Trust Across Agents, Data, and Platforms | Security Keynote, Dreamforce 2026

Please welcome General Manager Security Salesforce, Gagan Gulati.

What an incredible video! It's always great to see how our customers are using our products to make their life better. This is my first Dreamforce, and I'm so excited. To be here with all of you. I want to start by saying thank you. Thank you for being a Salesforce customer, and thank you for the trust you have put in us to help you secure your data while you are using Salesforce. And thank you for now doing the same thing as you move towards the world of agents. Now, I may be new to Salesforce, But I can tell you, I've been in software industry for a few decades, and the gray hair show a little bit of that. So back in the old days, and it's funny I say that, back in the old days, back in the day, how did you get to work? You had a badge, you had your photo on it, you'll take it into the building that you're gonna work at, you get to your computer, you get your work done, and you log out, right? Many of us, if not all of us, did that, and we used to call it perimeter protection. Keep the bad guys out, and you'll generally be safe. We all felt pretty safe about it, I'm sure. I know I did. But then the world started moving further. We went from the phase of perimeter protection to using mobile. Then came the world of remote. I mean, I think all of us over the last few years have experienced that. And now in present day, we're talking about the world of AI, agentic enterprise. This is the world where we have autonomous agents. These agents, they don't have to log in. They don't have to work in front of a computer for 8 hours or 10 hours, and they don't have to log out. We are living in a very different world now, and we have to secure it differently as well. Now, I may be here only a few months, but it's been an amazing journey the last few months. The passion and the drive with which we are protecting our customers' data, and the same passion and drive with which we are now working towards protecting the agents that run against those customer data. It's been a fascinating ride. And I'd like to say that we are not just a CRM company. Salesforce is a security company. Now, every one of your companies is going through the agentic transformation. You heard that from Mike— Marc earlier today, whether you know about it or you don't. So it's not a matter of if anymore, it's a matter of how. How are you ensuring that your company becomes an agentic enterprise? And how are you ensuring that you're securing your agentic enterprise? And I tell you what, in this new agentic enterprise, your, and actually my, job have definitely changed. Our jobs have changed because we have doubled the responsibilities that we used to have. On one hand, we have to go secure the AI. Now, what does that mean? It's about ensuring that your AI is defensible. When you think about AI, think about data, data classification, data access governance. Then you have to think about models. How are you gonna secure your models? Then you have to think about the MCP servers. Then you'd think about agents. The whole gamut. AI is now an asset class of its own, like platform and infrastructure is. After that, you have to think about securing from AI. When you think about securing from AI, you have to think about how are you gonna defend your company from the attackers who are bringing AI to the battlefield? And this is about AI-driven threat detection and response. It's about detecting in minutes, not days and hours, which you were okay doing in the past. It's about being a lot more proactive than reactive. So jobs become scary, but at the same time, very exciting. People like me have a lot more to do now. And in the world that we live in, the previous security models, the traditional security model as we call it, well, that is getting broken. And why is that? See, the traditional security model was designed for humans, and agents are breaking that design. Remember 20 years ago or 25 years ago, sitting in front of a PC, doing your job, and then getting out of there. That model is designed for humans. You log in, you do your work at home, at office, on your mobile, in an app or a browser. You do it serially, and at some point, you're done. You log off. That's the assumption that most security models have made over decades. Agents break that design. Agents break the design because agents are by default ephemeral. Multiple agents come together to take actions that you have asked the agents to perform, and agents are relentless. They don't have to work eight hours a day. They don't have to log in, and they don't have to log off. That's the world we live in today. So that traditional security model is broken, and now. What do you do? Well, that's what we have been trying to do here at Salesforce. Security is the foundation of the agentic enterprise, right from the Data 360 layer. How do you want to make sure you are classifying your data and you're ensuring that only the right people have access to the right data? And by people, I mean humans and agents. Customer 360, ensuring that this trusted context is only available to the right people. Again, humans and agents. Agent Force, ensuring that these agents are acting but with guardrails. And last but not the least, AI Force, which is about intelligent interface with trust and security built in. Now, this entire Foundation is based on what we call Salesforce Guardian. Salesforce Guardian is what we are rebranding what Trusted Services has done over the last decades for data security, data compliance, and data resilience. And now we are taking Salesforce Guardian to agents. But it's not a theoretical exercise. We have more than 24,000 customers today across the globe protected with Salesforce Guardian, and we are only getting started. Now, in the new world that we are in, when it's about security for the agentic enterprise, we think about it from 3 big pillars: data security, platform security, and agent security. And to talk about data security, I'm going to invite on stage Christine Magnusson, SVP of Solution Engineering. Please give her a big round of applause. Take it away.

Thank you, Gagan. Happy Dreamforce, everyone. Day 1. I love it. Well, I am privileged to lead our go-to-market technical teams for our tech, media, and telco business here in the US. And I'm thrilled to be in front of this particular audience today because security, y'all are having a moment. It is getting pretty crazy out there. Am I right?

Yes.

And we all know that we need to evolve how our businesses treat security. And I would argue that the basics are more important than ever. So we're gonna start where every good security review does, data. Data is the foundation of your business. It fuels every insight and workflow, and now every agent action and decision. When it is trusted and secured, businesses are more empowered than ever before, and that's exciting. We want our businesses to move forward and move fast, but this is easier said than done because the reality is, is data is— oh yeah, data is flowing through. It's flowing through your platforms, applications, hyperscalers. It's hard to track, let alone protect. Now, this is not a new problem. In fact, we have been showing you slides like this for years. But the reality is, with the advent of agents at scale, it's a massive security risk. Because giving the access of your— of agents to raw, unfiltered information that is your data is like giving away the keys to the kingdom. So Safe AI requires that you have complete control over every aspect of your data that gets exposed. Now, if you're like me and you find this very overwhelming, I find it's easy to start with 3 simple questions. Where is my sensitive data? What actually is sensitive about that data? And is that data already protected? Now, we can start by answering these questions with 3 simple steps. First, discover full visibility into where your data lives across platforms and applications. This is not just about Salesforce. Second, classify. Find the data, tag the data, classify the data. What's sensitive? What's regulated? What's safe for an agent and what's not? Third, protect. Take that classification and put real guardrails around it. Real governance, attribute-based, trusted, making sure that that classification can come to your life and your business. Now, I've been through some security reviews with some people in this room, which kind of freaks me out a little bit, actually. And I know that every environment is different. Everybody's architecture, technology, tools are in a different spot of their security lifecycle. Just know that no matter where you are, Salesforce is here to help. We Whether you're inside Salesforce with Guardian, or whether you're working across the enterprise with Informatica and Clair AI, we're here to help you make sure that you're secure across that discover, protect, or classify and protect. But I'm a solutions leader, so I would much rather show you the product than to drain this slide. So at this time, I'd like to welcome Carl Brundage, Distinguished Technical Architect to join me. Hi, Carl.

Hey, Christine.

Great to see you. All right. Can you talk us through what Jordan, a financial analyst at a bank, needs to do her job and maybe what she doesn't?

Yeah, let's take a look at that, Christine. Jordan starts her day in Claude reviewing her upcoming schedule. There's a portfolio review at the end of the day, so she's going to ask an agent to prepare a brief for her. What this agent will do is it's going to go and pull data out of Salesforce about the client. It's going to look at the core banking systems, give back information about the portfolio, the holdings, and more. A pretty comprehensive picture.

Hey, hey, hey, hey, Carl. Carl.

What?

One, great use of Salesforce and Claude. Looks great. But I see a major problem. That tax ID, Jordan does not need that to do her job.

Yeah, you're right. When we think about it, agents, they just don't necessarily know one field is different than another, and it needs to be treated as confidential information. You said it before, you can't protect what you don't know about.

You sure don't. So, what— let's dig into the Salesforce data behind that and get that classified.

Sure. I'm going to go over to Tag Manager in Data360, and I'm going to look at that client data model that has that tax ID. So I'll find the tax ID field down here at the bottom, and it has been tagged. It's a government identifier. So we can look at that particular tag, and I think I see what's going on. Look at this classification. It doesn't have confidential information, but don't worry, we can, we can fix that fairly quickly. I'm going to come over and I'm going to look for my government tag and what I will be able to do. We can see the classifications again. I can go in and say, let's attach a new one. And I've already built different levels. We'll put confidential. We'll go ahead and save that. And then what we can see is anywhere a field has been tagged and now is confidential information.

Okay, so fantastic. It's tagged now, but what's going to stop an agent or Jordan herself from going in and looking at the record and just seeing it in a field?

Yeah, that's this policies tag. We have, wherever we see confidential, a client identifier protection policy. What that does is that enforces the rules that we have across the bank. Whenever there's confidential information, we're going to mask everything but the last 4 characters. That's all a person should see when the data is set to confidential. So that means if, you know, Jordan or the agent is coming in, by default, they're not going to see this. They don't have to remember. So we can go even a step further. We may have some people in our tax department that do need to see it, so we can put in exceptions and say, well, they can view unmasked data.

Fantastic. All right. Can we now see that back in Claude? Did you actually fix anything in there?

Sure. Let's go back. We're going to go and give the same prompt. We're going to use the same agent. It's going to start gathering the information. And yes, right there, tax ID is covered. And now your data is protected.

Of course you fixed it, Carl. You're like a modern-day security hero. Well done. All right, well, there's one piece of data, type of data that we haven't really addressed, and that's the type that doesn't actually fit into a structured field or record. Like, I would never put sensitive information in an email, but my mom sure might. How do we protect that data too? Well, with that, we're excited to introduce unstructured data governance. This is for all of your messy types of data, PDFs, emails, files. Carl walked through what it was like to discover, classify, and protect within Salesforce. Now you can do it across the enterprise no matter what type of data you're working with. All right, let's zoom out from one instance to a massive security operation. I can't think of anyone better to talk about this than Pete Thurston, VP of Product Management. Pete.

Thanks, Christine.

Yeah, well done.

Thanks. Don't go anywhere. You got work to do here in a minute. Thank you all for coming to hang out with us here today. My name is Pete. I've worked on this platform for most of my adult life. I've been a customer, I've been a partner, and now I'm very proud to be part of the product team that builds a lot of this cool stuff and gets to come to Dreamforce and share it with you. So, thanks for making security a priority. Thanks for hanging out with us this afternoon, and let's get into it. So you just heard a lot about data. You heard about how important it is to know what data you have so that you can protect it the right way. We're gonna take that and take it out to the whole platform. How do you apply that same approach at a broader level? Now, as your organization grows, your platform and your apps, they grow right along with you. And the thing is, we've built this platform to go fast. We want you to be able to move at the speed of your business. We want you to be able to build fast, to integrate fast, to automate fast, and we're not here to slow that down here today. But what we are here to talk about is how do you do that with a trust-first mindset and the confidence to know that you got it right as you went? So, we know that security is a partnership, and I think you've probably seen some version of this shared responsibility model before. But I want to really make it clear that there are 2 sides of this. And at Salesforce, we take our side of the shared responsibility model extremely seriously. I see a lot of faces in this room that work tirelessly every single day to build a highly available, highly resilient Hyperforce infrastructure so that when you come to work in the morning, you know Salesforce is just going to be there for you. And we've got a world-class security team working around the clock, around the world, to protect every single Salesforce customer and all the data that you're processing every day. But then there's this context that only you can bring to the picture as a customer. Only you really know your business, your processes, your users, your agents. And so that's how we build this trust together. We build tools and we provide information and we work collaboratively to make sure that you can apply those tools the right way for your business. So I'm very excited 'cause they're letting me brag a little bit today. I get to share some really cool stuff that my team's been working on. So I've got 3 awesome things to share with you from Security Center today, and we're gonna jump into it first. We know that partnership that I just talked about, it only works if every customer has the tools they need available to them wherever they are on their security journey. So this year, we were super excited to be able to launch a version of Security Center for every single Salesforce customer at no additional cost. It's called Security Center Essentials. If you're not familiar, it's a single pane of glass that pulls together several key configuration metrics to be able to monitor not just where your security is now, but how it's evolved over time. It's things like your health check score and all of the things that go into calculating that, but also what connected apps do you have installed, what login IP ranges are configured, and on and on. So we're really excited about that. And as Gagan mentioned, Salesforce is a security company. We believe in that deeply. We also know we're not the only security company on the block. There are world-class organizations who have been building amazing security tools for decades, and we've been building partnerships with them all along. We know that our customers are using up to a dozen different security tools to protect their entire enterprise, and we want to make sure that when you apply those tools to a Salesforce ecosystem, they work as you would expect. And so we've built those relationships over time. What that means, though, is that we've got a lot of customers using a lot of different tools, and that opens up a very interesting problem and opportunity. When you're working with all these tools, it can be hard to get the signal from the noise, and that brings us to our second big announcement. With Security Mesh as part of Security Center, we're able to connect those disparate security signals from some of the best security companies in the world, pull them together, harmonize them, put 'em on a similar path, make 'em speak the same language, and really turn all that data into a plan, and ultimately, a much more complete picture of the risk that you're facing within your Salesforce environment. But speaking of pictures, Carl, can you help us out? Can we just take a look at what this thing looks like? 'Cause I kind of, I've been rambling a little bit.

Sure, I'd be happy to, Pete.

Okay, thanks, man. Oh, there it is. All right, we're gonna introduce you to Marcos now. Marcos is a security-focused admin at our bank here today. And Marcos is starting his day just kind of making sure that the data that he thinks is flowing into his Security Center really is. And so, what we're looking at is on the left-hand side, you can see several different signal sources, and these are companies you recognize. This is CrowdStrike. This is Okta, right alongside Salesforce's own event monitoring data. And you can see that this data is flowing through over into the right-hand side where we have our categories. Now, We leverage a standard called the Open Cybersecurity Schema Framework, OCSF, because that is a lot of syllables. OCSF has these predefined categories that help us take those various signals, bring them together, normalize them, and make them just make sense in categories like authentication and API activity. Now, Carl, now I know my data is coming in. That's great. Like, what's— what do we do?

Let's think about, Pete, when we have authentication data coming together. If you just had Okta by itself, you get an odd login, you go investigate it, more often than not, it turns out to be noise. Now, we've aligned that with Salesforce. So, when Salesforce generates an alert because something atypical has happened, there's some API activity, and you have an odd login from Okta, That's real signal. That means Marcos can focus on the things that really matter and not suffer from just alert fatigue.

Amazing. So we can trust our alerts, but I don't see any alert. I don't see any alerts here. What are we talking about?

Well, let's take a look at Marcos's investigation dashboard because that's where he's going to work. Oh, okay.

This makes a lot more sense now. Okay, cool. So we have our data flowing in and— but where do I start here?

Sure. If we think about the way this works, inside of a security investigation. Event monitoring in Salesforce, it raises an anomaly when it sees something atypical. In Marcos's case, he's looking at a report anomaly. Something happened with a report that the system flagged. Now, that's where Security Agent comes in. It goes and combines information, correlates to all the logs it has available to give you an incident summary, a risk score. There's details, locations, There's even a timeline of the different activities down here at the bottom.

Wow. You and I have both been working with security teams for a very long time. This takes hours or days to stitch logs together sometimes. This is— but I got to tell you, when you pulled this up, I saw the risk score was like really high. If I'm Marcos, I got some questions here. Like, what do I— tell me more.

Well, that's the next place Security Agent can help him with his investigation. Rather than going into the details and trying to find out why this has, happened, he can, he can just ask a question. And as we parse through this right here, 95% of the score came from the number of rows, which was well over half a million.

Whoa, that's, that's a lot of data. That's a lot of data. How do we shut this thing down? We got to get this thing shut down, then let's figure out where we're going to go next.

So if we think about it, so far Marcos, Marcos has been looking at information and now it's time to take action. So we have a remediation plan. This is his incident response. This is how he's going to treat something like this. It'll start by freezing the user because that's going to make sure that the person's kicked out of the system. They can't log in again and then execute the rest of this plan because now your platform is protected.

Wow.

This is amazing. Thank you so much for showing this. I cannot wait to get Security Mesh into all of our Security Center customers' hands. It's GA here at Dreamforce. And we're super, super excited about being able to pull the signal from the noise and turn that data into a plan. Now, we're getting low on time, but I did promise 3 things, and I've only talked about 2. So 3rd and final announcement, and this is a little bit of a sneak peek. So if you saw that forward-looking statement slide earlier, right? So it's great to know what happened in the past. It's great to be able to use the power of AI to dig into that. It's great to know where gaps may exist within your environment. But we asked ourselves a few questions. What if we could find things we haven't even thought to go look for? What if we could prove that a vulnerability is actually real, not just theoretical? And what if we could prioritize those things to shut 'em down before an external attacker finds them? Good news, we had the right answers to those. And so we're really excited to announce that Red Team Agent is coming to Security Center very soon. Red Team Agent is a unique type of security tool. Typical security tools act kind of like a building inspector, right? They'll walk around your house, they'll say, you know, this door really should have a chain lock on it, or, hey man, we know you got your spare key under that fake rock. Like, that's fine, that's great, that's very useful. Red Team Agent acts more like a burglar, but like your friend whose job is to be a burglar, and then they don't like do really bad things.

Yes.

Red Team Agent's gonna break into your house, will find the password that you wrote on the back of the sticky note, will open your safe, will remove your valuables, walk straight up to the front door, and then stop and give you all your stuff back, and everything's fine. Like, we're not going to take your stuff, but then tell you exactly how they got there and help you shut it down before an external attacker has it. So we're really excited about the power of AI here. We know you are too on your agentic enterprise journey. So to talk about how to secure agents, I'm going to welcome my very, very good friend and SVP of Product, Marla Hay to the stage to break it down for you.

All right. See ya. Thank you so much. Wow, God, look at this crowd. Thank you so much for being here. Like Pete said, I'm Marla, SVP Product for Salesforce Guardian. And lately, I have been thinking quite a lot about what happens when the things that are accessing your systems are no longer people. So you heard Christine and Pete talk about security for data and security for platforms, and security for agents is the critical third piece of that stool. And as we heard Gagan say earlier, it's because agents are pretty different. They're ephemeral. They come from all over the place. They are editing your data. They are creating your applications. And they're making their own decisions. So I wanna pose a scenario to all of you. Let's say you had a new employee starting at your company. Your security team would know about it. Hopefully they've done a background check, they've added permissions, they've created profiles. But now, how many agents were onboarded into your systems this week? Do you know? Well, the fact is agents are onboarding into every single one of our systems every single day, but they're doing it without the same rigor that we would use with humans. And this phenomenon is only accelerating. The IDC predicts a 10x increase in the number of agents in all of our systems by 2027. That means if you have 1 agent right now, you're gonna have 10. If you have 10 agents right now, you're gonna have 100 by next year. It's crazy, right, Carl?

Yeah.

And this is because everyone in your organization is rapidly trying to add agents into all of those systems. So your attack surface isn't even growing linearly, it's compounding. And the question is not whether you have agents in your system, You already do. It's whether you can see them. And if you can see them, whether you can trust them. Now, we're all wrestling with this, Salesforce included. And so, what I wanna do now is bring up a customer onto the stage who's just really taken this head on. Capita is a London-based business process services company that mostly services government and regulated industries. And they aren't just experimenting with agents. They have got hundreds of agents running in production that are affecting things that customers are using every single day by the millions. And so without further ado, I wanna bring up onto the stage my new friend, Tina Stephens, the Director of AI Engineering from Capita. Please give Tina a hand, everybody. Let's talk to Tina. Thank you so much for being here. This is so awesome. I'm so excited to see you in real life.

Thanks so much.

Okay, so you just heard me talk about how we're onboarding agents into all of our systems without the same rigor as we do with humans. And you guys are doing something pretty incredible. You've got over 400 agents running in production. And so I wanna kind of start at the beginning. What, what was really the tipping point for you? What made you realize like, hey, we gotta, We gotta do something about all these agents. We have to do something more like proactive, formal.

Yeah, sure. So I don't think that there was ever really a tipping point per se. We are, like you said, business process outsourcer in the UK, and we work with multiple, across multiple different clients, customers, accounts, and so on. And we have always had a multi-platform strategy. From very early on when agents started to be able to be built in their hundreds and very easily, we knew that we needed to have something that can monitor and manage out the whole of the agentic estate that we have. And those were the sort of thoughts that then we had to have some type of platform that can do this across those different platforms.

Cool.

That's great. So I know, like, we talk about, like, governance and restriction and things like that. A lot of people are gonna hear slow, they're gonna hear bureaucracy, red tape, but that hasn't been the case for you. That Kafka has really, if I have this right, has actually sped up API innovation by 20%. Can you tell us a little bit about that juxtaposition?

Yeah, of course. And I think that, 20% is probably lowballing a little bit. I think what MuleSoft specifically has enabled us to do is to really increase that speed of innovation. So it's not just API development and management, but it's also that agent governance that has enabled us to really go much faster and really get to that value a lot faster than previously. And I think this is— it's doing it because kind of like a couple of different things because it's really given us that visibility onto our estate and also the guardrails that then enable our build teams and also our operational teams to deploy AI agents and build AI agents much faster. And it gives them that safety net that they're able to do this and they know that it's all secure and we're using trusted platforms to do this.

Very cool. Oh, that's great. Okay, so we've got a lot of IT leaders and security leaders in the room with us today who are kind of thinking through this journey, maybe worried about shadow agents themselves. What's one piece of advice you would give to the folks that are listening and thinking about how to get this done?

Yeah, so I think one of the things that was super important for us was to understand the build platforms that you have across your enterprise. Like you said earlier, there's already agents across, people are already building this, so making sure ensure that you have that visibility into that, into those AI-built platforms, as well as then being able to monitor them on a continuous basis. Again, another thing that you said that really resonated with me is like, do you know when an agent is deployed? And actually what we have with MuleSoft Agent Fabric specifically in our organization, we know exactly when and where and how agent is deployed, who owns the agent, and how is it being used. So it really gives us that visibility. So I would say that's definitely one of the key things.

Oh, super cool. That makes a lot of sense. You mentioned Agent Fabric. I know you also have some Guardian products as well, Shield, Security Center, Data Masking Seed. Can you talk a little bit about how Salesforce fits into that trust picture in that way?

Yeah, absolutely. So of course, trust is one of the key principles. And for us, we work across government and regulated industries. So trust is— it really is key with our clients. So the Guardian products that we are utilizing at the moment from Salesforce, as well as the MuleSoft Agent Fabric, it's really given us that foundation layer of that security. Of course, We need to also make sure that we are working with our clients to make sure that those are secure. But the platform products are really giving us the monitoring capabilities as well as the ability to make sure that we know that our agent estate is governed in a way that we want it to be.

Very cool. All right, well, this was so incredible. Thank you for doing that. Seriously, it's so great to have really customers connect with customers here. And so I can't thank you enough for being here and sharing your story with everybody. Thank you so much for doing this.

Thank you so much.

Yeah, thanks. Big hand to Tina, everybody. Thank you so much. So the things that Capita mastered are really so incredible and very cool, but we know that this really cuts both ways. You heard speed, you heard Acceleration, scale, but that can be, that can trigger concerns as well. And we have been talking to all of you about what are the biggest obstacles, the biggest worries, the biggest concerns that you have. And you have told us about 3 things or 3 pillars of things that we've outlined here. The first is shadow agents. This is basically just, I don't know what's running in my system. The second is unmonitored agents. So you may know what you have in your system, but you're really flying blind. You're not exactly sure what they're doing, and when they do complete an action, it's kind of a black box. And then the third is agents without limits. These are agents that don't have any guardrails or don't have the correct guardrails for the things that you are trying to get done with agents in your organization. This one is the most nefarious because it can yield things like exfiltration of data, uh, at a speed that no human could possibly stop. And there's one element that's really missing from all 3 of these things. Uh, and as Tina mentioned it, it's trust. Uh, because really what it comes down to, you need to be able to trust that you can see the agents that you have, that you are able to understand what they're doing, and that you're able to protect your agents and your data. And that's why I'm really excited to tell you about 3 major announcements we have in the agentic space that are tied to these specific pillars. The first thing that we're doing is agentic identity. This is a real, true identity tied to agents, not just users, that you can propagate through your entire ecosystem. The second is Observability Center from Event Monitoring. This gives you complete visibility into your agent's behavior end to end. And the third is Agent Kill Switch from Agent Fabric. This gives you the ability to just stop an agent in its tracks, whether it's the session level, whether it's agent level, or even at the full tenant level. But we wouldn't still have Carl on stage if we weren't gonna do something interesting with all 3 of these announcements. So let's get into what those actually mean, and let's see them in action. So we are going to talk about David Park. He is in AI— he's in AI engineering, and he has got a whole bunch of agents running around in his system. And the first thing that we need to do with David, we have to answer a super basic question for him. What the heck? What's in my system right now? What agents do I have in there, and what are they doing? What do you think, Carl?

Well, to me, Marla, that's not a question you answer with a dashboard. That's something you have to build in from the start, and that's agentic identity. So, when we think about when we— you all want to connect in external agents, start in giving it a scoped verifiable identity, not a shared API key or services account. So, here, what David can understand is really all about that finance analyst agent that we saw Jordan use. He can understand how it authenticates, the type, and the— it's like any authentication provider. He can look at permission sets. So, the standard permissions that you're used to, objects that they can create or update, the fields, but also permissions. So, we think about that view financial data permission. Well, you don't want to give it to this agent, but if somebody else needs it, you can assign it there too. But we're not done, right? We have one more thing. We have scoped access. That's the idea of an agent in a specific context coming together and limiting permissions even more. So David knows now what's connected, what permissions they have. Great first step. I don't think he's done yet.

Oh, I don't think so either, Carl, because we really need to understand what the agents are doing. And that is something that we can do with Observability Center from event monitoring. This gives, this gives David the ability to really understand step by step what an agent has done. So, that means if something has happened, David doesn't need to rely on his memory or have to stitch together logs from 5 different systems. He can just pull up Observability Center, and he's got the full trace.

Yeah?

Yeah. Let's go through and look at that finance agent.

Great.

I'm going to filter down to the Salesforce MCPs. This is how the external agents are connecting in. And what you'll notice below is traces. In the last 30 days, 1,000 agentic interactions. And if you scroll through these, you know, there's a couple of steps, but he can actually change and sort spans and see very quickly that some of these are doing 20 different things. So if he looks at the timeline, he can see a timeline of everything that was done in these 20 steps. 5 seconds by an agent. You and I clicking around a UI, I don't know, 30, 40 minutes.

Yeah.

Maybe more. So we can understand that the agent is working with flows, invoking Apex. Ooh, also creating trace account. So this agent now created an account record in the org. So if we think about it, that finance agent, we really wanted it only to be reading data, But now it's creating data. David may need to act.

Yeah, I think you are right. And we know David has event monitoring, so he has really robust security and security policies for users and agents. But maybe in this case, we just want to kill that thing. We just want to shut it down. And that's something David can do with Agent Kill Switch from Agent Fabric, right?

Yep. So we're going to move into MuleSoft. David has access to all the different agents that are running in his org. And the ones on the screen, they've been flagged for a violation of a rogue agent policy.

All right.

That just means ways where you're looking for things an agent shouldn't do. It's leaking personally identifiable information as a prompt injection. Somebody is trying to get admin privileges. So if he looks at the finance agent, he can see the history. Somebody is trying to get the tax ID. They're trying to bypass approvals. It's time to act. David's going to quarantine this agent. which applies the agent kill switch policy. This, when I click it, will disconnect the agent from any models. It can no longer reason. And now your agents are protected.

Amazing. That was so great. Thank you, Carl. That was awesome. Give it— give Carl a hand here.

Yeah.

All right. So we did— we got agent identity. We understood what was going on with event monitoring, Observability Center, and killed it with agent kill switch. Amazing. So, that is how David and all of you can exercise complete control over your agents and scale them with confidence. So, now to close us out, the best for last, I want to bring up to the stage the man, the myth, the legend, our very own Salesforce CISO, Ian Mulholland, who is going to talk about how do we do this? here at Salesforce. So here's the real magic.

All right.

All right. Thank you. Thank you, Marla.

Appreciate it. All right. Well, thank you, Marla. You know, I'm really, really excited about the momentum around Salesforce Guardian and what it does to help all of you on your agentic security transformations. But, you know, we're all reading the news, and we know that it's a challenging cybersecurity environment right now. And I'll tell you, I personally feel that. Because my team's responsibility, and they're all sat on the front row here, is to protect Salesforce and protect you as customers. But trust has been our company value number one since the start of time. And we take our responsibilities really, really seriously. So I'm very excited to spend a few minutes with you to actually explain how we use all of these cool technologies to protect Salesforce And protect all of you. So one of the challenges with AI-driven threats is that we have to figure out how do we protect customers today whilst also preparing for the future. So we've made some product enhancements, including mandatory security controls that are focused on today's sophisticated attacks while paving the way for future AI-driven attacks. We're making security innovations, and in particular, we have a program that we refer to internally as Frontier Strike that stress tests our products and our systems using frontier models such as Anthropic's Glasswing and OpenAI's Daybreak to make sure we're ready and we're going to be ahead of attacks. And then we also have been partnering with others in the industry to make sure that our long-term commitment to things like zero data retention still hold up in this emerging and new AI landscape. And I'd actually like to invite up John Turo from Anthropic, who we've been partnering with around what is referred to as Enterprise Frontier Safeguards. So John, please join us on the stage.

Thank you.

So, John, thank you. Thank you for having me. Thank you for spending time with us. You know, your team and my team have spent an incredible amount of time together, an ungodly amount of time actually, over the last 3 months, really trying to solve the conundrum of how do we enable all these fantastic, you know, technologies that we saw Mark and Dario present on the stage, But those same technologies, as we know, can be used for harm. And so we've had to figure out, how do we thread that needle? Maybe you could talk about how you think about that and what everybody's role is in solving that puzzle.

Sure. Well, such a pleasure to be here with you, all of you. Our goal is to make sure that every customer is empowered to use frontier models for their toughest challenges. And every one of us has a role to play in doing that. For instance, Anthropic studies how bad actors attempt to misuse AI and what are the attack patterns from that. And we create automated systems that can detect it. Salesforce is the place where customers' data and agents live. And you, since the start of time, have been keeping all of that secure. And the customers in this room know their businesses best. And so if we get this right, we can put all of these things together to be able to act and stay ahead of threats and squeeze the best juice out of these frontier models.

So as we've looked at that, at the end of the day, to be able to thread that needle and to be able to inspect for misuse, Ultimately, data has to be held somewhere, and there's something inspecting it. So maybe you could talk a little bit more about that and how we actually came up with a solution that Mark and Dario talked about earlier.

Yeah, so the most sophisticated attacks today develop over time. It's very different from the kind of attack that would be immediately distinguishable. And that means you need to be able to have a history to compare behavior to. Think about stolen credentials. If an attacker gets the credentials of one customer's individual employee, the first prompt against a frontier model from that attacker may look innocuous. It's only the change in the behavior over days and over months that make that attacker sort of become clear. And so you need a history to compare against. There has been a practice in the industry that we spoke about called zero data retention, that these queries, these prompts to the model get deleted immediately after the conversation is processed. But that leaves no history. And so that's why we have believed that zero data retention needs to evolve. But we also heard from some customers that data retention is a difficult proposition. And so that's why we worked with you, Ian, and with Salesforce and with over 100 customers to have a joint solution that is both safe and also gives customers control over their data.

So that solution is Enterprise Frontier Safeguards, which again, Dario and Mark talked about today. And frankly, Claude Force wouldn't have happened if we hadn't have figured that out. Could you maybe talk a little bit more about how we've struck the balance with control for customers, but also giving them agency?

Yeah, so Enterprise Frontier Safeguards is the name for the joint solution that we came up with together. And the principle is that data stays with the customer and each of us can do our role. So, you know, it's important to mention that Anthropic has never trained on your data. And this has always been true for enterprise customers unless you explicitly ask us to do so. That's always been true, that will stay true. EFS doesn't change that. But what we do is we create these histories of activity against a frontier model, and we store those histories in the customer's own cloud accounts with the customer's own encryption keys where they have full agency over how those logs get stored and accessed. We pair that with automated review from Anthropic that detects patterns of serious misuse, like stolen credentials or cyberattacks. And in the event of a flag, that flag goes to the customer, not to anybody else. And we talked about everybody having their role to play. You all know your business best. So the customers can detect these flags, and decide how to proceed, decide what to do about them. The point of all this, if we pop back up, is that when we each play the roles that we're going to play, every customer can get access to frontier models and do it in a way that is safe and private, and they have control over their own data.

Well, thank you, John. I really appreciate the time you're spending with us. And it's been great as well to see all the hard work that your team and my team put into this over the last several months. and actually see the light of day empowering Cloudforce and so many other solutions. So thank you for the partnership, John, and I look forward to working with you more.

Thank you, Ian.

So, you know, we are on our own agentic security transformation. And one of the things that I want to highlight is that we actually use all of the products that Pete and the product team just demoed to you. And so, for example, Security Agent, which is part of Security Center, my enterprise security team uses that to secure hundreds and hundreds of tenants across our vast footprint. Because unsurprisingly, Salesforce operates the largest Salesforce installation. Security Mesh, we actually developed within my own team. It didn't have a cool name. Pete came up with that, I think. But that was because we had all of our data in disparate systems for both security and availability, and we couldn't make sense of it. And so we meshed it together. And then we use Agent Force on top of that to actually understand what that data means and how to derive value from it. You saw Red Agent previewed. That was actually developed by my penetration testing team. And they've been using that to to deliver scale and reach that previously was just humanly impossible, and it allows us to see so much more of our footprint. And then, surprise, surprise, Slack's a kind of core part of it, and everything sits on top of that. And so what I wanna do right now is actually introduce you to my new best friend, Kali. So Kali is an agentic SOC agent, that works alongside our security analysts in every part of a security incident. Kali triages vulnerabilities, alerts, looks at indicators of compromise, analyzes threat intelligence, can isolate compromised machines, making the analyst much more productive Because they don't have to do the drudgery of collecting and analyzing all the data. The data is represented to them in the place that they work already, which is Slack. But let me tell you where I love Kali, okay? And my boss is in the audience here, so I'm gonna ask him to close his ears. You security people know what it's like. There's an incident, there's something going on in the internet, and you get the text from your boss, Hey, what's up? Are we affected? And candidly, if you're running a footprint the size of Salesforce, a lot of the time I don't know yet. Okay, my SOC may be on it, but I don't know. Kali saves my ass because Kali will tell me— and we've lost Kali there. Kali will tell me with one command a summary of all of our incidents, what's happened over the last 24 hours, And frankly, whether or not I need to care, OK? It turbocharges me. It turbocharges our analysts. And you can understand why Kali is now our BFF. So I joined Salesforce 7 months ago. This is my first Dreamforce. Anybody else a Dreamforce newbie? OK, at least there's a few of you. So I joined 7 months ago because I was so excited by Salesforce's position to really lead the agentic security transformation. And I spent last week out in Europe talking to a bunch of customers to understand what's top of mind for them, and I'm even more motivated to lead in this transformation. So Gagan mentioned at the beginning that we're a security company. Well, here's the deal. Always have been, always will be. And there's even more ways for you to secure your enterprises and your Salesforce instances with all of the cool new products that Pete and team announced. And lastly, we really are here to help you with your transformation. We take our job very seriously, and we take the job of protecting all of you very seriously. So as you continue through Dreamforce, please do take time. to go downstairs to Trailblazer Forest. My team is down there. We've got some very cool hands-on activities. Go visit the campground and hang out in the Data, IT, and Security Lounge. And please, on the right-hand side, there's some other sessions that you really should go and see that will talk about more of the products that we've talked about today and some other cool stuff that we're doing in the security space. So I just want to thank you for taking the time, spending time with us. It really means a lot to us. We take our mission very, very seriously, and I look forward to seeing many of you on the show floor. Thank you.

Thank you.