Leading with Trust in the Agentic Era | Security Keynote, Dreamforce 2025

Please welcome Chief trust officer Salesforce Brad Arkin.

All right, welcome. Thank you for being here. This is the first ever security keynote at Dreamforce. We all get to be a part of it. Thank you for being here. It's going to be exciting. Security has never been more important than right now. As we enter this age of the agentic enterprise, figuring out together how do we meet these evolving threats and build the defenses that need to protect our organizations against these types of attacks is what we're going to be talking about today. Now, when we talk about what's happening in the. Oops. One more. When we talk about what's happening in the world, you see all these headlines, you see the bad news and the outcomes. But we may not all have the full understanding of exactly what tactics the bad guys are using. What are the actual steps they're taking to achieve these outcomes. By studying this, we can then reflect on what defenses we have in place and what do we need to tighten up and improve in order to be resilient against these types of attacks. And so trying to double click on these headlines and understand what's really happening, I went for some help. And so we've got Rachel Toback. So I'm going to advance one. So Rachel Toback came to my attention with the defcon social engineering contest that she won a couple years ago. Defcon is like hacker summer camp in Las Vegas in August. And so she is one of these people that are just amazing at getting folks on the phone and then scamming them into whatever it is that she's trying to get done. And so we gave her an assignment, a mission. And we said, rachel, we want you to target our chief technical officer at Salesforce who goes by mk. So MK is the target and that was her assignment. And so we've got a video clip of her showing the steps of how she went about this process. So let's roll the tape and watch that.

Whoa.

I mean, this is so crazy.

Let's rewind. Let me explain how this deepfake hack is built. Are you ready for a speedrun MK?

Whoa.

Yeah.

So we start with your LinkedIn. Only open source information is used because attackers are lazy. They want to get the research over fast. So they take that LinkedIn URL, they stuff it into a data brokerage site like Rocket Reach. And I already have two email addresses and a phone number to use right off the bat. Next, the attacker puts those email addresses into a data breach repository site. And with this one personal email address, I was able to find 42 breached records 5 milliseconds. Now, attackers, they're using AI to automate and do this research even faster. Do you want to see all of those breach records and what they include?

Yes.

Okay. It includes three phone numbers, two full addresses, three email addresses, and 10, 10 lane text passwords just from breaches. I want to show you what it looks like when I steal your Voice from a YouTube video.

KPIs and metrics across the organization.

So all I do is I take a clip from that video from YouTube and I put it in to my voice cloning tool. Essentially what we do is we just pretend to be you to your team to gain access to a wire transfer or to get them to download something malicious or give a password or a code. So here is your voice making that request to your team.

Thanks for jumping on. Okay, so here's the situation. We need to process a wire transfer in the next hour for an acquisition.

I would be duped.

We don't just have the ability to do this over phone calls. We can do it in a live zoom. I want you to imagine I send a link to your executive assistant, your team, the people that support you at work, and I show up and I'm you asking this.

Thanks for jumping on. Okay, so here's the situation. We need to process a wire transfer in the next hour for an acquisition. But I haven't announced it to the team yet. I'll send you all the details in an email in a second. Can you help real quick?

Crazy.

That is so real.

And I'm sure my directs are going to be super scared next time I call them, whether I'm a real person or not.

I know, I know.

So how do we all stay safe?

We have to be politely paranoid. Anytime you get a sensitive ads, make sure that we verify that people are who they say they are with another trusted method of communication. At Salesforce. That's Slack. We also need to make sure that people stop password reuse. So you've got to use your password manager and you have to turn on multi factor authentication mfa, that second step when you log in everywhere. Stay safe out there, mk.

Thank you, Rachel.

Okay, so that's a little bit crazy right now. Unfortunately, Rachel is not one of a kind. There are a lot of people who have the skills that she has, and not all of them have her moral compass. And so there are these folks out there every day and sometimes they're targeting individuals like what we assigned Rachel to do with mk, But a lot of times they're going after a category of Worker. And so a salesforce admin, somebody who works in your identity team, the help desk, and the way that they may target these folks may not be as specialized as that Zoom video. It might be something like a WhatsApp message to your personal cell phone. And particularly going after the human on their personal channels like their personal cell phone. There's no corporate security team defenses that exist within that environment. And so these are the real world attacks that we need to defend against. And the bottom line is after all of this is that we need to figure out how do we protect our data against all of these different tactics. Because the bad guys put this to work to achieve the outcome that they want. And so to help me have this conversation about how we protect our data, I want to invite Todd McKinnon onto stage now. Todd is the CEO and founder of Okta. Wow, that's an entrance. Thank you for coming.

It's a high risk move.

Yes, yes. That's awesome.

You miss. It's a laughingstock.

So, okay, first off, Okta, what does Okta do? Give us the quick primer.

Well, Okta is all about identity. We're providing a broad identity platform to 20,000 enterprise customers around the world. You may know us for multi factor authentication or single sign on, but we're trying to really define a new category which is a fabric that covers all the identity use cases from privilege access to identity governance to threat protection. Connects to every resources and consolidates all your identity sprawl. Because as you know, as the video demonstrated, that all the attacks now are identity attacks.

That's an important mission. Every single attack is easier if you can get the identity compromised. And so a lot of attackers are going towards you because you sit between them and what they want. So how do you as a defender think about this evolving landscape? What are you working on?

Well, the first thing is trying to eliminate complexity. Because when you think about an organization's identity landscape, it's not about defending the most sensitive accounts. Well, that's important. It's about defending every account because you can move laterally, you can compromise one thing and that'll give you some more information to do social engineering to get another account. So it's that comprehensive coverage, which is why this concept of a fabric and covering everything and leaving no gaps or no corner cases to sneak into is super important. And to get that to happen, it has to be simple, has to be pre integrated, simple, connected to everything. Those are some of the core elements of what we're doing.

Yeah, and this is, I think that attacker Game where you, you get what you can get and then from there see what you can get next. And so that building on an attack from one resource to then expanding access later. And so it's not just one server to the next, but it's one identity to the next. And so I might not be able to scam MK directly from the outside world, but if I can compromise his admin's account, that might be the way that I can get into his account. And so that fabric covers all of it, which is great. And then you are enabling your customers to do those defenses, but then you're also a target of attack. And so when you think about the leadership tone that you set because you're the CEO, you're not the security leader, you're not the IT leader, so what do you do to enable your team as a whole to understand how important this is?

I think the one we're all at some level trying to do risk management. We're trying to judge the risks of things happening and the impact of I think tone from the top being very clear about risk management. And at Okta it's like every risk has to be managed, every security risk, no matter how infrequent or how maybe a tail risk it is, it has to be managed. And that changes a lot when we think about how we prioritize things, how we prioritize our internal IT infrastructure, how we prioritize our product roadmap to making sure hey, the products don't just have great capabilities, but they're secure by default. And then really how we think about the entire industry and how we prioritize leading everything toward this world where these identity based attacks don't happen.

Yeah, and all of that investment paid off for you. In August there was this industry wide supply chain attack. Your team had done some work that actually saved the day. Maybe you could tell us a little more about what that incident.

Yeah. As part of this risk management I've been talking about, one of the things we did was a really long program, lots of work. But one of the things we did is we went through all of our applications. And people usually go through their sensitive applications, they're thinking about databases and content stores. We went through all of our applications and made sure we worked with the vendor. Salesforce being the most prominent application we have to making sure we're taking all the advantages of the platform to lock it down even to the degree where we limited IP ranges that other system to system integrations could connect to us in. And this is a hard thing to do. Because when you start limiting IP ranges for inbound integrations, you're, you know, if you want to do it from Google, you have to figure out the Google IP addresses. You have to figure out where all the tools are coming from and if they. It's a very hard thing to do, but we did it. And when someone stole our tokens, they couldn't use them because they were locked down by IP address. So it's about this risk management. It's about this having the diligence and the foresight to push this kind of change through the organization. And it also illustrated to me that the industry needs an easier way to do this. We need new standards to let applications collaborate with identity systems to make it easier to have security be done by default, which is what we're really focused on. Because one thing to do the hard work, but it's another thing to have it be easy for everyone.

Yeah.

And that's where we're trying to go.

That's an incredible story. Thank you so much for coming on stage and sharing all this with us.

Thanks for having me.

All right, thank you. I want to see if you can do a barrel roll off. Okay. So like Todd described there, there is a partnership that is involved between the vendor and the customers. And at Salesforce, we work with all of our customers to figure out what can we do together in order to defend against these types of attacks that we're seeing. And so we call this the shared responsibility model. And so the things that we need to do and the things that customers need to do, which together will land that security story that's going to make the difference when the bad guys come attacking. And if we double click on the Salesforce side of the fence, this is where we've got these three layers of work that we're going to be sharing with you today. So at the bottom layer, we call it the invisibles. The stuff we do 24 7, day and night, while you're sleeping, we are working to keep our Salesforce customers safe. Monitoring, patching servers, managing third party libraries. There's lots of stuff that goes into this. As the next layer up is the configurables our platform exposes to you. Like Todd described. IP allow, listing, principle of least privilege, permission, set management, lots and lots of security features. And you need to evaluate as a customer what is the right way to configure each of these settings for your business, the way that your business works and the threats and the risks that you need to counter. And then at the top layer of the stack, we have the enhanceables. So if you work in financial services, healthcare, some highly regulated environment, you may have obligations to your regulators and your stakeholders and your customers that require you to go above and beyond and do something more. And that's what that enhanceable layers is all about. And so I'm gonna invite the Stage Now Kelly McCracken, she leads our cybersecurity operations center and she's gonna tell us all about that invisible layer. Thank you, Kelly.

Thank you, Brad. So I'm going to take it to a personal level for just a moment. I have been at Salesforce for over 10 years and I lead the cybersecurity operations center which is an intel driven autonomic security operations team that detects and responds to all security events across Salesforce infrastructure and our products to ensure that we are protecting Salesforce, our customers and our community. This is a mission that I am passionate about because it's personal to me. I'm not only protecting your data, your organization's data, or your customer's data, but I'm protecting my data, my family's data, and my friends data. I would bet that almost everyone in the world has some type of data being protected by my team. And this is a massive responsibility that I take very seriously. As Brad mentioned, with the shared responsibility model, we build security into every layer. We do this so that you can innovate and grow your business knowing that your data is available and protected. With the evolution of data and privacy regulations, trust and security are more critical than ever. And this is why we leverage a secure by design principle in building everything in our infrastructure and our products. Everything at the bottom layer is Salesforce's responsibility. These are the invisibles. These are the protections we put in place for our customers. Enabled by Salesforce, managed by Salesforce. Customers do not need to lift a finger. So what are the invisibles? They are your network level security protections, your application level security protections, and your secure infrastructure such as Hyperforce, our next generation public cloud infrastructure. The backbone to Salesforce modern architecture that allows you to build AI and apps at scale anywhere in the world. But this is table stakes in today's world. What I'm excited to talk to you about today is how the Cybersecurity Operations center is working for you in the background, invisible to you. The Cybersecurity Operations center, or CSOC for short, is working behind the scenes, often going unnoticed to our customers, but absolutely critical to protecting your data. We are a global team that works 24 hours a day, seven days a week, Monitoring, detecting and responding to all security events to reduce the impact to our Salesforce, our customers and our community. Our mission priorities are clear. Protect Salesforce, protect our customers, protect our platform and protect our community. We don't wait for alerts. We are actively hunting leveraging threat intelligence to strengthen our security posture. Responding to events as quickly as possible. We leverage automation, AI and agent force to improve the efficiency of our operations to ultimately reduce the mean time to detect and the meantime to respond. You can think of us as your digital first responders, your own elite cybersecurity firefighters. We move fast to investigate any security event no matter what side of the shared responsibility model it is because no matter whose responsibility it is. Responding to all security incidents is important to me because we must reduce the risk and the impact to Salesforce, our customers and our community. This is why I put two of my favorite cybersecurity leaders in charge of building our detection response capability for both Salesforce side and the customer side of the shared responsibility model. Moore and Doug unfortunately cannot be here today because they're at home monitoring and detecting and responding to all security events. So you can enjoy your dreamforce knowing that your data is protected. More leads our detection analysis and response team which builds the detections, then monitors, triages and escalates and when needed responds and manages all of Salesforce's own incidents. Doug leads our integrated threat management team which leverages threat intelligence to build detections into the platform so that we can protect our customers orgs and when needed, we help our customers respond to events on their side of the shared responsibility model. Now, in the rare event that there is a security incident, we move fast and we notify our customers clearly. Because my goal as the leader of the CSOC is to ensure that I'm building your trust in Salesforce through our response to security incidents. So let's put this into real life with a story about two customers who who had incidents on their side of the shared responsibility model and how Salesforce partnered with them to detect and respond to their events. One afternoon a Customer went to security.salesforce.com clicked on Contact Us and reported a security issue immediately. A CSOC analyst picked up that report, reviewed it and realized this customer was having a security incident on their side of the shared responsibility model. They immediately got on incident bridge with the customer, helped them investigate the incident, reviewing the logs, helping them understand what they were seeing in the logs and help them with their remediation. We took the data from that incident and was able to provide it to our threat intelligence team who leveraged it to identify the threat actor, the tactics, techniques and protocol and build detections directly into the platform to now protect all of our customers from a similar threat. A few weeks later, another CSOC analyst was monitoring our alert queue and got an alert that was based on the detection that we created just weeks earlier based on the first customer's incident. The alert indicated that a customer was having unauthorized access to their org via one compromised user. The analyst immediately froze that user and contacted the customer via their security contact we had on file. The customer immediately implemented their incident response plan plan and CSOC analysts worked directly with them to investigate and remediate, providing them information on the threat actor and their tactics, techniques and protocols in addition to providing them remediation actions and best practices such as IP allow listing and multi factor Authentication to prevent future incidents like that in the future. Now, it's unfortunate that these two customers experienced these incidents, but the fact that they had a partner in Salesforce significantly reduced the impact to the customer, Salesforce and our community. If you were to take two things away from this, I want you to know to go to security.salesforce.com, contact us if you experience a security incident within one of your orgs because your report can help us now protect all the other customers from future similar incidents. Additionally, keep your contact information up to date with Salesforce so that we can notify you in a timely manner in the event that there is a security issue. Now we've gone through a lot about how Salesforce is working behind the scenes and visible to you to protect your data. Our customers are able to customize their orgs to meet their business needs and they must configure them to ensure that they keep their data secure. And with that I'm excited to introduce my colleague, Head of Product Security, Prashant to discuss the configurables.

Thanks Kelly. I've been with Salesforce over a year and I lead our product security organization and I can't tell you how eagerly I've been waiting to be here in front of all of you. My team and I work towards ensuring that our products are built safe, securely and resiliently and most importantly are worthy of the trust that you all put in us. Salesforce powers mission critical operations across the globe for multiple organizations and governments and we know that a simple security incident could have a global impact. Our mission is very simple. Block this impact before it happens. And how do we do so? We do that by embedding security into everything we do all the way from Build, deploy and shipping the products to our customers. As Kelly mentioned earlier, the built in protections will within the invisible layer are a part of our Salesforce commitment to deliver a secure platform to our customers. Once the platform is accessed by our customers, it's your responsibility to ensure that the security settings within this platform are configured appropriately to meet the best needs as per your business and also to ensure that your data is safe. So what are the configurables? The configurables are the security controls built into the Salesforce platform. Think of these as the seat belt in your car. The seatbelt is available to you, ready, tested and designed to protect you. However, you have to click it on. That's the configurables. These are the dozens of security controls available within the Salesforce platform that the customers are responsible to enable and set up as per their business needs to improve their Salesforce organization security posture. Just like buckling in your seatbelt, enabling functionalities such as multi factor authentication, single sign on ip, allow listing and enabling login history, these are simple yet extremely powerful controls that overall improve the security posture for your organization. And to manage all of this, we have a super handy dashboard called as the Health Check which is available to all of our customers and the administrators for the Salesforce orgs. Can I get a quick show of hands in this audience? How many of you play the role of an administrator for your Salesforce orgs? I'm sure there are many others who are watching us live right now who also have their hands raised. The administrators are our superheroes. You are our security heroes and you are responsible to ensure that the settings within these Salesforce platform and the orgs that you're managing are set up appropriately and configured to ensure that the security for your organization is also appropriately set up. Instead of me just talking about Health Check, why don't we give you a live demo. I have here with me my colleague Mike.

Hi Prashant.

Good to be here.

You ready? Awesome. So Mike is going to play the role of a budding security hero. A Salesforce administrator for a fast growing company. Let's call her Alex Chen. Alex comes to work every day, looks at her Salesforce org and is wondering has one question in her mind. What's the security posture for the organizations that she manages and how to improve it and to enable this? The answer is pretty simple. Go to the heart of our platform, the setup page and from there on go to the Health Check dashboard.

Give me a minute. We're calculating this score in real time here. There we Go.

All right, there it is. So Alex is at the health check dashboard for her organization. And in this dashboard, you can see that there are two, two different baseline standards available. One is the Salesforce baseline standard, which is available out of the box. These are the baseline security controls that we are recommending and strongly suggesting to be enabled for all of the Salesforce orgs that our customers use. But in this case, Alex knows that security is not one size fits all. So she has also the capability to enable a custom baseline standard for her org on top of the Salesforce standard that we provide. So she goes to her enterprise security settings and sees that the score is 78%.

It's good, it's good, but I think we can do better. Prashant.

Absolutely, Mike. Alex is an overachiever. She wants to aspire for greatness. So let's make her score better. So while scrolling through this dashboard, we can see that there are quite a few actionable insights that are available. And one of this is, is that the password complexity requirement, there is a warning next to it. The standard says that Alex should enable alpha, numeric and special characters for her org for all users who are accessing the org. But the current setup only shows alpha and numeric characters are enabled. Mike, let's help Alex enable the special characters too.

All right, we're going to switch this to use special characters and save. There we go.

Just a few clicks. There you go. Alex has enabled the password complexity requirement to meet with the standard. Now let's tackle one more win. We also see that the login IP range enforcement is disabled right now and the alert is showing up as critical. Let's help Alex enable this. But before Alex can go and enable this setting, she has to make sure that she goes to the user profile setting and enters the right IP addresses. So Mike is helping us navigate to go to the user profile setting.

Yeah, I'm going to set up a new IP arrange just for her enterprise. And one thing I do want to call out here. This can be a little bit tricky identifying these IP ranges. And you can see we give a notice to Alex on the screen. Hey, make sure you're doing this right. So she checks with her IT team. And I want to encourage all admins to work closely with your IT team to make sure you've got these right before you enable this setting.

That's a good point, Mike. So we also want to make sure that when Alex enables this setting, the IP ranges are set up. Otherwise she may be risking locking her users out. Okay, now that The IP ranges are set up. Let's go ahead and enable this.

Here comes the fun part.

All right. Absolutely. Let's do a quick refresh and see what happened to the score.

All right.

Calculating in real time. There we go.

That's how easy it is. Few clicks at the very start of her day, Alex was able to navigate into the Health Check dashboard which gave her that one stop shop view into her organization's security score status and actionable insights that she could act on and improve the score immediately, thus improving the security posture. Let me ask this question to the audience. How many of you know your health check score for your orgs? Good. So if there is one takeaway I want you all to take from my talk track, it's going to be this. When you go back to your health check orgs back on Monday or however sooner you can, or if you're leading a team of administrators, ask the administrators for the health check score and challenge them to bring it up to 100%. This one action can itself improve the security posture for your salesforce org immensely. Start off by enabling the simple configuration checks such as Multi Factor Authentication and IP allow listing. Starting off with these and then going on and adding additional dozens of other security checks through Health Check will be extremely beneficial and improve this posture. And in addition to that, I'm super excited to also announce that coming spring we're also adding some additional features to the Security Health Check dashboard. Instead of the administrators going to the dashboard and checking the score every time they need to check it, they can opt in for a score change, notifications to be received over emails, and also we are adding additional signals to the scoring algorithm. These all will be available through the Health check coming spring as a new release. The key is to be proactive about security. The best security in the security space is to have a better defense which in turn turns into a good offense. I'm going to share five basic principles that every Salesforce organization administrator should focus on to improve the posture for their organization. Start off with this technology can only take us so far. People, your employees are your first line of defense. Enable them through security awareness training. Train them so that they can identify social engineering attacks, phishing emails and other such scams so that they don't fall for these scams. Follow the principle of least privilege. Your administrators are your privileged users. They have the keys to your kingdom. Your kingdom is the salesforce org and the crown jewels within this kingdom is the data that is within these orgs. Would you give the keys to your kingdom to Everyone. No you won't. Likewise, restrict the access the administrative level access to only people who need to have this access. Enforce multi factor authentication. This is a very simple yet extremely powerful control. Enable MFA for all users. When you enable this, if the bad actors get access to your password, they can't just walk right in. They will be challenged for the second level authentication which will block them from walking right in. Restrict IP login ranges. We saw this. Alex was able to do it. IP allow listing enablement is an extremely strong control which will make sure that trusted users through trusted network are the only one who are able to access your organization. And as Kelly mentioned, add your security contact to your salesforce. Org. We have a QR code here. If you scan this QR code it will take you to the security.salesforce.com, which has links to various security enabled material as well as educational content. Through our trailhead sites we know that enabling the least principle, the restricting the administrative access to users takes a lot of clicks through the user permission setting. And we know that we have heard it loud and clear from our administrators and customers that there are over 1200 pages to be navigated through the setup page. To help with that, we are extremely excited to announce this week that we are launching Setup now with AgentForce. This is a personalized intelligent AI agent available to all the administrator right at the setup page where the administrators can navigate with setup with AgentForce right at the setup page without needing to move away from the page and perform complex tasks as managing their user permissions. And the best thing of all, it doesn't consume any credits. So it's in pilot right now, beta right around the corner. Please check it out with that. I'm going to hand off the mic to my amazing colleague Marla, SVP of Product Management to talk about the enhanceable.

All right, thank you so much, Prashant. That was awesome. Hi everybody, I'm Marla Hay. I'm the SVP of Product for Trusted Services. I am so excited to be here talking to you all today about security in our first ever security keynote. Because I know if you're here on a Thursday afternoon to listen to security, you probably live and breathe this stuff just like all of us up here on stage today. Okay, so Kelly talked a little bit about the Invisibles. We heard Prashant review the configurables and I'm here to talk to you about the last layer, the enhanceables. So these are our powerful capabilities that allow our customers to go above and beyond what comes out of the box and do some additional data protections. And I am especially passionate about this last layer because I have the honor of leading the unbelievably brilliant team of product leaders, some of whom are in the audience today, today, who work with you, our customers, some of who are also in the audience today, to innovate and create these incredible capabilities to try to answer the call to the challenges that we're seeing around security. And as Brad mentioned, those threats, those challenges, the things that you're seeing out there are changing rapidly. It used to be that even just a couple of years ago, we really were seeing, like our most highly regulated industries have to worry really significantly about changing regulation, cyber threats, etc. But now every single customer that has sensitive or valuable data, which is pretty much everybody in this audience, has to think about things like breaches, losses, and attacks like we just saw with mk. It's just becoming part of the. Part of doing business. And we're super thrilled to explain that we've got a powerful new set of capabilities in this space that came to us last year with the acquisition of own. So we heard from you, actually, after we announced this incredible excitement and that there was a hugely loyal following around this company for customers who were trying to do things like backup and recover their data or archive their data to improve performance and do things like seed realistic but not real data in order to help minimize their risk and their exposure. But let's not just talk about it. Mike, will you help me show everybody the power of these capabilities?

Let's do it, Marla.

All right, so, okay, so we just looked at Alex, our admin, and when we last left her, she was doing a routine security health check. But, you know, some time has passed. Her org has matured. She's getting more and more data, more and more orgs. Maybe they're based on business unit, maybe they're based on region. And with those new orgs, she's got admins that are managing each one, and they've all kind of got their own way of handling security. So now Alex is kind of feeling like she's losing a little bit of control. She's losing a little bit of that centralization, and she really needs to get that single pane of glass to better understand how do I do security across all of my Salesforce orgs. And for that, she's going to be using Security Center.

All right, so here we go. This is Security Center. This allows Alex to get an aggregated health check score view of all of her orgs so that she can ensure consistency at scale and make sure all of her orgs are in compliance. She can do things like see user access and permissions, who all has that very powerful view all data permission across all of her orgs. And she can even deploy security policies to her orgs. So for example, remember those trusted IP ranges we set up? Why not deploy those out to multiple orgs production and sandboxes, or deploy a new health check baseline or here's one. She's got a password policy that's already been set up. So if we take a look at that, let's change that complexity to use special characters and then we can choose which salesforce tenants we want to deploy to.

Awesome. Great. I mean this is really what we're talking about, right? Cause now she's got total control. She's got consistent password policies across her whole entire organization. Okay, so now Alex is going about her day, everything's fine. She's just going to open up a totally random contact record and. Oh God. All right, you know the security workers work is never finished here, right? Because now we've got a credit card number sitting in a notes field. I'm sure whoever put this in here was very well meaning and just trying to save some customers a little bit of time, but holy cow, it is incredibly risky to have a credit card number just sitting in a notes field.

Like.

That's right. That's right. It really shouldn't be in the notes field. What I'm going to do, let's say Alex wants to mitigate this. One thing she could do is put it into a custom field. Let's put the expiration date and then watch what happens when we click save here. It moves the actual number to a. To a field that is encrypted with SHIELD platform encryption and hidden from view of most users. All right, so only specially permissioned users can see that. It also masks the credit card number. So the user can still see that. But we can also take a little bit further by. Well, we want to make sure we take it out of the main field here. So let's.

Do that.

And just like that. There's obviously some process that needs to be put in place and maybe some user training, but she's got to start on protecting that data.

All right, well that's great. I'm glad to see that. I think that's great for that one instance. But man, if I'm Alex, I'm thinking to myself, well, geez, that was like one random record that had a credit card number in it. Where else Do I have data that is totally in a place it shouldn't be? I don't even know what else is in these notes fields. Like who knows what could be in there. Alex really needs a way to figure out how do I find all of the sensitive information that's just been sitting in random places in my org. Well, fortunately for Alex, she doesn't have to guess about that because she is going to use Data Detect to go find all of those hidden, sensitive pieces of information, right?

So Data Detect allows her to scan her org for personal information or other sensitive data. So she's got a policy that's been set up and it's been running over her data and we can take a look at the results here. Now she can see here just for the contact object, there's a few fields that have. Well, she's found like six, seven different patterns out there that include Social Security number, phone numbers, email addresses and so forth. But let's concentrate on this notes field. She knows she's got credit card numbers in there. She's also got looks like some phone numbers and some other things. So she wants to classify this field. So she'll classify it as PII with the data sensitivity level of, let's say, confidential. Now this is not prescriptive. Data classification looks different for different organizations, but this is one way she can start to get a handle on it. Let's go apply those changes. And once she's classified the data, then she can use that metadata on those fields to drive protection with other parts of the platform, whether it's encryption or transaction security policies. So for example, she can go to event monitoring and she's got a transaction security policy set up. This one blocks downloads of data because we don't want users downloading data in that notes field if it's got sensitive information, because once it's downloaded, we lose control of it. So she's going to enable this policy which will block downloads of reports or other API calls, whatever. If it has a field that's been classified with that PII or confidential tag.

Oh great. I mean this is a great way to do this for right now. Just to make sure, let's stop the bleeding. Let's make sure we're not sending notes fields with crazy stuff in and out into the world. Especially now that we know that there's sensitive information in there. Let's see how this looks from the user's perspective. So let's say I'm a user and I try to do this. What's going to happen?

So imagine A user running a report. We've got one out here on contacts and accounts and this report happens to have that notes filled in it and there is some sensitive data in there because we're still working on redoing our procedures. So we want to prohibit that download. So if the user goes and tries to export this data to a spreadsheet, it's going to get blocked.

Great.

And also there is an alert that will go out to the security team and Alex so that they understand what just happened. There's been someone tried to download some data so that they can go and then look into that and see what's.

Going on with it. Great. Very clear for the user, very clear for the security team. We've got some next steps. We're gonna go help that user get what they need without trying to export, accidentally export some sensitive data. I love it. Okay, so let's think even bigger now though. So wouldn't it be so helpful for her to also be able to see what's going on outside of her Salesforce. Org. So stick with me for a second. Right now within Salesforce we can look at things like for example impossible logins. So that's like if I tried to log into Salesforce from San Francisco and then at the same time I tried to log in from Chicago, we can catch that say eh, that's not actually feasible. So this is probably, this is sketchy, we're not going to let that go through. But what we can't do is say well we had somebody log in from San Francisco in Salesforce and then somebody that same user log into a totally different system and that could indicate that a user's profile has been broadly compromised. We really need a way for admins like Alex to be able to connect the dots across her entire Salesforce footprint. Which is why I am so excited to announce here at Dreamforce that, that we've launched Secure, that we are launching Security Mesh. So this was built in conjunction with our phenomenal industry leading partners like Okta and CrowdStrike to help our admins like Alex be able to connect the dots across different systems. So if we take that same impossible login example now through let's say Okta, I could know if somebody tried to log in to Salesforce in San Francisco and at the same time they tried to log into Workday in Chicago and, and it's the same user, I can then catch that, stop it and block it, which is really exciting. But we're really adding a lot of work not through Security Mesh but in general to security teams across the world. With the number of elevation of threats and attacks that are out there, security teams are telling us they're spending over half their time doing deep dives into investigations. And we really wanted to figure out a way to make that work better for everyone. Which is why we're also really excited to announce that Security center has now been enhanced with AgentForce. So what that means is now we've got an agent, a security agent that sits inside Security center that is automatically running to help surface anomalies, bring them to your team, provide remediation sets and help you get to the next step. Step Mike, can you show us a demo of what this looks like in somebody's org?

Sure, yeah. So this also starts with Slack. Alex and her security team receive an alert that there's been a new investigation that has been created. So she clicks on the link and it takes her straight to Security center where her and her team can look at all of the investigations that they're working on. She can see here that there's been a session hijacking attempt. And also it's important to note that these were not created by Alex. They were created by Agent Force and triaged automatically. So let's take a look at this, Marla.

Very cool. We can see all the data is right there. I think we've even got a timeline in here. And then if we want more information, we can ask more questions like what's going on with Dan Ross? Why does he have access? What's he have access to? What's he been looking at?

That's right. And they can even ask more questions like how does Dan Ross have access to the financial account object and get the actual permission set that granted that. And Agent Force even suggests the next action, for example, removing access. And then more than that, Agent Force will suggest a full mitigation plan to go along with it.

Great. So now she can freeze the user and close out that investigation and we're good to go. Okay, but we don't. It doesn't stop there because in addition to that, we are really thrilled to be able to announce that Privacy center also has added Agent Force. If we could go back to the slides. So you can think of this as your Rosetta Stone. Between a whole bunch of changing regulations and compliance that you need to manage and the actions that you're going to take in order to help maintain compliance. So Privacy center with Agent Force, the compliance agent will allow you to. Will allow you to automatically bring those regulations into actionable policies. Things like data retention or PII masking so that you can support compliance automatically with an AI agent. Okay. And so all of these things, security mesh, security, security center and privacy center with agentforce are available for you. Now please go get hands on with those or check them out later on Salesforce Plus. Thank you so much with that. I'll hand it back to Brad.

All right, thank you so much.

Thank you, Marla. And thank you to Prashan and Kelly. So we just got that quick run through of the invisibles, the configurables and the enhanceables. And this is just the beginning of what we all need to do together in order to establish the foundation of trust that we need to bring in this agentic future. And so everything that we've covered today is just the beginning of your learning journey. And so what we want to leave you with are some concrete ideas on how you can elevate your readiness and improve the security of your environment and your resilience against these types of threats. We have a lot more information available and so you can see this information here behind me. And with that, I want to bring our first ever security keynote to a close. Just say thank you so much for being here with us. We had a lot of fun. Thank you.