Securing Salesforce Archives - Cloud Protection for Salesforce by WithSecure™

Credential compromise is one of the oldest tricks in cybercrime, and still the most successful if looking at the statistics. In 2025, stolen or reused credentials accounted for 22% of all breaches globally according to the Verizon Data Breach Investigations Report. The IBM Cost of a Data Breach Report 2025 found that these incidents cost organizations an average of USD 4.81 million and take 292 days to contain, which is longer than any other breach vector.

Salesforce is not immune. WithSecure telemetry revealed an average of 900 malicious URLs per Salesforce org (not environment, but a single org) last year, many tied to phishing and credential-stealing attempts within trusted workflows.

The reason for this trend is simple, and already an unfortunate cliche in cybersecurity: attackers don’t need to break in if they can they log in. Once they log into Salesforce, they act from within the most trusted, connected business platform that hoards a plethora of valuable data.

Once attackers get in, compromise rarely stays neatly contained. What begins as one exposed login can quickly evolve into a chain of trust abuse between identities: from identity to identity, not just system to system. The attacker uses one foothold to harvest information, impersonate colleagues, and move laterally across accounts and integrations. Each new identity they compromise widens the breach.

How credential compromise unfolds in Salesforce

Salesforce identities are everywhere: employees, administrators, contractors, suppliers, customers, and integrated systems all authenticate into the same environment. Each of those identities – internal or external – can become a pathway for compromise.

Credential compromise often starts far away from Salesforce itself. An employee reuses a password on a personal SaaS account. A partner’s login credentials are leaked in a breach on a third-party portal. Those credentials are then tested through automated credential-stuffing attacks until one works.

The Jira credential breach in 2025 followed this exact pattern: attackers reused valid credentials exposed in previous incidents, logged in legitimately, and harvested data at scale. In Salesforce, the same playbook applies. When a valid user account is compromised, every API, integration, and connected app that trusts it becomes part of the attack surface.

This is how lateral movement happens inside modern SaaS environments. A compromised user can not only access data, but inherit trust. With that trust, they can authorize connected apps, generate OAuth tokens, or trigger automations that act on their behalf. Without early detection, this chain reaction can silently cascade through Salesforce and any system linked to it.

The unseen attack surface: community and external users

Salesforce Experience Cloud portals enable partners, suppliers, and customers to collaborate and share data directly. But these external users often fall outside the reach of corporate IAM or security policies.

They might authenticate with separate credentials, use weak passwords, or reuse them across systems. Unlike employees, they’re rarely covered by single sign-on (SSO) or strong MFA enforcement. Their login activity may never appear in enterprise identity logs.

This is where attackers find leverage.
A compromised community account can impersonate a partner, modify cases, download attachments, or trigger automations that connect deeper into the environment. From there, they can pivot laterally – moving from an overlooked external identity to privileged internal accounts through trust and integrations.

Salesforce’s strength as a connected ecosystem is also what makes it a target. Each connection represents an identity, and every identity is a potential entry point.

The impact of a single compromised identity

When an attacker gains valid credentials to access Salesforce, they inherit trust, which has consequences.

Data exposure

Salesforce stores some of the most sensitive data in the enterprise: customer records, sensitive business details in case attachments, contracts, and financial details. A compromised account can access and export that data quietly.

Lateral movement

A single valid login can set off a chain reaction. What begins with one compromised account can expand identity to identity: a community or partner user might impersonate internal staff, authorize connected apps, or trigger automations that open new paths of access. This interconnectedness is what enables lateral movement: spreading through legitimate trust rather than exploits, and chaining identities across systems until the initial breach becomes a multi-platform compromise.

Supply chain compromise

Salesforce integrations connect to ERP, HR, and various operational, collaboration and business systems. Once attackers gain access, they may pivot laterally across systems, turning one compromised login into a multi-platform breach.

Fraud and manipulation

Attackers can exploit compromised accounts to submit fake orders, modify invoices, or manipulate workflows. In one observed case, attackers used compromised community logins to insert fraudulent bank details into legitimate customer records.

Impersonation and social engineering

Using valid Salesforce identities, attackers can impersonate employees or partners to send credible requests, distribute phishing links, or gain further access through highly convincing social engineering.

Malware and phishing delivery

Attackers increasingly use Salesforce itself to deliver malware or phishing (we’ve seen a 20 fold increase in 2025 vs. 2024) embedding malicious links in case files or QR codes in attachments. Because it all happens within a trusted domain, users are far more likely to click.

These risks mirror patterns seen in real incidents: credential compromise leading to data theft, fraud, and abuse of trust across connected cloud ecosystems.

Why credential compromise is hard to detect

There are several practical steps you can take to harden your Salesforce environment against identity risks. But it’s important to keep in mind that traditional identity controls like MFA and SSO while essential, are insufficient alone.

They verify how a user logs in, not whether that user’s credentials are already exposed elsewhere.

Salesforce doesn’t monitor for leaked credentials. IAM and XDR tools don’t have visibility into community Salesforce accounts. Identity breach monitoring tools operate externally, disconnected from Salesforce’s user directory.

That leaves a blind zone between most global breach intelligence tools and the identities that live inside Salesforce.

When attackers exploit that space, they gain legitimate access with no alarms triggered.

Learn about credential stuffing attacks on Salesforce

Read our blog

Introducing Identity Protection in WithSecure Cloud Protection for Salesforce

Identity Protection capability in WithSecure Cloud Protection for Salesforce was created to eliminate the unseen credential exposure – and to help defenders mitigate credential exposure risks before the attackers abuse them.

The feature continuously monitors Salesforce user accounts, covering internal and community users, against threat intelligence, including the latest dark-web breach intelligence. It identifies credentials that appear in known or emerging data leaks and flags those users directly inside Salesforce for rapid response.

If a user’s credentials appear in a known data leak, the system flags it with detailed breach and severity information.

You’ll know:
- Which users were exposed – and when
- The breach source and password format
- How severe the risk is and what to do next
Detailed breach history (severity, breach details, and metadata) helps prioritize response actions

Scans run automatically, ensuring organizations are alerted when a user’s credentials are found in breach data. Each detection is logged for audit and compliance, supporting compliance frameworks besides incident response.

Identity Protection operates entirely within Salesforce, as a protection layer in the WithSecure Cloud Protection for Salesforce app. Identity Protection capability complements MFA, SSO, and Event Monitoring by adding what those tools can’t: continuous awareness of credential exposure.

You can see which Salesforce identities are at risk at a glance

In Salesforce, a single compromised login can open access to customer data, business processes, and integrated systems.

Identity Protection turns that risk into an early-warning system by detecting exposed credentials before they can be used against you. Identity Protection protects your business from credential-based fraud, impersonation, and supply-chain abuse that can start with a single compromised user account.

Learn more about Identity Protection

Explore the capability

Use cases and risk scenarios

Credential compromise risks – and mitigating them – can be realized in many ways across different Salesforce environments. It can look like the examples below.

Financial services

A supplier’s community account credentials were leaked in a third-party retail breach. Attackers reused them to submit fraudulent requests and access contract data. Identity Protection detected the exposure before the next login attempt, allowing admins to reset credentials and prevent financial loss.

Technology company

An engineer reused their corporate email and password on a personal code repository. When that repository was breached, the same credentials appeared in breach data. Identity Protection flagged the user during a routine scan, preventing a potential lateral move to Salesforce environments containing intellectual property.

Public sector organization

A consultant’s partner-portal account appeared in a dark-web credential dump. Identity Protection identified the compromised identity and notified administrators immediately. The account was suspended, and access logs were reviewed before any data exposure occurred.

Across all these examples, the outcome is the same: detection before exploitation.

Strategic impact: stopping breaches at their first step

Every major breach begins with an initial access event – and more often than not, that access is legitimate. As highlighted at the Dreamforce 2025 Security Keynote, attackers now move “identity to identity” rather than the traditional “server to server.” Identity Protection in WithSecure Cloud Protection for Salesforce breaks that chain early by detecting exposed credentials before attackers can pivot laterally through trusted accounts.

By identifying compromised users before attackers act, Identity Protection transforms the early phase of the attack chain from silence into signal. It’s a visibility layer that maps real-world breach intelligence directly onto the people and user accounts that define your Salesforce environment.

The result is shorter dwell time, faster response, and demonstrable reduction in identity-related risk.

Identity Protection gives security teams something they’ve never had in Salesforce before: the ability to see and act on credential exposure before it turns into a breach.

Learn more about early detection of credential compromises

Explore Identity Protection
Even well-protected Salesforce environments face a real identity risk: credential stuffing.

Your environment can get breached not because your defenses failed, but because someone reused their password somewhere else.

Credential stuffing turns someone else’s breach into your Salesforce problem.

Real protection is knowing which credentials are already compromised before attackers use them.

What credential stuffing means inside Salesforce

Credential stuffing is simple. Attackers use stolen username and password pairs from previous data breaches and test them across other platforms, including Salesforce, hoping they still work. They may use bots to make job more efficient.

Because many users reuse passwords, it works more often than anyone admits.

Cloudflare found that 41% of successful logins across web services involved already compromised passwords (Cloudflare).

Even at a 0.1% success rate, testing one million stolen pairs can still yield 1,000 valid logins.

This matters to you if your users, including your partners, log into Salesforce. (Worth reading again.)

Why Salesforce is uniquely at risk

Credential stuffing is dangerous anywhere, but in Salesforce it hits harder because the platform connects people, data, systems and automation.

Internal users

Corporate credentials often overlap with personal ones. A password leaked from a consumer service can still unlock Salesforce.

Even with MFA, attackers use push-bombing or token replay to bypass weak implementations.
Once inside, they can export customer lists, modify records, or plant phishing links inside trusted workflows.

Community users (Salesforce Experience Cloud)

Partners, suppliers, and customers connect through portals built on Salesforce Experience Cloud using Salesforce community user accounts. Their accounts often fall outside corporate Identity and Access Management controls and rely on weak or reused credentials from personal or small-business sites – a habit attackers know and exploit.

Many of these accounts may already be compromised: users can be logging in with credentials that appeared in past breaches, giving attackers a legitimate way in.

A single compromised partner login can expose customer data, initiate fraudulent orders, or abuse OAuth connections to integrated apps.

The recycled credential paradox

Credential reuse isn’t just that people are lazy, but a reality that comes with scale.
People manage dozens of accounts and reuse passwords to remember them. In reality, 44% of employees reuse passwords for both personal and work accounts (Cloudflare).

IBM’s Cost of a Data Breach Report 2025 shows breaches involving stolen or compromised credentials cost USD 4.81 million on average and take 292 days to contain, which is the longest of any vector (IBM).

Reused passwords link personal exposure to corporate systems. One password, used twice, can open your Salesforce org.

Despite identity risks such as credential compromises having been such a longstanding security problem, there are blind spots that have not been mitigated by widely adopted security tools so far.

Salesforce community users present one of such blind spots. The main risks stem from the following:
- Weak password hygiene is the norm for external users: Partner users often don’t follow the same password policies as internal employees.
- Password reuse is even more common in partner portals: Lack of oversight means many reuse passwords from personal or previous accounts.
- High likelihood of credential compromise: External users may be logging into your Salesforce with credentials exposed in past data breaches.
The external users may not care, and they shouldn’t be expected to be responsible of your environments identity security either. As a Salesforce customer, you carry the full risk – whether it be data leakage or financial fraud. A compromised community user account is your problem to solve.

Learn more about credential compromise monitoring on Salesforce

Minimize credential breach risk with Identity Protection

Does MFA stop credential stuffing in Salesforce?

MFA greatly reduces successful credential stuffing but does not remove credential-based risk. Attackers bypass MFA through fatigue, AiTM, token theft, and connected-app/OAuth abuse. To stay protected you need layered controls: phishing-resistant MFA, strict OAuth/token hygiene, behavioral monitoring (e.g. Event Monitoring), and breach-intelligence that finds exposed credentials before the attacker logs in.

Why traditional defenses miss it

Credential stuffing is not random guessing. It is automated logins with leaked, valid credentials. Your defenses must be different to match that.

Credential stuffing is automation with valid credentials.
Attackers use breach lists and bots to try known username/password pairs across sites. Brute-force blockers do not stop valid logins and attackers who already have the password. A successful login might be suspicious.

MFA reduces risk but gaps remain.
MFA blocks many password-only attacks, but push-bombing, social engineering, SIM swap, token theft, and OAuth approvals can bypass weak implementations.

Detection tools rarely see exposure before login.
Most controls act at authentication time and do not ingest breach feeds by default. Without exposure feeds, you often only spot abuse after the attacker is inside.

Failed-login alerts are unreliable.
Credential stuffing can produce little failed-login noise because attackers focus on credentials that are valid. You can’t rely on failed-login alerts alone, because attackers use what already works.

What credential stuffing looks like in Salesforce

Typical signals of credential stuffing on Salesforce include:
- Successful logins from unusual IPs or countries
- Sudden bursts of activity across many accounts
- Quiet data exports or API queries
- Fraudulent actions in Experience Cloud portals (fake orders, edited invoices)
- Abnormal OAuth authorizations or token use
Here’s an example: A partner reused their password from an old forum. Attackers acquired those login details, and logged into the partner portal with them, performed fraudulent actions in critical business processes (think placing fake orders and manipulating ones already there), injected phishing links into business processes, exported files and sensitive data – without triggering login-failure alerts.

Lateral movement in Salesforce: a risk scenario

The Dreamforce keynote put it plainly: attackers no longer treat identity as a single target — they treat it as a route. Once an attacker compromises a partner or community account through credential stuffing, that account becomes a source of reconnaissance and a social-engineering platform. From there the attack moves from identity to identity. The attacker uses what they learn to phish an internal employee, create or abuse OAuth tokens, or install connected apps, where each step widens the “blast radius”. The defensive response must treat every account as a potential pivot point, not only the obvious admin seats.

This is how a lateral movement can spiral in Salesforce:
1. Initial foothold: An attacker obtains credentials from a public breach or phishing campaign targeting a partner or contractor (accounts often lack SSO/MFA and reuse passwords).
2. Legitimate access: The attacker logs in to Experience Cloud or another Salesforce entry point; an activity that looks “normal” to network/endpoint tools.
3. Credential harvesting & reconnaissance: Inside the org the attacker views org metadata, shared files, user lists, connected app configurations, and org roles, which is key information used to tailor follow-up attacks.
4. Lateral movement via identity: The attacker crafts targeted phishing or social engineering (internal messages, file attachments, case comments) to compromise an internal user. Alternatively, they create or abuse OAuth tokens / connected apps to persist access beyond a password reset.
5. Automation & scale: Malicious actors can abuse Agentforce-style workflows or API automations to execute actions at scale, exfiltrate data, or trigger business-process fraud while blending into routine activity.
6. Outcome: Data exfiltration, fraud, or long-term persistent access across cloud systems.
How to defend your Salesforce environment

Stopping credential stuffing isn’t about blocking logins. It’s about seeing risk early and responding fast.
1. See credential exposure before attackers do
  Monitor your Salesforce user population, from employees and admins to Experience Cloud/community users, against breach-intelligence feeds. Identity Protection in WithSecure Cloud Protection for Salesforce scans user identifiers inside Salesforce and flags exposures so you can prioritize remediation. Note: detection does not automatically disable accounts, but visibility is the first step in response and investigation.
2. Strengthen access hygiene
  Enforce MFA and SSO consistently, retire unused accounts, and require admin approval for connected apps. Limit OAuth scopes, enable refresh-token rotation, and assign a unique, least-privilege integration user to each app. For external/community users, require SSO or force a Salesforce password reset when you detect exposure. These steps reduce the attack surface for credential-reuse and OAuth abuse.
3. Monitor and respond (correlate telemetry with exposure intelligence)
  Feed Event Monitoring and Shield logs into your SOC so you can correlate exposure alerts with post-login behavior (e.g. mass exports, unusual token refreshes, new geographies). When exposure plus suspicious activity appear, you can take appropriate actions such as lock the account, revoke tokens, force a reset, and notify your incident team.
Reality check: exposure visibility is critical but not sufficient alone. Treat credential-exposure scanning as an early-warning signal and combine it with phishing-resistant MFA, OAuth/token hygiene, strict connected-app policies, segmentation, and automated revocation to prevent account takeover.

The edge of your Salesforce environment is identity.

Attackers exploit human behavior. Identity is the edge of your Salesforce environment, and visibility is the baseline of your defenses.

Identity Protection in WithSecure Cloud Protection for Salesforce delivers visibility directly in Salesforce, detecting exposed Salesforce user credentials before attackers use them.

Learn more about Identity Protection

Explore the capability
Phishing awareness training has come a long way – and most in security agree it’s critical. But here’s the tough question:

Does your phishing training reflect today’s reality, or just inboxes?

Let’s face it: security training has made users more alert to suspicious emails. That’s a win. But attackers aren’t staying in email anymore. Phishing has become an innovation engine driven by AI, deception layers, and delivery tricks like QR codes, callback scams, and embedded threats inside trusted files.

Attackers are moving into platforms like Salesforce – where the signals are different, and the built-in defenses are limited.

That’s where things break down.

Even well-trained users make mistakes — especially outside email

In Salesforce, phishing links can hide in shared files, QR codes, or support portal messages – even agentic AI / Agentforce workflows. Users encounter them in places they don’t expect – and on devices like mobile phones that often sit outside security controls.

And attackers know how to make these threats look harmless. Phishing links can be buried in mundane PDFs – making them harder to catch at a glance. For users, these files look routine. For attackers, they’re a perfect delivery vehicle.

Add to that the daily pressure most users face: all the jumping between workflows, responding to customers, making decisions fast. Distraction, hurry, and multitasking aren’t rare exceptions. They’re the norm. And even well-trained users slip.

Don’t blame users. Protect them.

When a user clicks a phishing link in Salesforce, it’s easy to look for human error. But the better question is: Could we have prevented it?

The truth is, phishing training alone was never meant to carry the entire burden. We don’t expect users to be malware analysts. Why expect them to be phishing detectives?

Instead of pointing fingers, we need to back our people up with technology that catches what they can’t. That’s where solutions like WithSecure Cloud Protection for Salesforce step in. It scans files, links, and QR codes at the point of upload or interaction, stopping threats before users can act on them. Prevention is always cheaper than remediation.

New threats demand new defenses

Attackers are evolving fast – and they’re lowering the bar to entry. Today, we’re seeing:
- AI-powered phishing campaigns with polished, branded content and natural-sounding language
- Phishing-as-a-Service kits that provide complete end-to-end attack infrastructure – from email templates and fake login pages to real-time credential harvesting
These campaigns don’t need a genius behind them. They’re scalable, convincing, and effective. And platforms like Salesforce – which blend collaboration, automation, and trust – are attractive targets.

The Salesforce platform is already being exploited. Many enterprises have seen phishing, malware, or social engineering threats move through Salesforce channels. This is acknowledged by Salesforce.

Even MFA has its limits. Attackers have found plenty of ways around it. Not all MFA is phishing-resistant, and not all implementations hold up. It’s just another reminder: layered defenses need to meet users where they work.

Phishing is an industry and evolving fast

Phishing is getting easier to launch and harder to detect.

With AI-written lures, fake branding, and phishing kits sold as-a-service, even low-skill attackers can launch convincing, targeted campaigns in minutes.
And now, it’s moving into business-critical platforms like Salesforce, where trust and the element of surprise make users even more vulnerable.

Agentic AI use cases amplify the risks, with the potential for the threats to spread at machine speed.

Phishing isn’t staying in the inbox. As AI-driven use cases like Agentforce reshape how users interact in Salesforce, attackers are finding new ways in. They’re embedding malicious links inside trusted workflows like support chats, where even well-trained users can be caught off guard.

Learn more about phishing threats in Agentforce workflows

Why traditional tools don’t cut it

Endpoint protection (EPP) is essential. But it’s not enough.

Salesforce is a cloud-first platform. Files and links often enter via chats, emails, forms, APIs, community portals, or direct user uploads without ever touching a protected device. And Salesforce doesn’t natively scan content for threats.

If you rely solely on EPP, here’s what you miss:
- No inspection at upload: Files and links sit in Salesforce records and attachments, looking harmless
- No scanning in real time: Threats go live the moment someone clicks, shares, or automates with them
- No visibility: You won’t know what’s spreading inside your environment until damage is done
You wouldn’t trust EPP to secure your email – why treat Salesforce any differently?
Just like we protect inboxes with specialized email security, we need to extend that same layered defense to Salesforce.

Find out why endpoint security is not enough for securing attacks targeting Salesforce

Protecting users (and your reputation) pays off

Security shouldn’t just catch mistakes. It should create a buffer between human behavior and business risk.

WithSecure Cloud Protection for Salesforce is that buffer – detecting threats like phishing links, malware files, and malicious QR codes the moment they enter your environment. It integrates natively with Salesforce, so your users stay protected without changing how they work.

It’s a way to maximize your existing security investments without adding more complexity. And it helps stop threats before they spread to customers, partners, or AI workflows.

The smart move — for your business and your career

When someone takes the initiative to strengthen Salesforce security, that sends a clear message – to attackers, to leadership, and to your peers.

That’s proactive security.

It’s not just smart for the business. It signals maturity and foresight in your role. Whether you’re in security, Salesforce and CRM team, IT, or ops – being the one to champion protections where they’re needed most? That’s leadership. And it doesn’t go unnoticed.

What to do next
- Continue phishing training. It matters.
- But don’t rely on training alone, as human error will always exist.
- Add phishing protection where it’s missing: inside Salesforce.
- Treat Salesforce like a cloud-based endpoint. Secure it the way you would email.
- Encourage proactive security culture, and avoid blame culture.
Let your users focus on work instead of sweating about every threat.

Protect your Salesforce users where training can’t.
Extend your protection beyond email with WithSecure Cloud Protection for Salesforce – real-time scanning for links, files, QR codes and identity risks inside your trusted workflows.

See how WithSecure Cloud Protection for Salesforce helps you protect your users
Salesforce threat protection is no longer optional as attackers pivot to business workflows. In 2025, Salesforce has become one of the most targeted enterprise platforms. Nearly forty major companies, from Google to global insurers, have been listed on leak sites tied to breaches in their Salesforce environments. The business value and sensitive data it holds make Salesforce an exceptionally attractive target.

How WithSecure Cloud Protection secures your Salesforce environment in real-time

Traditional security tools stop where Salesforce begins.
Email filters scan inboxes.
Endpoint agents guard devices.
But Salesforce, where customer data, workflows, AI agents and automation meet, often sits outside that protection.

Salesforce is your operational headquarters, like a high-value command center where teams, partners, and AI agents move data in and out. Most security tools guard the perimeter far away from this center, not the place where operations happen.

Attackers know this. They move through trusted users, shared files, and automated processes that traditional security never sees.

WithSecure Cloud Protection for Salesforce brings enterprise-grade threat detection inside the platform. It scans files, URLs, QR codes, and identities in real time, stopping threats before they spread and making risks visible through unified analytics.

The native app secures Salesforce from the inside out instead of just guarding the surroundings.

The shared responsibility gap

Salesforce provides the energy grid, think of a stable power source that keeps the mission running. But it’s every organization’s job to protect what’s powered by it: the systems, people, and processes that rely on that energy. This is the essence of the shared responsibility model.

Protecting what your users upload, click, or automate inside that environment is your responsibility. Salesforce secures the cloud platform infrastructure; organizations must secure the activity and data within it. That’s where traditional “outside-in” tools have little to no reach.

Here’s what Salesforce security risks look like in practice

Attackers don’t necessarily smash windows, doors, and walls. They blend into routine traffic, tailgate through side doors, abuse trusted connections, or use borrowed keycards. Here’s how those break-ins happen inside Salesforce:
- A malicious attachment arrives through email-to-case and is uploaded into Salesforce without being scanned. When processed, an infostealer quietly harvests stored credentials and session cookies. The attacker uses those tokens to pivot, access reports and integrations, and quietly exfiltrate customer data over weeks before detection.
- A contractor account falls outside corporate IAM. Its password, reused on another service, appears in a third-party data breach. Attackers log in through Salesforce’s legitimate interface and start extracting customer data via reports and connected apps.
- A malicious URL or QR code is posted though a chat, and stored inside a case. It leads to a convincing fake login page; a user or agent follows the link and submits credentials. Those credentials are then used to access business processes and export customer data and trade secrets, which leads to extortion and loss of customer trust.
When risks unfold inside Salesforce, they are difficult to detect with external tools

These risk scenario examples show how mundane workflows — like email-to-case — become attack vectors when attachments are weaponized and processed inside Salesforce without inspection inside the platform. WithSecure Cloud Protection for Salesforce closes that gap with real-time, native protection where those actions happen.

When a breach occurs inside Salesforce, visibility dictates recovery time. Without in-platform detection and telemetry, organizations can spend weeks tracing infected records, workflows, and automations. WithSecure Cloud Protection reduces that window to hours, preventing prolonged downtime and preserving compliance readiness. In regulated sectors, this level of audit-ready visibility can be the difference between a contained incident and a weeks-long investigation.

Figure 1: Email-to-case is a common entry point: weaponized attachments arrive as routine tickets, get processed in Salesforce, and can lead to operational disruption or data exfiltration without in-platform inspection.

Find out why endpoint security is not enough to mitigate content-borne threats

File protection — next-generation analysis inside Salesforce

Files are one of the most common delivery routes for threats. According to Verizon, ransomware is present in 44% of all breaches and it’s been on the rise recently. In Salesforce, file-based threats enter through forms, email-to-case, chats, user uploads or APIs, and often bypass traditional controls.

File Protection in WithSecure Cloud Protection for Salesforce scans every file in Salesforce at upload, download, on-demand, and in scheduled mass sweeps. It blocks malware, ransomware, and hidden cyber threats before they reach your users.

Every file is checked before it can do harm

If malware is a routine-looking harmful parcel that the threat actors aim to slip into the building, File Protection is the building’s baggage scanner that ensures every parcel that comes through the lobby is x-rayed before anyone can open it.

File Protection brings layered analysis directly into Salesforce:
1. Multi-engine malware detection checks every upload and download using AV-TEST–certified engines.
2. AI and heuristic analysis identifies suspicious or ransomware-like behavior missed by signatures.
3. Cloud sandboxing safely executes doubtful files to reveal zero-day and evasive threats.
4. Global threat intelligence enhances detection using telemetry from millions of daily analyses in the WithSecure™ Security Cloud.
Each file is fingerprinted, compared against known verdicts, and analyzed in the sandbox when needed. Only anonymized samples are processed by the threat analysis service.

Figure 2: End-user messages can be customized, here’s an example “harmful content blocked” notification.

Figure 2: The app replaces the removed malicious file with a text file so users can’t access it.

Extra layers for evasive content
- Detects hidden malicious URLs and QR codes inside files.
- Identifies spoofed extensions (for example, “.jpg.exe”).
- Blocks password-protected archives and risky file types such as executables and scripts.
For a complete breakdown of detection layers, platform coverage, and policy configuration options, visit the full feature list.

See a list of all the features and sub-features

Proven real-time protection

Malicious files are intercepted at upload or download, before they reach users or automations.
All detections are stored for 24 months, including hash, verdict, and timestamp. This creates an auditable record trail of every event.

WithSecure’s detection engine, also powering the company’s enterprise endpoint products, earned AV-TEST’s Best Protection Award 2024 after a full year of flawless detection results across more than 90,000 malware samples.
That same engine protects files in Salesforce environments, providing independently verified detection accuracy against both known and emerging threats.

Figure 4: File Protection admin view showing scanning and policy controls.

Granular control where it counts – practical examples

Every organization handles files differently. WithSecure Cloud Protection for Salesforce lets admins tailor policies down to object level — defining what gets scanned, when, and how.

From the File Protection settings, you can:
- Decide whether to scan uploads, downloads, or both.
- Set different rules for Salesforce Files, Attachments, and Content Libraries.
- Customize actions for detections (block, remove, or quarantine).
- Manage exclusions for trusted workflows, test environments, or file types.
These granular controls make WithSecure Cloud Protection for Salesforce adaptable to diverse security and performance requirements from highly regulated environments to fast-moving teams.

Best practice: Enable scanning for both Salesforce Files and Attachments, activate Advanced Threat Analysis, and apply stricter policies for archives and Office files.

This is thorough protection applied where files actually live — inside Salesforce.

Figure 5: File Protection settings view showing customizable scanning and policy options.

Find out more about File Protection for Salesforce

URL and QR protection — stopping phishing in its new form

Phishing doesn’t end in the inbox. Links and QR codes now move through Salesforce records, case comments, and shared documents — unseen by external tools.

Phishing links are like forged orders that seem legitimate, but trick users into acting for the benefit of the threat actors.

URL Protection in WithSecure Cloud Protection for Salesforce scans embedded links for threats in real time.

Stop phishing attacks that hide in Salesforce

URL Protection inspects links at post and at click, across standard and custom fields and objects.
It decodes shortlinks, analyzes redirect chains, classifies domains, and scans QR codes embedded in files.

Advanced threat analysis and global threat intelligence detect newly registered or obfuscated domains before they become active threats. Even multi-layered tactics like malicious short links behind QR codes are detected.

Time-delayed or redirected phishing links are stopped inside Salesforce, before users or agents can act on them.

Users see a clear “phishing blocked” message; admins see who posted or clicked and where.

Figure 6: URL events overview for the list of fresh URL detections

Figure 7: Detailed view showing blocked phishing link.

Learn more about stopping phishing attacks with URL Protection

Content filtering — keeping Salesforce professional

Not every link is malicious; some simply don’t belong in your Salesforce space.

Content filtering is the office policy board, protecting the integrity of the environment. It keeps the hallways clear of scams and inappropriate material, maintaining a professional and comfortable environment for everyone who walks in.

Keep Salesforce clean, compliant, and on-brand

Content Filtering prevents inappropriate or policy-violating material, like gambling, scams, or illegal content, from entering Salesforce environments and communities.

Powered by domain intelligence, it blocks disallowed categories as users post or upload.
Admins select which categories or top-level domains to restrict, applying consistent rules across the instance.

It maintains a trusted workspace and reduces compliance exposure, especially in environments with external contributors.

Figure 8: Content Filtering configuration screen for disallowed domains and categories like spam or hacking.

Learn more about content filtering for Salesforce

Identity protection — catching compromise before access

If content threats are about what gets in, access control is about who is allowed in. Majority of breaches are attributed to identity compromises. These breaches start with a seemingly valid login. In Salesforce, attackers can use valid credentials stolen elsewhere.

Continuing on the operations center metaphor, a contractor’s stolen badge opens a side gate and the threat actor walks straight into restricted systems, extracting sensitive data as part of seemingly normal activity.

Catch stolen credentials before attackers use them

Identity Protection in WithSecure Cloud Protection for Salesforce detects compromised Salesforce user credentials before attackers use them.

Identity Protection continuously checks Salesforce accounts against verified breach intelligence. It covers internal and external users, scanning weekly and tracking 12 months of history. Each match shows where and when the breach occurred and how credentials were exposed.

It’s like your badge control system that verifies who walks in and flags stolen passes before they’re used to access restricted areas.

Admins can reset passwords, revoke sessions, or enforce MFA the moment an exposure is found.
All activity is logged for audits and compliance.

This early warning turns credential reuse from a hidden risk to a visible, fixable one.

Figure 9: Breach detail view showing exposed partner account and breach metadata.

Read more about early detection of credential compromises in Salesforce

Secure AI adoption — keeping Salesforce fast and safe

Agentic AI and automation drives efficiency, but with efficiency comes risk.
Agentforce agents act faster than humans, spreading both value and potential compromise.

As Agentforce brings autonomous workflows into Salesforce, you can think of it as a coordinated fleet of smart systems operating across a secure facility. The same rules apply as to humans. WithSecure Cloud Protection for Agentforce supports with this.

Extend the same real-time protection to your autonomous AI agents

WithSecure Cloud Protection for Agentforce add-on extends real-time scanning to every non-human action.

URLs shared to an AI agent, links shared by an AI agent, or records updated by AI agents are all inspected .

Events are logged with context and retention similarly as user action logs.

Automation runs at full speed under the same protection boundaries as human users.
Security scales with business, not against it.

Learn more about Agentforce security

Analytics and visibility — connecting every signal

Detection without visibility is guesswork.

Analytics acts as the building’s control room. Every door entry, camera feed, and alarm signal is logged, giving you a complete picture of what happened, when, and who was involved.

Trace what happened, where, and who was involved

In WithSecure Cloud Protection for Salesforce every file, link, or identity scan feeds into unified analytics inside Salesforce.

The Salesforce-native app supports multi-org environments, giving security teams visibility and consistent policy enforcement across all Salesforce instances.

Protection Status dashboards show detection trends and overall health at a glance.
Reports pivot by user, object, or threat type. Logs keep two years of event data and can export to a SIEM for broader analysis.

Security teams can trace incidents end to end, identify recurring attack sources, and refine policies with evidence.

Visibility closes the loop between detection, prevention and improvement. It is the critical factor that can turn a compliance nightmare around.

Figure 10: Protection Status dashboard summarizing detections across layers.

Learn more about security visibility and analytics

Enterprise-grade and audit-ready protection for Salesforce

WithSecure Cloud Protection for Salesforce brings enterprise-grade defense inside the platform itself.
It applies the same layered logic proven in modern endpoint protection – multi-engine detection, sandboxing, machine learning, and behavioral analysis – but runs inside Salesforce.

Unlike API-based or CASB security solutions, Cloud Protection operates within Salesforce’s own trust boundaries.

There are no external dashboards or delayed scans, and every inspection happens in real time, with minimized data traffic outside the platform.

WithSecure Cloud Protection for Salesforce is designed for organizations that live under scrutiny. Every detection, verdict, and policy action is logged and stored for 24 months, creating a verifiable audit trail of what happened, when, and how it was resolved.

That visibility gives compliance and risk teams the documentation they need for internal reviews, regulatory audits, and incident investigations – saving time, money and trouble.

It’s also built on independently verified controls.

Certified under ISAE 3000 Type 2 (European equivalent to SOC 2 Type 2) and ISO 27001, and aligned with frameworks like NIS2, DORA, and GDPR, Cloud Protection meets the same standards expected of enterprise and government-grade environments.

Options for controlled data residency – across the EU, US, Japan, Singapore, and Australia – keep analysis and logs within your chosen jurisdiction, satisfying both privacy and compliance requirements by design.

Already trusted by leading Fortune 500 enterprises and public-sector organizations, WithSecure Cloud Protection for Salesforce secures Salesforce environments of every scale – from regional deployments to multi-org global operations.

Figure 11: Admin view showing regional data-processing selection for Salesforce security.

Built for the threats of today — and what’s coming next

Salesforce now connects people, processes, and autonomous AI agents – and attackers are adapting just as quickly. WithSecure Cloud Protection for Salesforce evolves in step.

Identity Protection turns credential exposure – a prevalent attack vector – into an early warning.
The Agentforce extension adds real-time scanning for agent-driven use cases, keeping AI automation as secure as human action.

Our roadmap follows both the Salesforce platform and the threat landscape, with one goal: to protect every interaction in Salesforce.

When the protection layers work together

If Salesforce security “checkpoints” are overlooked, the effects tend to ripple.
One overlooked upload can spread malware across internal and external environments.
One stolen credential can open connected systems.
One missed alert can turn a contained incident into an operational outage.

When layered safeguards hold, nothing dramatic happens, and that’s the point.
Operations stay steady.
Customers never notice a thing since their experience stays smooth, secure, and uninterrupted.
Data stays untouched.
Users log in, work, and leave without friction.

It’s the digital equivalent of a secure operational base running on schedule, where lights are on, comms stable, mission intact. Everyone it serves never even notices the threats that were stopped.

That’s what layered protection inside Salesforce delivers: quiet continuity. As a Salesforce-native app, WithSecure Cloud Protection for Salesforce is available on AppExchange, and deployed within a short 30-minute session, where our technical experts walk you through the set-up.

Got questions? Want to see the solution in action? Book a quick demo from the form below.

For example, European ABN AMRO Insurances saw immediate impact and identified and quarantined their first threat quickly after deploying WithSecure Cloud Protection for Salesforce.

“Within an hour we were up and running — and the protection just works in the background.”
— Ralf van Hoorn, Salesforce Developer, ABN AMRO Insurances

In the meantime, for further reading:
A normal upload. A breach in the making.

It starts with something routine.
A customer uploads a PDF.
A partner adds a link in a Case comment.
A contractor logs in with credentials reused from another service.

Nothing unusual, but minutes later, data starts moving through an authorized app via API.

That’s how modern Salesforce breaches begin.
Attackers don’t break in; they use what’s already open from portals to forms and trusted integrations.
They hide links behind QR codes, register look-alike domains, and act through legitimate accounts that no one suspects.

Salesforce is built for connection. It’s where customer data lives, deals close, and automation keeps the business running.
That same openness makes it a prime target.

Defending Salesforce starts with seeing every move inside the platform, starting from the first upload.

How a layered attack unfolds inside Salesforce

Attackers operate in sequences, not single actions.
Each move sets up the next, leading step by step toward their goal: persistence, data theft, or leverage for extortion.

Security teams often call this the attack kill chain: the sequence of stages an adversary moves through, from first access to final impact.

They don’t always start with a file with malware. Many begin by looking for entry points — a web form, an Experience Cloud portal, an email-to-case inbox, or stolen credentials that let them impersonate a user and gain valid access. Once an entry works, the chain begins.

Let’s look at how those attack chains form inside Salesforce, and how real-time detection can break them before damage hits.

When entry looks legitimate

It starts with a normal upload like an RFP response to an Experience Cloud portal, an invoice attached to an email-to-case, or a document submitted via web-to-lead.
Inside the PDF is a QR code. The QR code includes a short link. Scanning it opens a mobile browser that lands on a login form hosted on a newly registered domain.

Figure 1: Evasive attack tactics hide behind multiple layers.

Salesforce will store the file by default; the platform does not inspect every embedded QR or decode its destination URL. That gap is enough. A busy support agent scans the QR on their phone for convenience, signs in, and the attacker captures the credentials on their server. The attacker can then reuse those details to log in or create a connected app.

That’s a routine activity turned into a credential-harvesting event.

Figure 2. Fake Microsoft login pages used in credential-harvesting campaigns targeting Salesforce instances. The design is near-identical to the real service, the domain is newly registered.

When layers hide layers

A seemingly partner user adds a shortlink in a Case comment inside Experience Cloud.
At first glance, it looks harmless, just a link to shared documentation or a status page.
In reality, the shortlink expands to a redirector, which then points to a phishing site cloned from Salesforce’s own login page.

Because this link lives entirely inside Salesforce data, email filters never see it. No alarms.
Each redirect strips a layer of context — bit.ly to redirector to fake domain — all executed in a matter of moments when a user clicks.

By the time someone enters credentials, the attacker has the session and moves on to create persistence.

When access turns into persistence

After initial access, attackers often seek persistence. Let’s break down the common paths.

One, they log in with stolen credentials and create long-term access, for example by authorizing a connected app and obtaining refresh tokens.

Two, they use credentials directly to perform actions under a compromised account. That looks like normal user activity with API calls, exports, scheduled jobs. This makes it hard to spot with standard tools.

Both approaches let attackers move slowly and quietly. There may be no traditional malware and no anomaly to flag. The activity runs through legitimate and trusted processes.

In a 2025 campaign, phishers impersonated Salesforce support and used a cloned MFA page to capture username, password, and an MFA code. The attacker relayed those credentials to complete the login and generate session tokens. In the incident WithSecure Cloud Protection for Salesforce detected the phishing URL and blocked the page inside the portal before any token issuance could be abused for large-scale extraction.

Figure 3. Phishing link in a campaign impersonating Salesforce led to a cloned login and MFA page containing a small but telling typo; one of the subtle cues that give fake portals away.

When exfiltration looks like business as usual

At the final stage, the objective is simple: get the data out of Salesforce.
Attackers often do it through the same functions everyone else uses, like report exports, Data Loader jobs, or API syncs run through connected apps. Each of these looks like standard business activity, so there are no alarms ringing.

In several recent extortion cases, attackers stole Salesforce records including customer data, and used them for pressure campaigns. When victims refused to pay; their data later appeared on leak sites. Once an attacker reaches Salesforce data, they already hold leverage.

For defenders, that means two risks: operational downtime if systems are locked down, and reputational damage if customer data is exposed. Both are hard to recover from without clear visibility into what happened.

Incident response teams face a hard truth inside Salesforce: there’s limited telemetry and traditional forensics tools weren’t built for the platform.

Signals from the field – 2025

WithSecure telemetry recorded a 20-fold increase in detections per million scanned files between late 2024 and early 2025. 27 % of file-based threat detections were image files containing embedded QR codes. Based on the threat telemetry, there are on average 900 malicious URLs in a single Salesforce org.

Attackers are layering their tactics to hide malicious intent where traditional tools rarely look: QR codes hide links, new domains replace blocked ones, and trusted SaaS tools become the distribution channel.

The first sign of trouble is often a routine interaction inside Salesforce.

Know what’s happening in the Salesforce threat landscape

Get the Salesforce Threat Report

Breaking the chain from the inside

To stop a layered attack, detection has to look at the same layers.
That’s why WithSecure Cloud Protection for Salesforce, as a native Salesforce app, operates inside the Salesforce platform itself and inspects every file and link in real-time.

It detects zero-day malware, obfuscated quishing campaigns, and user credential compromises before the risk escalates, directly inside the Salesforce environment. It monitors credential risks of Salesforce community users – external users are a blindspot that traditional tools miss.

Let’s take a look how the attack chain is broken from progressing inside Salesforce.

Catching files at entry

Every file upload and download is scanned and analyzed in real time.
All established file types are unpacked and inspected for hidden malicious scripts – like malware and ransomware – or embedded URLs. Encrypted, password protected archives and files are blocked.
If a link points to a new or risky domain, it’s blocked before anyone clicks.

Behavioral analysis then looks deeper – not at what a file looks like or is called in file type, but what it tries to do.
Does it behave unlike an image file should?
Attempt encryption or script execution?

Suspicious behaviors trigger an instant block and alert.

Understand the difference of file security solutions

What’s under the hood matters in stopping threats

Catching hidden phishing links

The solution also inspects links inside Salesforce in open text fields like records, comments, and uploaded files.

Links and QR codes are inspected for reputation and age, and thoroughly decoded.
URL Protection scans twice: once when content is posted, again when it’s clicked or interacted with. Agentforce actions also trigger the analysis process.

Same mechanism rescans files when users download them, ensuring new detections apply even after the file has been stored.

This double check catches delayed and time-bombed threats, which are a trick in targeted phishing.

Figure 4. WithSecure Cloud Protection for Salesforce detects and blocks malicious URLs like phishing links at the time of post and click to neutralize evasive threats.

Stop Salesforce phishing attacks in real-time

See how URL Protection blocks threats

Containing compromised user identities

Identity Protection capability in WithSecure Cloud Protection for Salesforce continuously monitors internal and community user accounts for exposure in third-party credential breaches.

It matches encrypted email addresses against verified breach feeds and flags compromised users directly inside Salesforce. Admins can then revoke sessions and force password resets before an attacker reuses those credentials.

This stops credential compromise from turning into long-term persistence and gives security teams a verifiable response trail when regulators request proof of action.

The capability leverages both public and dark web breach intel, detecting compromised credentials up to 6 months earlier than any open source tools.

Protect your Salesforce user identities – both internal and external

Minimize identity risk

Visibility for investigation and response

Every detection, every response, every interaction is logged.
Admins can review them in Salesforce reports and dashboards or export to SIEM for centralized analysis.
The audit trail stays complete for 24 months, giving both security and compliance teams full visibility.

Visibility helps incident response teams trace how a threat entered, what it touched, and how far it spread. This evidence is often missing in Salesforce environments, and speeds containment, supports collaboration with law enforcement, and gives forensic teams real context instead of speculation.

For most organizations, that level of evidence becomes the difference between days or weeks of uncertainty and hours to containment. Having a full audit trail inside Salesforce can turn a potential compliance mess into a documented response story.

Visibility builds prevention and also makes response possible.

Why layered detection matters

Attackers layer their methods to stay hidden.
Each link in the chain conceals the one before it, There is a phishing site hidden behind a shortlink, the shortlink is behind a QR code, a QR inside a document… The document might be spoofed to look like another file type even. Every layer removes a piece of context that defenders and superficial detection capabilities rely on.

Signature scans match known patterns. Evasive chains change patterns.

Layered detection connects the dots:
file analysis finds weaponized content;
URL and QR inspection expose malicious redirects and phishing domains;
identity protection reveals when valid credentials have been exposed in a breach.

Traditional and superficial security tools just flag the first anomaly, then lose sight of what happens next. Layered detection inside the platform keeps following the trail.

Understand the difference of Salesforce file security solutions

What’s under the hood matters in stopping threats

Why this matters now

Salesforce has become one of the most targeted business platforms in the enterprise stack.
Attackers know its data is rich, permissions are complex, and human error is inevitable.

Content-borne threat detections attacks grew 20× in the past year. These threats – from file-based malware to QR code phishing campaigns – exploit what the typical security stack doesn’t see, which is the activity inside SaaS environments.

In complex platforms like Salesforce, the breach doesn’t take a genius hack. They start with small oversights attackers are waiting for, like a reused password, too much access, human error, and a missed or missing alert.

Protecting Salesforce against today’s threats doesn’t mean removing all the complexity, but illuminating it.

Even the best defenses can’t promise perfection. We’ve seen this in the recent attacks, where a $1M security stack couldn’t stop a phone call and a fake app. When a breach does occur, what matters most is how fast you can understand it, contain it, mitigate the damage and prove what happened.

For further reading:
Every security team knows the phrase defense in depth. It’s the oldest security mantra in the book, and one of the least adapted to how business actually runs today.

It sounds solid: layers of protection so one failure doesn’t take you down. Firewalls. Endpoint protection. MFA. All good. All necessary. But limited.

Too many organizations still treat Salesforce as “just a CRM,” not the operational backbone it has become. It’s the hub of data, operations, automation, and customer trust – yet its security is often handled as a checkbox audit exercise, split between teams that rarely talk. That mindset creates the perfect blind spot for attackers.

In 2025, attacks often begin inside the tools we trust most. Salesforce is one of them.

The illusion of layers

Salesforce runs sales, service, portals, and now AI agents. It’s business critical and trusted – and a prime target because of it.

That trust creates blind spots. Network security can’t see inside Salesforce. Endpoint tools can’t scan what’s shared there. Email security filters never touch the files or links users exchange across the platform once there – even if they originated through email.

So yes, the defense layers in the traditional model exist and are 100% valid – they just stop too early when looking at defending modern entry points like Salesforce. And that’s where attackers now operate.

If your data and workflows live inside Salesforce, your defenses should too.

Traditional defense in depth protects networks and endpoints from the outside in. But in SaaS platforms like Salesforce, the most critical layers exist inside the environment itself.

Why external layers like endpoint or email protection aren’t enough for Salesforce

Most organizations still treat email as the front line. It’s where phishing and malware start, and the entire security stack evolved around it. But Salesforce isn’t an inbox. It’s where customer data, automation, and integrations meet, and once a file or link enters this environment, endpoint or email controls can no longer see it.

Threats that enter through legitimate business channels built on Salesforce – such as support case details, or community portal processes – bypass traditional layers entirely. From there, malicious content or compromised identities can propagate across the platform, users and integrated systems unnoticed.

Endpoint protection (EPP) or email security solutions weren’t built for this. They secure what enters or leaves the perimeter, not what happens inside Salesforce.

The same layered model that has shaped email security – combining identity protection, content inspection, phishing protection and anomaly detection – has not yet been applied to Salesforce, even though it’s now a business-critical environment for data, customer trust and operations.

That’s the visibility and control gap a modern defense-in-depth strategy for Salesforce must close.

The lesson from email security is clear: layered protection works, but only when it lives where the data and interactions actually occur.

Dig deeper into the limitations of endpoint security

Why relying on endpoint security is insufficient for Salesforce workflows

Learn more

Salesforce needs its own layers

Recent breaches prove it. The recent cascade of vishing and malicious Salesforce connected app breaches. Coinbase’s contractor compromise. The HELLCAT Jira attacks. Both began with valid credentials. Attackers didn’t break in; they logged in.

Traditional defense-in-depth models focus on protecting systems and data. Attackers don’t think in layers, they just move through them as fast and as far towards their objective as they can. In Salesforce, that movement happens for example through people, files, unstructured data, and connected apps. Defenses need to follow the same path: seeing how threats enter, spread, and act, not just stop at the edge.

Inside Salesforce, modern defense in depth has four connected layers: identity, content, governance, and automation. Each reinforces the others.

These layers mirror the traditional defense-in-depth structure, with the first line of defense at Salesforce’s entry points (identity and content), followed by governance ensuring integrity within, and automation forming the intelligent core of business operations.

Defense in depth inside Salesforce protects identity, content, and configuration layers, creating a secure, Agentic AI–powered environment where data and automation work safely together.

This model reflects Salesforce’s shared responsibility for security. Platform configuration, governance and monitoring form the foundation; real-time threat protection complements them.

The identity layer – who’s logging in

The identity layer forms Salesforce’s first line of defense by controlling who reaches the environment before any data or process interaction can occur.

Its weaknesses are well known but still underestimated: stolen or reused credentials, hijacked OAuth tokens, and unmanaged community or integration accounts that operate outside corporate identity controls.

Many organizations see credential compromise as yesterday’s problem, but it remains the number one initial attack vector according to Verizon.

Attackers most often exploit access and misconfiguration rather than Salesforce platform zero-days. Once they log in legitimately, every API, connected app, and automation trusting that account becomes part of the attack surface.

The least controlled identities often pose the greatest risk. Community, partner, and external contractor accounts frequently operate outside corporate IAM controls yet hold broad access permissions. They should be treated as first-class identities: rotate credentials, restrict scopes, and continuously monitor for breach exposure.

Examples:

– An employee’s Salesforce credentials leak in a third-party breach. Attackers use them and export customer data unnoticed.
– A partner reuses an old password from another system – that has been breached. Attackers use it to log into Salesforce submit fake orders and pivot into connected systems.
– An external contractor user is left active after a project ends. The same credentials are on sale on the dark-web. Attackers use these credentials to access data programmatically.

Identity protection in Salesforce is about seeing what’s normally invisible: who’s authenticating, how credentials are used, and where risk hides.

Identity Protection in WithSecure Cloud Protection for Salesforce continuously monitors internal, partner, and community accounts against advanced breach-intelligence feeds. It detects exposed credentials before attackers reuse them – and much before any open source tools know of the breach details.

A living identity-defense layer that detects and reacts before incidents spread deeper into the environment relies on multiple mechanisms designed to prevent the bypasses attackers most often exploit. This includes phishing-resistant MFA for high-privilege users, SSO when possible, use refresh-token rotation and short token lifetimes, require admin approval for connected apps and implement third-party credential compromise monitoring to prevent credential stuffing risks.

Learn how you can harden your Salesforce against identity risks

Minimize identity risk with these practical steps

The content layer – what moves through Salesforce

If identity is the gatekeeper, content protection is the guardrail. It inspects what enters Salesforce at the moment of upload, share, or click. This layer stops threats hidden in unstructured data before they spread and cause damage, for example data breaches or operational disruption.

Delivery often rides trusted workflows. Files, links, and QR codes move through Salesforce every day across chats, emails, records, cases, portals, and various workflows. That’s where malware and phishing hide.
- A PDF attachment hides a phishing link.
- A ZIP file in a workflow contains ransomware.
- A QR code in a record leads to a fake login page.
These threats bypass email and endpoint security because they never leave Salesforce. Just as email filters scan attachments before delivery, Salesforce needs native inspection at upload and interaction, because the attack surface targeting human users and human error has shifted from inboxes to platforms like Salesforce.

WithSecure telemetry shows a twenty-fold increase in malware and phishing detections between 2024 and 2025.

File Protection and URL Protection in WIthSecure Cloud Protection for Salesforce keep this layer clean by scanning every file and link in real time. It stops threats where they appear – inside the platform itself.

Read how the layered thinking works on Salesforce object and field level

Check out the Salesforce Data Protection Model 101

The platform & governance layer – how Salesforce is configured and controlled

Misconfigurations and excessive permissions can be as damaging as malware.
This layer defines Salesforce’s security foundation — the policies, controls, and visibility that shape how the environment operates and evolves.

Salesforce security isn’t a set of isolated parts.
Identity, content, and governance intersect constantly:
who acts (identity), what they act on (content), and under what rules (governance).

This layer unites those elements by keeping access, data handling, and automation consistent, visible, and accountable.

Effective governance rests on three principles:

Integrity: Harden configurations, enforce least privilege, and keep permissions and integrations within intended boundaries.
Visibility: Continuously monitor changes, API connections, and unusual activity that signal misuse or drift.
Accountability: Maintain a clear audit trail of who changed what, when, and why. This enables compliance and rapid incident response.

Native tools like Salesforce Security Center, Health Check, Shield, and Event Monitoring support these principles by exposing configuration and activity data inside Salesforce.
Ecosystem tools such as AppOmni extend that visibility across third-party integrations and cross-cloud access.

Once attackers gain entry, their goal becomes persistence and hiding within trusted processes.
Governance shortens that dwell time by enforcing integrity, surfacing anomalies, and ensuring every configuration and connection is auditable.

When governance, identity, and content protection reinforce each other, Salesforce operates as a cohesive, trusted environment. Every action, human or automated, stays within defined and observable boundaries.

The automation layer at the core – where Salesforce intelligence comes to life

AI and automation are now the heart of Salesforce, but at the same time its newest attack path.

At the core of Salesforce are the automations and autonomous AI workflows that drive modern business – from Flows to Agentforce. This is the Agentic AI–powered Salesforce environment: a living system where data, processes, and AI agents interact to execute work at speed and scale.

As Salesforce embeds AI agents across every process, the attack surface now includes the workflows themselves. Salesforce’s emerging direction “Agentforce for Security” introduces agentic capabilities for automated detection, incident triage, and intelligent remediation. These innovations aim to help security teams respond faster and reduce the manual overhead of investigation and response. As Salesforce continues embedding AI agents across its ecosystem, the need to ensure these automations act on safe, trusted inputs only grows more critical.

Automation is not part of the traditional defense in depth thinking, but in modern Salesforce environments automation is the business logic itself. It’s not just “a layer” but an amplifier for both productivity and potential risk.
- Automated Flows and AI agents directly execute actions that affect data and users.
- That means automation and especially autonomous AI can propagate malicious inputs (e.g., a poisoned file, fake record, or compromised user action) at machine speed.
That’s where layered defense plays a defining role. When data is secure, and configurations are consistent, automation can operate safely and predictably. Without those guardrails, AI agents and automated workflows can quickly amplify mistakes, or act on malicious inputs.

Defense in depth must now extend into automation, because automation acts with the same privileges as humans in the attack path, only faster. When every layer reinforces the next, both human and AI-driven actions inside Salesforce remain trustworthy and resilient.

What are the security risks of Agentforce

Understand why threats need to be blocked from agentic AI use cases

Visibility that leads to action

When each layer feeds visibility back into the next, you not only prevent attacks, you learn from them. That’s how depth becomes intelligence.

Every defense layer in Salesforce is connected by a visibility loop that turns detections into prevention, and prevention into ongoing improvement. Visibility in Salesforce is not just adding more dashboards.

Having this overarching visibility means exposures are caught before they become incidents and attacks are blocked before they cause damage (and tracked swiftly if something has slipped through). Patterns of malicious activity or misuse feed directly into stronger governance.

Visibility isn’t an extra layer but something that connects everything. It helps improve every layer continuously with each event.
- User risk: detect → reset
- Content risk: scan → block
- Platform risk: monitor → fix
When each action is logged and traceable, you have provable control, compliance-readiness, and stronger prevention against incidents.

Salesforce has become one of the most targeted and valuable operational systems in any enterprise. Prioritizing its detections and exposures delivers disproportionate risk reduction.

The new meaning of depth

In Salesforce, layers don’t sit neatly on top of each other, they intersect.

In practice, defense in depth inside Salesforce results in clearer sight and faster action. Visibility turns detections into decisions, and decisions into effective prevention.

Salesforce security needs layers that look inward – at the users, the content, and the automation driving your business every day.

Innovation isn’t optional anymore. Agentic AI isn’t a “maybe”, it’s a “when.” Securing it can’t wait for maturity or readiness. Salesforce found that 79% of IT leaders believe that defenses are falling behind AI-driven cyber threats. IBM found that 97 % of AI-related breaches involved systems with no proper access controls. The timing for security isn’t later – it’s day one.

If you run Salesforce, don’t ask how tall your walls are. Ask how deep your defenses go.

WithSecure Cloud Protection for Salesforce offers layered defense

Defense in depth in Salesforce only works when each layer reinforces the others, and when those layers live where the risks occur. WithSecure Cloud Protection for Salesforce puts this layered model into practice – in Salesforce, in real time.

File and URL Protection
Scans every file and link at upload, download, and interaction. It stops sophisticated malware, ransomware, and phishing from entering Salesforce through various channels.

Identity Protection
Detects compromised user credentials before they’re exploited. Continuously monitors internal and community accounts against the latest breach intelligence, providing early warnings.

Visibility & Analytics
Delivers deep insight into detections and user risk. It complements built-in platform tools like Salesforce Shield and Event Monitoring.

Together, these capabilities form multi-layered defense for the AI-powered Salesforce environment including Agentforce. They protect against malware, phishing, and identity threats without slowing down the business.

Learn how layered detection stops attacks in Salesforce

Read our kill chain breakdown
This guide explains how to strengthen identity security in Salesforce using Salesforce’s built-in controls, and how WithSecure Cloud Protection for Salesforce adds what Salesforce doesn’t cover: continuous awareness of credential exposure, helping detect compromised users before attackers exploit them.

Why identity security needs its own strategy in Salesforce

Most modern Salesforce intrusions don’t start with a software bug. They start with a valid access.
Attackers steal passwords, harvest OAuth tokens, or trick admins into installing trojanized admin tools. Then they act from inside by using legitimate API calls and UI actions that look normal at first. When attackers operate legitimately, detection slows and damage grows.

According to the 2025 Verizon Data Breach Investigations Report, credential compromise remains one of the top causes of cloud breaches, involved in 22% of incidents globally.

In Salesforce, that risk multiplies when partners, suppliers, and customers log in through community portals or integrated apps that sit outside corporate identity monitoring.

Traditional Salesforce controls cover how users log in, but do not monitor whether their credentials have already been stolen or reused. That’s the “silent weakness” attackers rely on. Credential compromise is in fact one of the top three attack vectors in breaches, according to IBM.

Case in point: you should treat identity as telemetry. That starts with visibility, in knowing who’s logging in, how tokens are used, and whether any credentials have surfaced in external breaches. Doing that turns user credentials from “silent failure points” into early-detection signals.

With that threat picture in mind, harden the Salesforce foundations first. Then layer more advanced monitoring, connected-app hygiene, and credential-exposure detection to close the blind spots attackers exploit.

1. Strengthen Salesforce-native identity foundations

Salesforce provides several built-in tools for authentication and access control. Configure them first to reduce the chance of unauthorized logins.

Multi-Factor Authentication (MFA)

MFA adds a second verification step beyond passwords. Salesforce supports an org-wide MFA enforcement option and an array of verification methods including authenticator apps and security keys. Enforce MFA either at the Salesforce level or centrally via your IdP for SSO. For Experience Cloud/community users, require SSO or configure MFA where feasible. Behavior depends on how those external users are managed.

Learn more in Salesforce’s Multi-Factor Authentication Overview and Org-Wide MFA Setting Guide.
Supported methods are listed in Verification Methods for MFA.

Single Sign-On (SSO) and identity providers

Integrate Salesforce with your corporate identity provider (IdP) to centralize authentication. Use SAML or OpenID Connect for secure federation.

Centralized policies make it easier to enforce password complexity, session limits, and lockout rules across cloud systems.

See the Salesforce Identity Overview for more details.

2. Secure Experience Cloud and external users

External and community users often follow different identity rules than employees. That increases risk.

These community users are often customers, partners, suppliers, and contractors that fall outside corporate identity and access management systems, including authentication. If their account credentials including passwords are recycled and exposed elsewhere – for example, in consumer platform breaches – attackers can reuse them to impersonate trusted partners or customers inside Salesforce. There may also be less vigilance from individuals when it comes to user accounts other than the primary corporate one they use for work.

To minimize risk you should give external users minimal roles and permissions. Disable self-registration if unused. Apply MFA if feasible. Deactivate orphaned or inactive accounts regularly. Monitor for credential breaches (more about this in #5 below).

Guidance: Manage External Users and Give External Users Access to Manage Other Accounts.

External accounts extend your identity boundary beyond your company. When attackers target those identities, they’re already inside your trusted ecosystem.

Learn more about credential compromise monitoring on Salesforce

Minimize credential breach risk with Identity Protection

3. Monitor and investigate with Event Monitoring

Even with MFA and SSO, identity threats can bypass configuration-based defenses.
Event Monitoring shows what happens after login — across user behavior, API usage, and data exports.

Watch for:
- Logins from new geographies
- Large or unexpected data exports
- Abnormal API usage or failed MFA attempts
Enable real-time Event Monitoring/Shield and stream those events to your SIEM for correlation and alerting.

Monitoring turns authentication from a static control into continuous intelligence you can act on.

Guidance: Event Monitoring Overview and Enable Access to Event Monitoring.

4. Manage connected identities and integration users

Integration accounts typically authenticate via OAuth, or API tokens rather than interactive UI MFA. Secure these accounts by using unique integration users, limiting OAuth scopes, enforcing token lifetimes and refresh-token rotation, and requiring admin approval for connected apps.

Give each integration its own Salesforce user account. Apply least-privilege permissions using profiles and permission sets.
Enforce token expiry and revoke tokens when integrations are retired.
Require admin review before approving new connected apps and limit OAuth scopes to what’s essential.

Salesforce references: API Access Control for All Users.
For more practical context, see How to Secure Connected Apps and OAuth Connections in Salesforce.

Compromised integration users can silently move data between systems. Securing them preserves trust across your Salesforce ecosystem.

5. Go beyond configuration: detect exposed credentials early

Your Salesforce security tools can’t see whether a user’s email and password have been exposed in third-party breaches, but attackers can.

In Salesforce, a single compromised login can open access to customer data, business processes, and integrated systems.

WithSecure Cloud Protection for Salesforce brings early warning to that risk with Identity Protection capability.

Identity Protection monitors internal and community Salesforce users against global breach intelligence feeds, detecting newly exposed credentials before attackers reuse them.

Scans run automatically, flagging at-risk accounts and logging every detection for audit and compliance reporting.

This adds a threat intelligence driven layer to Salesforce’s authentication framework, providing continuous awareness of credential exposure and identity risk.

Why it matters: table stakes like MFA and password policies protect the platform.
Identity Protection protects your business from credential-based fraud, impersonation, and supply-chain abuse; a cascade that can start with a single compromised user account.

Learn more about Identity Protection

Explore the capability

Practical identity hardening checklist for Salesforce

Some of these actions are table stakes — others go a step further. Attackers are moving quickly, using valid credentials, hijacked tokens, and automation to exploit trust inside Salesforce.

Security controls need to keep pace.

This checklist combines the essentials every Salesforce environment should have in place with measures that prepare you for where the threat landscape is headed.

Authentication and access controls
- Enforce MFA for all login paths, including employees, partners, and community users.
- Centralize authentication with SSO and a trusted identity provider.
- Configure Login IP Ranges and session policies to limit access from unfamiliar networks.
- Regularly audit permission sets and remove unnecessary admin rights.
External and community users
- Review all Experience Cloud and partner accounts.
- Disable unused self-registration and deactivate orphaned or inactive users.
- Apply MFA to external accounts wherever feasible.
Connected apps and integrations
- Require admin review before approving any new connected app.
- Assign a unique integration user for each app with least-privilege permissions.
- Limit OAuth scopes and enforce token expiry or revocation when apps are retired.
- Maintain an up-to-date inventory of connected apps, integration users, and active tokens.
- Establish a clear process for token or app revocation when suspicious activity is detected.
Monitoring and response
- Use Salesforce Event Monitoring to detect unusual login, export, or API activity.
- Integrate Event Monitoring with your SIEM or SOC for alerting and analysis.
- Log detections and admin actions to maintain a verifiable audit trail for compliance.
- After any incident, review permissions, connected apps, and integration tokens.
Credential exposure detection
- Enable continuous credential-exposure scanning with WithSecure Identity Protection to detect compromised user accounts early.
Identity = trust

Every login in Salesforce is a moment of trust. Securing that trust takes visibility, discipline, and continuous attention.

You can’t stop every breach that may involve your Salesforce users’ credentials on the internet, but you can control whether those breached credentials still work in your Salesforce org.

Explore how WithSecure Cloud Protection for Salesforce helps you detect exposed credentials before attackers act.

Learn more about Identity Protection

Explore the capability
If you’ve read about recent Salesforce data breaches, you’ve seen how threat actors exploited connected apps to bypass cyber defenses, steal CRM data, and even pivot into systems like Microsoft 365, Okta, and Workplace.

These weren’t highly sophisticated or complex attacks, but simply the result of misconfigured OAuth settings, weak app approvals, and gaps in monitoring. Threat actors understood the weaknesses, and used social engineering to take advantage of them – and especially human error.

In this article, we plainly list the concrete counter measures against OAuth abuse. No frills.

How to secure connected apps and OAuth connections against social engineering attacks

Here’s how Salesforce admins and security teams can lock down connected apps now.

1. Limit OAuth scopes to the bare minimum
- Grant only the scopes the app truly needs — often just api.
- Avoid avoid ‘full access’ scopes at all cost.
- Rotate or expire refresh tokens to block long-term access abuse.
- Check out Salesforce guide: OAuth tokens & scopes
Why: Smaller scope means smaller blast radius if an app is compromised.

2. Restrict who can authorize connected apps in Salesforce
- Set Permitted Users to Admin approved users are pre-authorized.
- Disable “connection code” installs for non-admin profiles.
- Restrict access to trusted IP ranges.
- Check out Salesforce guide: Control API access
Why: Prevents attackers from socially engineering standard users into installing malicious OAuth apps.

3. Enforce MFA and high-assurance sessions for connected apps
- Require multi-factor authentication (MFA) for all connected app access.
- Apply high assurance session policies to block token issuance without MFA.
- Check out Salesforce guide: High assurance sessions
Why: Even if credentials are phished, tokens can’t be issued without MFA verification.

Download the free 2025 threat landscape report

4. Use dedicated integration user accounts
- Assign each external app its own Salesforce user account.
- Apply least privilege through permission sets.
- Monitor activity per integration for faster incident response.
Why: Makes logs clear, revocation easy, and scope tight.

5. Monitor and revoke suspicious OAuth access
- Watch for bulk data exports, unusual API spikes, or new connected app authorizations.
- Revoke suspicious tokens immediately via Setup → Connected Apps OAuth Usage.
Why: Real-time monitoring helps detect and stop ongoing abuse before data leaves your org.

6. Advanced session and token controls
- Enable Single Logout (SLO) so users logging out of Salesforce are also logged out of third-party apps connected through OAuth.
  Salesforce guide: Single Logout
- Enforce API access controls to restrict which apps users can authenticate to via API.
  Salesforce guide: API access control
- Use refresh token rotation to block long-lived tokens that attackers could silently reuse.
  Salesforce guide: Refresh token rotation
- Use PKCE (Proof Key for Code Exchange) for mobile apps, JavaScript, and stateless backends to mitigate token interception.
  Salesforce guide: PKCE
Why: These measures reduce the attack surface, shorten the blast radius, and make it far harder for attackers to persist once inside.

Download the free 2025 threat landscape report

Salesforce connected app security: the bottom line

The “malicious Data Loader” style attacks didn’t rely on a Salesforce zero-day. They exploited misconfigured OAuth settings, the way connected apps are trusted, and plain human error.

The basics go a long way: minimize scopes, restrict who can authorize apps, enforce MFA, and actively monitor OAuth activity. That playbook alone blocks most of what we’ve seen in the wild.

But if you want to really cut down your risk, the “more advanced” measures matter. Our seasoned Salesforce Architect Tapas Tripathi highlights the importance of shorter session timeouts, refresh token rotation, API access controls, and PKCE all shrink the window an attacker can operate in. Or better yet, close it altogether.

Securing connected apps aims to reduce the opportunities attackers have to turn a single click or code entry into full API access – one that opens the door for data theft and fraudulent actions.

At the end of the day, tighter controls are what prevents breaches.

Understand the attack paths hackers exploit on Salesforce
Autonomous AI agents that can interpret prompts, act on business data, and interact with users across channels like Slack, email, and WhatsApp? That’s transformational.
But with that transformation comes hype — and not all Agentforce security claims are accurate.

In a recent LinkedIn Live conversation with Connor Casey, Head of Customer Success & Pre-Sales, and Tapas Tripathi, Salesforce Engineer & Architect, we separated hype from reality and explored how to secure Agentforce from day one.

Agentforce in Salesforce is not end-to-end “secure by default”

Agentforce may be native to Salesforce, but that doesn’t mean it’s automatically safe.
Like all AI in Salesforce, it follows the shared responsibility model. Salesforce provides platform safeguards, such as the Einstein Trust Layer, but you as the customer control the configuration, access, and the Salesforce data governance on your end.

According to the Salesforce State of IT: Security Report, 79% of security leaders believe AI-driven threats will soon outpace traditional defenses.

Data security should not be viewed as some necessary evil or a checking-the-box exercise. It’s the catalyst for trust and innovation.

You must decide:
- How Agentforce accesses Salesforce data
- What each AI agent is allowed to do
- What guardrails and permissions are in place
Without proper governance, AI agents can increase exposure to Salesforce attack vectors — including phishing in Salesforce, data leakage, and malware resurfacing.

“AI agents are powerful, but they need guardrails, oversight, and a clear security strategy, because when an agent goes off script, it’s not a glitch, it’s a business risk,” says Connor Casey, Head of Customer Success & Pre-Sales.

How to prepare for Agentforce? Check out this down-to-earth guide.

Get the ebook

Key Agentforce security risks

Agentforce doesn’t rewrite Salesforce’s security model — but it amplifies both benefits and risks.
- Social engineering: Agents could act on malicious prompts.
- Malware resurfacing: An agent might retrieve infected files from legacy records.
- Prompt injection attacks: Crafted inputs could bypass expected behavior.
- Data leakage: Cross-channel integrations could expose sensitive data.
These aren’t new threats — but AI’s speed, autonomy, and cross-platform reach make them harder to detect and contain. For real-world examples, read about Agentforce security against cyber threats.

How to deploy Agentforce securely — the secure-by-design model

The Secure-by-Design framework for Agentforce security in Salesforce follows four essential phases: Build, Validate, Deploy, and Monitor. Each phase is designed to minimize AI agent risks and strengthen your overall Salesforce security posture.

1. Build
Be clear on what each agent is for. Give it one well-defined job, write prompts that leave little room for misinterpretation, and make sure the access scope matches the intent. (Less is better here.)

2. Validate
Test before you trust. Review the training data, run simulations of how the agent responds. Spotting hallucinations or odd behavior early saves you trouble later.

3. Deploy
Keep it contained. Launch agents in controlled environments, give them only the permissions they actually need, and log events so you know what they’ve done.

4. Monitor
Stay on top of it. Track how agents are being used. Monitor threats in agent activities.

This way, security becomes part of how you build and run Agentforce.

Common Salesforce security pitfalls with Agentforce

When securing Agentforce in Salesforce, three mistakes appear again and again.

The first is over-permissioning — because AI agents inherit the same user access rights as the accounts they run under, excessive privileges can dramatically increase your exposure. The second is relying on dirty or outdated data. Old case records can reintroduce security threats, from malware-laced attachments to flawed recommendations that undermine decision-making.

Finally, many teams make the mistake of delaying security implementation. If you wait until after go-live, you risk immediate exploitation as agents interact with real data and users from day one.

Native threat protection for Agentforce

One of the most effective ways to close these gaps is to add native threat protection that works inside Salesforce itself.

WithSecure Cloud Protection for Salesforce provides real-time Agentforce threat detection, stopping malicious files, phishing links, and ransomware before they ever reach users or agents. It also secures Salesforce AI agent interactions across Slack, WhatsApp, and email — without middleware or delays — and integrates with identity protection tools to flag compromised accounts acting through agents.

Learn more about real-time protection for Agentforce

Explore the product details

“Salesforce gives you the tools, and Agentforce gives you intelligent automation. But it’s up to you how you build it — and that determines your security posture.” – Tapas Tripathi, Salesforce Engineer & Architect.

Expert tips for secure Agentforce deployment

From real-world implementations, and drawing from from AI deployment frameworks, a few best practices stand out:
- Give each agent one clear job, rather than trying to make it multi-purpose.
- Apply strict guardrails at setup, and always test in sandbox before deployment.
- Once in production, audit agent responses regularly to spot anomalies early
- Make AI security governance part of your team’s ongoing training.
Salesforce AI agents demand a security-first mindset

Agentforce is a new operational model for AI in business platforms.
Your competitive advantage won’t come from launching it first, but from deploying it securely.

🎥 Watch the full conversation with Connor and Tapas to explore Agentforce security best practices, myths and realities.
Understand and embrace the Shared Responsibility Model, a core tenant of Salesforce’s security strategy and securing Salesforce

Salesforce follows the Shared Responsibility Model and believes security is a shared responsibility between Salesforce and its customers. The same model is used by virtually all cloud providers, including Amazon Web Services, Google Cloud and Microsoft Azure. At the most elemental level, the cloud provider is responsible for the security of their cloud offering and its underlying infrastructure. At the same time, customers (end users) are responsible for the security of the data stored in the cloud environment. With the shared responsibility model, customers must understand what the cloud provider is not doing and fill those security gaps. Recognizing the enterprise has a role in securing its Salesforce instance and understanding the limits of what Salesforce (as a cloud provider) offers is a critical first step to developing a comprehensive Salesforce-related security strategy.

Salesforce provides many tools to help secure your environment, but it’s the enterprise’s role to implement and maintain them correctly

Salesforce provides a 300+ page Salesforce Security Guide covering everything from the basics to advanced security topics. This guide is an excellent resource for enterprise Salesforce security and administration teams as it details specific topics, including health checking, auditing, authentication, user data access, data sharing, permissions, data encryption use, real-time events monitoring and more. While understanding this information is extremely valuable, proper actions by the enterprise are required to ensure a secure Salesforce environment and instance.

For example, Salesforce data-sharing models can be very simple, but a large enterprise will likely require something more complex and nuanced. Selecting the data set that each user, or group of users, can see and ensuring it is properly configured is key. There needs to be a balance between limiting access to data (minimizing risk) versus the convenience of data access for your users. Thus, Salesforce administrators must understand sharing models in-depth to ensure that data is only available and exposed to the proper set of users.

Include a defense-in-depth approach for securing Salesforce with these best practices

Defense-in-depth is a cybersecurity strategy that uses multiple layers of security services and tools to defend an organization’s data assets. The theory behind defense-in-depth is that if one layer of security is penetrated, assets will still be defended by the remaining layers of security. Examples of tools and approaches that can provide a defense-in-depth for your Salesforce instance include:
- Multi-factor authentication (MFA): a secure authentication method that requires users to prove their identity by supplying two or more pieces of evidence (or factors) when they log in. MFA today is now ubiquitous for web-based applications. It can help defend against phishing, credential stuffing, and account takeovers and should be considered a requirement for all Salesforce users.
- Restricting Login IP Addresses in Profiles: Sales admins can control login access at the user level by specifying a range of allowed IP addresses on a user’s profile. When IP address restrictions are defined for a profile, a login from any other IP address is denied.
- Permission Sets: A permission set is a collection of settings and permissions that give users access to various tools and functions. It extends users’ functional access without changing their profiles and is the recommended way to manage your users’ permissions.
- Single Sign-On (SSO): SSO is an authentication method that enables users to access multiple applications with one login and one set of credentials. Single sign-on (SSO) can be considered part of a defense-in-depth strategy because it can encourage stronger password hygiene. However, SSO by itself doesn’t thwart identity-based attacks.
- Custom Login Flows: A login flow directs users through a login process before they access your Salesforce instance. A login flow can control users’ business processes when they login to Salesforce. After Salesforce authenticates a user, the login flow directs the user through a process such as enforcing strong authentication or collecting user information. When users complete the login flow successfully, they’re redirected to their Salesforce instance. If unsuccessful, the flow can log out users immediately.
When securing Salesforce don’t forget that sensitive and critical enterprise data can be exported or “leaked”

Securing Salesforce also means monitoring what data can be moved, transferred or leaked out of Salesforce. Users can export data that they have access to. Hence, it is critical to have a monitoring tool to monitor activity and detect/prevent data leakage.

Salesforce supports real-time event monitoring to monitor and detect standard events in Salesforce in near real-time. Event data can then be stored for auditing or reporting purposes. With real-time event monitoring, enterprises can see what data has been accessed, by whom, and whether the data has changed. This proactive monitoring should be part of a comprehensive Salesforce security strategy.

Salesforce does not scan data for malware, but WithSecure Cloud Protection for Salesforce does

The Shared Responsibility Model defines that customers are responsible for the security of their data. While Salesforce’s infrastructure security provides an extremely strong foundation, no built-in threat detection exists, as this is the customer’s responsibility. As such, customers must employ tools for malware and phishing attacks.

WithSecure™ Cloud Protection for Salesforce reduces risk and keeps your enterprise compliant by scanning all Salesforce files, URLs and QR codes for cyber threats. WithSecure Cloud Protection for Salesforce, a native application that runs in your Salesforce environment, prevents malicious and disallowed content from entering your Salesforce environment via files, web links and email messages. The application secures Salesforce to mitigate advanced cyber threats on Salesforce by:
- Providing real-time protection and instant visibility
- Working seamlessly with enterprise customizations and workflows
- Complement the infrastructure security controls that Salesforce provides
WithSecure Cloud Protection for Salesforce meets the strict compliance requirements of modern enterprises and critical public sector organizations. It was designed with Salesforce to make securing Salesforce instances very easy. Together with the Best Practices and other recommendations discussed above, every Salesforce customer can be confident in a more secure environment.

Want to know more? Get to know WithSecure Cloud Protection for Salesforce, or use the form below to contact our team to discuss your Salesforce security requirements.

How credential compromise unfolds in Salesforce

The unseen attack surface: community and external users

The impact of a single compromised identity

Data exposure

Lateral movement

Supply chain compromise

Fraud and manipulation

Impersonation and social engineering

Malware and phishing delivery

Why credential compromise is hard to detect

Learn about credential stuffing attacks on Salesforce

Introducing Identity Protection in WithSecure Cloud Protection for Salesforce

Learn more about Identity Protection

Use cases and risk scenarios

Financial services

Technology company

Public sector organization

Strategic impact: stopping breaches at their first step

Learn more about early detection of credential compromises

What credential stuffing means inside Salesforce

Why Salesforce is uniquely at risk

Internal users

Community users (Salesforce Experience Cloud)

The recycled credential paradox

Learn more about credential compromise monitoring on Salesforce

Does MFA stop credential stuffing in Salesforce?

Why traditional defenses miss it

What credential stuffing looks like in Salesforce

Lateral movement in Salesforce: a risk scenario

This is how a lateral movement can spiral in Salesforce:

How to defend your Salesforce environment

The edge of your Salesforce environment is identity.

Learn more about Identity Protection

Even well-trained users make mistakes — especially outside email

Don’t blame users. Protect them.

New threats demand new defenses

Phishing is an industry and evolving fast

Why traditional tools don’t cut it

Protecting users (and your reputation) pays off

The smart move — for your business and your career

What to do next

How WithSecure Cloud Protection secures your Salesforce environment in real-time

The shared responsibility gap

Here’s what Salesforce security risks look like in practice

When risks unfold inside Salesforce, they are difficult to detect with external tools

File protection — next-generation analysis inside Salesforce

Every file is checked before it can do harm

Extra layers for evasive content

Proven real-time protection

Granular control where it counts – practical examples

URL and QR protection — stopping phishing in its new form

Stop phishing attacks that hide in Salesforce

Content filtering — keeping Salesforce professional

Keep Salesforce clean, compliant, and on-brand

Identity protection — catching compromise before access

Catch stolen credentials before attackers use them

Secure AI adoption — keeping Salesforce fast and safe

Extend the same real-time protection to your autonomous AI agents

Analytics and visibility — connecting every signal

Trace what happened, where, and who was involved

Enterprise-grade and audit-ready protection for Salesforce

Built for the threats of today — and what’s coming next

When the protection layers work together

In the meantime, for further reading:

A normal upload. A breach in the making.

How a layered attack unfolds inside Salesforce

When entry looks legitimate

When layers hide layers

When access turns into persistence

When exfiltration looks like business as usual

Signals from the field – 2025

Know what’s happening in the Salesforce threat landscape

Breaking the chain from the inside

Catching files at entry

Understand the difference of file security solutions

Catching hidden phishing links

Stop Salesforce phishing attacks in real-time

Containing compromised user identities

Protect your Salesforce user identities – both internal and external

Visibility for investigation and response