Identity Protection is a feature in WithSecure Cloud Protection for Salesforce that detects Salesforce user credentials exposed in third-party breaches.
Early detection of credential compromise enables Salesforce administrators and security teams to act before attackers get the chance to exploit stolen credentials – for example by enforcing password reset.

Salesforce doesn’t monitor for exposed credentials, and stolen logins are involved in 22% of all data breaches globally (Verizon DBIR 2025).

When users reuse the same passwords across different services, which is known as password reuse, a breach in one system can compromise many others.

If an employee, partner, or community user’s credentials are leaked elsewhere, attackers can use those logins to access Salesforce as a trusted user.

Identity Protection provides early detection and visibility inside Salesforce. Existing security tools have no scalable coverage for community user monitoring.

Identity Protection in WithSecure Cloud Protection for Salesforce covers both internal and external user types:

Internal Salesforce users: Employees, administrators, and system accounts. Detect compromised credentials early to prevent unauthorized access or privilege escalation.

Community and partner users: Experience Cloud and partner logins often fall outside corporate security controls. WithSecure Cloud Protection for Salesforce uniquely monitors these accounts at enterprise scale — reducing the risk of impersonation, supply-chain abuse, and data exposure.

Identity Protection continuously scans Salesforce user email identifiers (securely hashed) against a combination of proprietary, commercial, and dark-web breach intelligence feeds. Human analysts infiltrate dark web forums to uncover threat intelligence that is not available with traditional credential scraping tools.
This hybrid approach detects new exposures 3–6 months earlier than any public or open-source lists.

If a user’s credentials appear in a known data leak, the system flags it directly in the Cloud Protection for Salesforce dashboard, complete with breach metadata and severity information.

You’ll know:

Which users were exposed — and when

The breach source and password format

How severe the risk is

By default, Identity Protection scans run automatically every week.
Threat intelligence feeds for credential compromises are updated daily.

No. Identity Protection provides early detection and visibility, but control for response actions stays with the administrator to avoid unwanted disruption.
You decide when to reset credentials or apply other remediation steps.

Identity Protection is a feature of WithSecure Cloud Protection for Salesforce – a 100% Salesforce-native app, with no external connectors, or unnecessary data traffic outside the platform.

It covers Experience Cloud and community users (like partner accounts) at scale. User risks related to these Salesforce user types fall outside current enterprise security tools.

Each detection event and admin action is logged, creating a verifiable audit trail.
This supports today’s compliance frameworks, and helps demonstrate proactive identity-risk management for internal and regulatory audits.

Key use cases for Identity Protection feature include:

Detecting exposed employee Salesforce user credentials before attackers log in.

Monitoring high-risk external community users in partner and community portals built on Salesforce.

Strengthening third-party and supply-chain security posture in Salesforce.

Reducing the risk of fraud, impersonation, or data theft across Salesforce and connected systems.

What attack methods does Identity Protection protect against?
Identity Protection helps prevent attacks that rely on compromised or reused credentials, including:

Supply-chain compromise — Attackers use compromised partner or customer logins to submit fraudulent transactions, upload malicious files, or move laterally into your systems. Detecting exposed external accounts stops these supply-chain attacks before they escalate.

Credential stuffing — Automated login attempts using usernames and passwords leaked from other services.

Account takeover — Using stolen credentials to access Salesforce as a legitimate user.

Social engineering with trusted identities — Using compromised user accounts to send phishing links or fraudulent requests inside Salesforce.

Early prevention is always cheaper than breach recovery.

Some personal data may be processed in the Identity Protection feature, namely the email address and related breach data. Such personal data is stored in encrypted form and processed in accordance with the Data Processing Agreement. Please note that the data in the Identity Protection feature may be processed outside your normal data processing data region.

For more information on privacy in WithSecure Cloud Protection for Salesforce, please see the WithSecure Cloud Protection for Salesforce Privacy Policy.