it exists and when it was last reviewed, rather than discovering it during an incident.

What each connection can actually do. Many integrations default to broader permissions than the workflow needs. A connection that only needs to read new form submissions doesn't need write access to your entire customer list. This one takes a few minutes per workflow and it's the single highest-value check on this list.

Whether anyone owns this. Not a job title, an actual person who's responsible for reviewing the automation stack every quarter or so. Automation that nobody owns is automation nobody is watching, and that's when small issues sit unnoticed for months.

What this means in practice

None of this requires ripping out your automations or being nervous about using Zapier or Make. It means treating the connected-app stack the way you'd treat a set of keys to the building: worth knowing who has a copy, worth changing the locks when someone leaves, and worth an occasional check that nothing's been left propped open.

When we build or review automation for clients at Digital Hand, access and ownership are part of the handover, not an afterthought bolted on at the end, because an automation that nobody can account for a year later isn't actually saving anyone time. If you want a second pair of eyes on what's currently connected to your business, or you're planning a new automation and want security built in from the start, you can book a free 15-minute consultation and we'll talk through what's actually worth checking.