THE CHALLENGE

When your CRM is also your biggest open door 

Georg Fischer (BFS) uses Salesforce as the operational backbone of its global sales and service organization. Across two Salesforce instances covering Europe and North America, around 1200 internal users rely on it daily for managing customer relationships, processing orders, running marketing campaigns, and handling service cases. Hundreds of external partner portal users interact with GF BFS through the platform, too. 

That level of external interaction is exactly what makes Salesforce so valuable. It is also what makes it a target. Every month, several thousand cases arrive through email-to-case and web forms, each one potentially carrying files or URLs submitted by people outside GF BFS’s network, and none of it passing through traditional perimeter defenses. According to WithSecure’s 2026 Salesforce Threat Landscape Report, 98% of malicious detections in Salesforce environments are URL-based, not file-based, and standard security tools are not built to catch them. 

For Sankar Sivagnanam, this was not a theoretical concern. A security incident prompted the team to take a hard look at their Salesforce environment, and what they found gave them pause for thought: they had no systematic tooling to validate inbound files or URLs, and a manual process that could not keep pace with the volume they were handling. 

THE SOLUTION

Cloud Protection for Salesforce. Native to Salesforce. In production in under 10 days

Sivagnanam’s evaluation covered four areas: vendor reputation, cost, effectiveness, and native Salesforce integration. Cloud Protection for Salesforce met all four criteria. But what sealed it was understanding exactly how the product works. Scanning happens directly inside Salesforce, with only encrypted, anonymized metadata leaving the platform, ensuring speed, privacy, and compliance. For GF BFS’s team, that meant no added infrastructure, no disruption to existing workflows, and protection that runs quietly in the background. GF BFS’s Salesforce team completed the full setup in under 10 days, validating in a development environment before moving to production.

THE IMPACT

Two years of threats caught. Zero  complexity added

Since go-live, Cloud Protection for Salesforce has processed every case flowing through GF BFS’s two instances, adding up to several thousand interactions each month. Over the following two years, the product detected nearly 2000 URL security events, with approximately 600 confirmed threat elements identified within those detections. 

The most prevalent threat type was linked to a Facebook Business Manager phishing campaign, a scheme that exploits platform workflows to harvest credentials and compromise accounts. To understand why that matters, consider what happens without protection in place: a service agent opens a case, sees what looks like a routine customer message, and clicks a link. In seconds, their Salesforce credentials are harvested. From there, an attacker with valid credentials inside a live CRM environment has access to customer records, open cases, partner portal data, and internal workflows. Nearly forty major companies have been listed on leak sites tied to breaches in their Salesforce environments. The link gets clicked before anyone realizes it was malicious. This is exactly the kind of URL-based attack that WithSecure’s 2026 Salesforce Threat Landscape Report flags as the dominant vector in Salesforce environments. 

Cloud Protection for Salesforce intercepts that moment. The URL is flagged at the point of submission, before it ever reaches an agent’s screen. Monthly threat statistics are now reported to GF BFS’s cyber security team and visible to management, contributing directly to an improved internal security score for business applications. 

Key outcomes

• Nearly 2000 URL security events detected over two years across two global Salesforce instances 

• Approximately 600 confirmed threat elements identified within those detections over two years 

• Full deployment completed in under 10 days 

• Several thousand monthly inbound cases now systematically validated for files and URLs 

• Improved internal security score for business applications 

• Monthly threat reporting now visible to management and the cyber security team