Introducing Security Data Fabric: Unify Signals Across Silos | Dreamforce 2025

You. We'd like to thank you for being here today and sharing your most precious resource with us. Your time. Let's meet our speakers. You already know me, and I'm joined today by two great co presenters. First, my Salesforce colleague Mark Wickham, who is a product management director. And we're thrilled to welcome our a special guest from our valued partner, Okta or Dermer, who's a product acceleration specialist. And you'll hear from both shortly. Let's start by looking at the core challenge. This slide is not meant for you to read, it's meant for you to feel. This is the modern cybersecurity landscape, a marketplace that is permeated by an abundance of vendors, with new vendors literally launching weekly. And if you're looking for Waldo, he's in the lower left hand corner of the slide right there. And this is not a trend that is slowing down. In fact, it's the opposite. It's accelerating. As the pace of technology evolution accelerates, attackers will follow suit and there will be a demand for new specialized tools to protect organizations of all sizes. And this leads to a fragmentation. And this fragmentation is, is not slowing down, it's accelerating. And teams are literally struggling and buried under mountains of security data and alerts. And this makes it incredibly difficult to get a picture of what's actually happening from an attack perspective. And this leads to not only a flood of alerts, but just missing context and inconsistent security and ultimately a significant increase in business risk. So how exactly does this fragmentation lead to an increase in business risk? So let's look at a real world scenario. So let's imagine that your identity system sees an employee login. Unbeknownst to that, to the identity system, this employee was just off boarded and separated from the company. Your backup and recovery tool might see, might flag a mass data deletion and your security monitoring might see a flood of anomalous API activity. Right now, these are just disconnected security alerts. They're likely sitting in different queues, they're being triaged by different teams. And it becomes incredibly difficult to actually see the full picture, the full ATTCK picture in motion in real time and understand how your organization is being affected from a risk perspective. And unifying all of these siloed security events and alerts into a common data schema is complex and challenging for most organizations. And this is the area that we've been focused on and have been innovating in for a number of years. So that's why I'm really excited to welcome my colleague Mark up to the stage to tell you about the features and benefits of Security Mesh with Security Center. Over to you, Mark.

Thanks, Ramon. So how do we solve that problem we just talked about? And our solution to this problem is Security Mesh with Security Center. We want to bring together those siloed alerts and siloed information into one place to give you the full picture. And we do that with really three main areas. First, it is that unification, the security data. So wherever that data begins, whatever format it's in, let's bring it into one place, let's connect that data, and make sure we have the full context ready for you to use. Next up, we want to automate risk. So exactly as Ramon said, you might have one bit of the picture over here and one bit of the picture over there, but when you put that together, you understand this is actually more risky. And if it's more risky, it's gonna impact what I need to do and when I need to do it to make sure my business and my data are secure. And then lastly, we know that everything is going to be driven by agents pretty soon. So if we can give the right data with the right context to the right agent at the right time, it can improve your security performance and again, greatly reduce your risk. But we don't do this alone. We have to bring this data together with data from external vendors, from partners. So I'm super excited about the agreement and the partnership we're entering into with Okta to give that full holistic view. And so I'm sure everyone here has heard of Okta. We know they're the industry leader, but just some good stats here that they have over 20,000 customers, they integrate with over 8,000 applications, and they're protecting 8 billion monthly attacks. So I'm really excited to have all with me. All right, thank you. Over to you.

We're very excited about this opportunity to partner with Salesforce as well and to elevate the security posture of our mutual customers. And I couldn't agree more, Ramon. The way to security must come through breaking down those silos. You know, at Okta, we've been seeing many different types of customers across different industries, from SMBs to Fortune 500 companies. And time and time again, we see this issue of identity sprawl, basically this explosion of identities that we see and the different types of apps, resources that they have to access. You know, we have employees, then we have privileged users for whom we can compromise on the user experience, but we really must nail down the security controls, stuff like contractors and Partners where we can't control their identity properly, we can't audit them properly. Obviously non human identities being another type of risk themselves. And each one of those identities must access different stuff, right? This could be on prem apps, SaaS apps, cloud maybe we have private APIs, public APIs. It's a massive thing to understand. It's managed across different platforms and if you don't have good visibility to that, this is where security gaps arise. And as an identity provider I would love to tell you that all you need to do is set up your identity provider properly, right? Set up single sign on so every access comes through that identity provider set up MFA so all of these accesses are secure and set up scim so when someone leaves the organization their account is off boarded. When someone comes in they are granted access but reality often isn't like that. So we can see stuff like API keys, tokens, OAuth grants certificates, they're often managed within the apps themselves and the identity provider does not have any access or or visibility to it permissions stuff that are often managed again in those apps. Leak credential is obviously a very big thing to monitor for incomplete off boarding. We often see that in cases where people have like a secondary account or maybe the API token where their main account has been deleted but this residual access there still remains a very risky thing to find and SSO bypass obviously we see that sometimes with subsidiaries, sometimes with M and as where you know we acquired another company they had like a legacy identity provider there or some policy we weren't aware of. And all of these findings are very crucial and none of them could be detected unless we break those silos down. Enter Okta identity security posture management from here on. Now ISPM because that is a mouthful. So ISPM integrates with all your identity providers, not just okta. In fact we have customers who are not okta customers at all aside of ISBM of course and we integrate with those identity providers. So this could be okta entre Google Workspace, your SaaS apps obviously Salesforce being a very major one for us. GitHub, AWS on prem environments, all of those different environments we pull from these the accounts, the roles, the permissions and how they federate to each other. Stuff like federation SSO policies that interact with those different environments. We surface all of these for you so that you have a single pane of visibility to your human non human identities and AI agents all under one platform and you don't have to be an expert in each one of these individually. This context Is key stuff like seeing that we have an administrator in Salesforce is very different to knowing we have this admin account. But they don't have MFA at Okta or they've been offboarded from from the HR platform. Understanding all of this together is key to understand our security posture. So ISPM delivers all of this to you, all of those risks prioritized based on the blazed radius, how exploitable they are and the ability to automatically remediate those findings. And we deliver a clear visibility to trust but verify who has access to what, how they authenticate and all of this data. We're now super pleased to be partnering with Salesforce and enrich even further the context you can get into those findings. Mark, show us how it's done.

Thanks all. So I think it'd be helpful to let's just talk through a real world scenario. How are these bits and pieces gonna go together and actually improve security for you and your organization? So let's think about what we may have visibility into today and how these bits will come together. So let's imagine we have a user in Salesforce who is exporting a lot of data in a short period of time. Okay, that's something we're concerned about and it's something that we can detect with event monitoring, threat detection events. But maybe we've got a lot going on and maybe we get a fair number of these requests. You know, people will do this around quarter end or they're running financial reporting. So it's concerning, but it's not so concerning that we're going to take action instantly. But then maybe we layer on some additional context in Security Center. We can understand if this is a very permissioned privileged user, okay, if they have access to a wide range of data and they can do things with that data, that's going to increase how concerned I am about the first anomaly. And that on its own can be very helpful. That can then increase my risk and increase the level of importance I'm going to give this. But the real game changer is when we start to layer on additional data from partners like Okta. What if we also understand from Okta that this is a user who's actually been off boarded but. But their credentials were not revoked. Well now that changes everything. This isn't just something that we need to maybe look at next day. Maybe this is something we need to take action immediately. Wake people up in the middle of the night. Whatever we need to do to shut down this security incident, we know the access needs to be revoked. So how can we then automate that so the access can be revoked automatically? All of this context can be helpful, especially as we talked earlier on moving into the agentic era. So as we have this context, we have this certainty. We can now give those instructions to an agent to maybe automatically remediate this for us when we have this level of certainty. I think that's the really critical thing here. As we bring more of this data together, we get a bigger picture of the puzzle. We have a greater confidence in what we're looking at. And so then it allows us to make decisions automatically about how we stop this incident in its tracks. So let's just go back over some of those key takeaways. So the problem that we have, I think we all have is there's too much data, it's too much noise, it's too siloed. So our solution to that is by bringing it together, housing in one place, making sure it's connected together, making sure it's in the same format, and making sure they're bringing data from other sources. So we have that rich risk context so that we can do things like risk scoring and prioritization of the incidents, all working towards that future of automation where all of that rich data can feed into an agent. So you can actually resolve these issues automatically. And look, this isn't the only time we're going to be talking about this stuff. If you are hungry and thirsty for more content around security and Mesh and what we're doing in the agentic era, you can check out Security keynote coming up soon. We've got some great speakers here. Todd McKinnon from OCTA is going to be speaking there with Marla Bradark and our Chief Trust Officer as well. So definitely want to check out. And with that, thank you very. Much.