1. Graham, what was different this year?
The scale, mainly. Five years ago, security at Dreamforce meant a couple of Shield booths and not much else. This year, the Trailblazer Forest ran a hands-on security challenge for developers, and for the first time there was a whole trust and security section in the campground, too. The last two years have also seen the addition of a security keynote, in which Cloud Protection by WithSecure was described as a key partner.
Security has always been the most important non-functional requirement on a Salesforce project, but five years ago perhaps many of Salesforce’s customers didn’t have enough focus or expertise devoted to this topic. Now enterprises know that if Salesforce matters to the business, so does Salesforce security, and this year’s show reflected that.
2. Is Salesforce doing more or something different?
Both. In the past, Salesforce focused on solving security largely on its own. Now they’ve recognized it’s a team game. You can see it in who they’re partnering with: Cloud Protection by WithSecure, CrowdStrike, DigitSec, and Okta, an acknowledgement that identity and endpoint security touch the Salesforce world even when securing those things sits outside Salesforce’s own remit.
Then there’s Security Center and Security Mesh, which starts to look like an actual ecosystem – Salesforce products sitting alongside partner products rather than Salesforce trying to own the whole stack.
3. Has any single moment stuck with you?
I have to go back to the line that Salesforce is a security company. They’ve started giving Security Center Essentials to every customer for free, which is new, and it shows real intent to keep raising the baseline year on year. In a way, we’ve been a Salesforce security company for the past ten years, since we started building on the AppExchange. It’s good to see Salesforce embracing that identity, too. It means we’re all pulling in the same direction.
4. What were people talking about?
The market is now genuinely aware of high-profile breaches, such as ShinyHunters. But awareness of an attack and being ready to survive it are two different things.
What Salesforce and partners like Cloud Protection try to do is bridge that gap. It’s about being really clear on the main threats to Salesforce security that exist today and creating simple technology and processes that customers can use to protect their own unique use cases.
The growth of AI and agents creates complexity, which is the enemy of security. So today the importance of identity and protection of integrations are such important parts of Salesforce security.
5. What about customers?
Our customers tell us that the visibility we bring them is key in mitigating risk for them. For example, how many files are we receiving, which are malicious and what are the trends relating to this – is it from unauthenticated users via email to case or something different?
We are now moving into giving customers visibility of risky identities and integrations, too – areas that customers are demanding to know more about as they increasingly invest and rely on the Salesforce platform.
What is not up for debate is that organizations on Salesforce need to get good security outcomes or they won’t truly derive value from their technology investment.