THE CHALLENGE

Recruitment runs on files. Files are where the risk hides. 

Recruitment is a document-heavy business. Across more than 37 countries, approximately 6000 Michael Page recruitment consultants and salespeople use Salesforce daily to manage job leads, track candidates, and handle client relationships. Candidates submit files through web forms, email, and the company’s Experience Cloud portal, all of which feed directly into the platform. At peak, that has meant tens of thousands of CVs arriving every single day. And it is not just files. Candidate messages and form submissions carry links too. Those files and URLs arrive completely outside Michael Page’s network. They have never been scanned by any of the cybersecurity layers that protect the rest of the IT environment. 

What made this exposure particularly sharp is what happens to those files next. A recruiter opening a CV could just as easily be opening malware or clicking a malicious link hidden inside the document. And once a CV lands in Salesforce, a recruiter can forward it to a client directly from the platform. A document submitted by a stranger, unscanned, could travel from a candidate’s laptop through Salesforce and into a client’s inbox, without anyone in Michael Page’s security team ever seeing it. 

Marc Springett had a clear view of the problem. His team’s internal security policy already flagged this kind of unvalidated external data as a gap that needed controlling. The challenge was doing something about it at the volume Michael Page operates, and in a way that would not slow down the recruiters who depend on Salesforce to do their jobs. 

THE SOLUTION

Cloud Protection for Salesforce. Native to Salesforce. In place since day one. 

When Michael Page first built out its Salesforce environment in 2018, a security review during the implementation surfaced the same gap Marc Springett’s team had identified: files entering Salesforce were not being scanned for malware at the point of upload, and the platform’s built-in controls at the time did not cover this. The recommendation was Cloud Protection for Salesforce. It has been in place continuously ever since. 

The product covers Michael Page’s full Salesforce footprint, including Sales Cloud, and the Experience Cloud portal that handles public-facing candidate intake. Every file that enters the platform through any of those channels is scanned before it reaches a recruiter, including files flowing through Michael Page’s core recruitment application.

The result is that Michael Page’s recruiters work exactly as they always have. They submit, review, and forward candidate files without any additional steps or friction. The scanning happens invisibly, at the point of entry. 

THE IMPACT

Every file is scanned. No one had to change how they worked. 

Since go-live, Cloud Protection for Salesforce has processed every file entering Michael Page’s Salesforce environment. Real threats have been caught. 

For Marc Springett’s team, the operational value goes beyond the threat count. The security team has visibility into everything passing through Salesforce. URL scanning runs in parallel, catching malicious links in case communications before they reach a recruiter screen. And because the product runs natively inside Salesforce, none of this requires Michael Page to maintain additional infrastructure or ask their recruiters to do anything differently. 

The platform has also grown since 2018, and Cloud Protection for Salesforce has grown with it. When Michael Page introduced Experience Cloud five months ago to power their public-facing candidate forms, the product extended to cover that environment, too. Marc Springett describes it as security that stays in the background but is always there. 

Key outcomes

• Every externally submitted file scanned at the point of entry, across all Salesforce environments 
• Full coverage across Sales Cloud, Experience Cloud, and Michael Page’s core recruitment application 
• URL scanning active across all case communications 
• Zero change to recruiter workflows or candidate experience 
• Security coverage extended automatically as new Salesforce products were adopted