Salesforce's Free Scanner Leaves Security Gap Unaddressed

The widespread adoption of Salesforce among Fortune 500 companies has created a security concern that many executives are unaware of. With nearly 90% of these organizations using at least one Salesforce product, attackers have a prime target for their malicious activities.

According to an expert who has spent 19 years architecting and securing Salesforce as a Certified Technical Architect, the vulnerability lies in the assumption that features such as backup and malware scanning are sufficient. In reality, teams often stop thinking about security once these features are implemented, leading to a false sense of confidence.

A survey by Arctic Wolf found that 63% of IT and security leaders had suffered a significant cybersecurity incident in the past year, yet 96% still reported confidence in their ability to keep pace with the threat landscape. This disparity highlights the need for ongoing vigilance and awareness.

The Coca-Cola breach in May 2025 is a prime example of this vulnerability. A threat group listed the Salesforce database of Coca-Cola Europacific Partners for sale, claiming over 23 million records across 64 gigabytes. What's striking is that some of these records dated back to 2016, highlighting the long-term risk posed by unsecured data.

Salesforce's recent release of Summer '26 scanning has been touted as a security improvement, but it has its limitations. Files are only scanned if they are under 100 MB in size, and uploads through the API are permitted without scanning. Furthermore, notifications to admins are off by default, allowing malicious files to reach users' laptops before being detected.

The real issue lies not with detection rates, but with the universal configuration of the scanner. Every Salesforce org on earth runs the same version, making it a poor place to rely solely for security. An attacker can simply sign up for a free developer org and test files against the scanner until one clears, generating no traffic or logs in the process.

This vulnerability was demonstrated by the author themselves, who uploaded a live trojan to Salesforce's native scanning and found it cleared the first time but was blocked on repeat attempts. This highlights the need for ongoing testing and evaluation of security measures.