TL;DR:
- The biggest Slack security risks for small businesses are compromised staff accounts, uncontrolled app integrations, and sensitive files shared in channels that are broader than necessary.
- Two-factor authentication on every account, SSO where you can get it, and a regular audit of installed apps cover most of the attack surface.
- Slack’s free and Pro tiers lack some enterprise controls, but the settings that matter most for security are available at all paid tiers.
Slack holds a lot. Customer conversations, internal strategy documents, HR matters, financial information — teams share it all in channels because it’s convenient. That convenience makes Slack a high-value target. A compromised Slack account doesn’t just expose messages; it exposes linked Google Drive files, Notion pages, Jira tickets, and whatever else your team has connected via integrations.
The security risks aren’t exotic. Most Slack compromises in small businesses happen through credential theft, phishing within the workspace, or misconfigured integrations. All of these are addressable without specialised security expertise.
Start With Account Security
Enforce two-factor authentication for everyone. In Slack, Workspace Admins can require 2FA under Workspace Settings → Security → Two-Factor Authentication. Set it to required, not optional. Any team member who hasn’t set up 2FA will be prompted to do so at next login. This single control stops the majority of account takeover attempts.
If your team uses Google Workspace or Microsoft 365, configure Slack to use SSO (Single Sign-On) through your identity provider. This means Slack authentication inherits whatever MFA and conditional access policies you’ve set up centrally. SSO is available on Slack’s Pro tier and above. With SSO enabled, you can optionally force all authentication through your identity provider and disable password-only login.
Audit your members list. In larger or older Slack workspaces, former employees or contractors sometimes retain active accounts. Go to Administration → Manage Members and filter by “Active”. Deactivate accounts that shouldn’t have access. This is also worth adding to your staff offboarding checklist — Slack account deactivation alongside email, cloud storage, and other access.
Check connected sessions. Under your personal account settings, Slack shows all active sessions (devices and browsers where your account is logged in). Team members should periodically review these and end any sessions they don’t recognise. As an admin, you can force workspace-wide session revocation if you suspect a compromise.
Control App Integrations
Slack’s app directory has thousands of integrations, and many ask for broad OAuth permissions. A compromised app integration can read channel messages, post as users, and exfiltrate data without any sign that an account itself was compromised.
Restrict who can install apps. Under Permissions → App Management, set app installation to require admin approval. This stops individual team members from adding integrations you’re unaware of. It adds a small amount of friction for legitimate requests, but the visibility is worth it.
Audit currently installed apps. Go to your workspace settings and review every app that has been installed. For each one, ask:
- Is this app still actively used?
- What permissions did it request? (Check the OAuth scopes)
- Is it from a reputable vendor?
Remove integrations that are no longer in use. Dormant integrations still hold active tokens that could be used if the vendor’s systems were compromised.
Be wary of webhook-based apps. Incoming webhooks allow external services to post to your Slack channels. Check which webhooks exist and what systems they’re connected to. A webhook URL that was posted publicly (in a GitHub commit, a blog post, a leaked credential dump) can be used by anyone to post into your workspace.
Channel and Information Hygiene
Use private channels for sensitive information. Slack’s default is public channels visible to all workspace members. Sensitive topics — HR matters, financial discussions, security incidents, legal issues — should be in private channels with membership limited to those who need access.
Don’t share passwords or credentials in Slack. They feel like messages but they persist and are searchable. Use a shared password manager (1Password Teams, Bitwarden for Business) and share credentials through that instead. If credentials have been shared in Slack historically, rotate them — you don’t know who has searched for and read them.
Check your data retention settings. Under Workspace Settings → Retention & Deletion, you can configure how long messages and files are retained. Slack’s defaults vary by plan. Shorter retention periods mean less historical data is at risk if an account is compromised. However, shorter retention may conflict with your record-keeping obligations under UK employment or financial regulation — check what’s appropriate for your context.
File sharing permissions. By default, anyone with a Slack file link can view the file even if they leave your workspace. Under Settings → Permissions → File Sharing, review who can share files externally and whether public file sharing is appropriate for your workspace.
Protect Against Phishing Within Slack
Attackers who compromise one Slack account often use it to send phishing messages to other team members from a trusted internal contact. A message from a familiar name asking to click a link, approve an urgent payment, or share a password is more convincing than an email from an unknown sender.
Train your team to be suspicious of urgent requests, even from known senders. Establish a norm that sensitive requests (wire transfers, credential sharing, sensitive document access) should always be confirmed via a separate channel — a phone call or in-person check, not a Slack reply.
Don’t click links from DMs without verifying. This applies to links in direct messages even from colleagues, especially if the message is unexpected or the request is unusual.
Review external workspace invitations carefully. Slack allows users to be invited to external organisation workspaces. Attackers create fake company workspaces and invite targets to “collaborate” — once accepted, the attacker can send messages as a workspace member. If you receive a Slack invitation from an unknown organisation, verify it out of band before accepting.
Guest Access and External Sharing
If you use Slack Connect to collaborate with clients or partners, review the external access settings:
- Guest accounts have limited access by default, but check what channels guests can see
- Slack Connect channels are shared between workspaces — both workspace admins can see the channel, but you retain control over your own channels
- Regularly audit which external organisations have active Slack Connect connections
For businesses under UK GDPR, sharing personal data in Slack channels that include external participants (clients, contractors, partners from other organisations) may have data sharing implications. Check whether any such sharing requires a data sharing agreement.
Monitoring and Response
Enable Slack audit logs. Available on Business+ and Enterprise Grid plans, audit logs record admin actions, authentication events, and user activity. If you’re on a lower tier, Slack doesn’t provide this visibility — it’s a genuine limitation of the free and Pro plans.
Know how to revoke access quickly. If a staff member’s account is compromised or they leave unexpectedly, know the steps to deactivate their account immediately (Admin → Manage Members → Deactivate). Also know how to revoke all active sessions workspace-wide if needed (Admin → Security → Session Management).
Set up notifications for admin actions. Some third-party Slack security tools (Nightfall, Cybereason Endpoint, and others) can monitor for sensitive data patterns (credit card numbers, NHS numbers, passwords) in Slack messages and alert on anomalous behaviour.
GDPR and Compliance Notes
Slack’s EU data residency option (available on Business+ and Enterprise Grid) stores message data in EU data centres, which simplifies GDPR compliance for businesses primarily serving EU customers. Check your current data residency setting if this is relevant to you.
Slack’s Data Processing Agreement (DPA) with UK customers covers the UK GDPR requirements for processor relationships. Make sure you’ve accepted the DPA — it’s available from the Slack privacy settings area.
If you use Slack for any HR or disciplinary processes, be aware that employees can submit Subject Access Requests (SARs) for Slack messages involving them. Having clear retention policies and the ability to export relevant messages is important before you need it.
Quick Checklist
- 2FA enforced workspace-wide
- SSO configured if you use Google Workspace or Microsoft 365
- Former employee accounts deactivated
- App installation restricted to admin approval
- Installed apps audited and unused integrations removed
- Sensitive topics in private channels
- No passwords or credentials in messages
- Data retention policy reviewed and configured
- Team aware of internal phishing risk
- External Slack Connect connections reviewed