When “authorized access” becomes the attack path

A practical guide to the 2025 wave of Salesforce data-loss incidents, and the monitoring moves that reduce risk.

Download the White Paper and Action Plan

In 2025, several organizations saw Salesforce data leave their environment without a classic breach signal. No outage. No obvious break-in. Activity stayed inside expected limits.

The common thread: trusted connected apps and legitimate credentials made the access look normal, until you had enough visibility to compare it to baseline behavior.

Download the White Paper

Get the patterns to watch for and a practical first-30-days plan.

The visibility gap most teams still have

Most teams can answer “how much activity happened.” Fewer can answer “did that activity make sense?”

Early warning signs tend to be subtle without history and baselines:

  • off-hours activity that doesn’t match past patterns
  • new locations/IPs appearing quietly
  • shifts in access patterns (objects, sequences, users, apps)
What this means for AppExchange ISVs What this means for Salesforce customers
  • Your app sits on the security boundary: customers will judge you on how well you detect and contain abnormal access—even when credentials are valid.
  • Prove “normal” over time: monitoring needs history and baselines (not just limits) to spot behavior drift across API users, tokens, and connected apps.
  • Ship trust signals: customers want evidence—auditability, anomaly detection, and fast investigation paths—before an incident forces the conversation.
  • Treat connected apps as first-class risk: inventory what’s authorized, tighten access, and assign an owner to every integration.
  • Move beyond thresholds: detect behavior changes across time, location, and app identity—not just volume.
  • Fix retention to enable baselining: keep enough event history to define “normal” and investigate confidently.

In the wake of these breaches, the real lesson is simple: “authorized” access can still be the attack path. When connected apps and credentials get abused, your org can look healthy while data quietly moves out. Download the white paper to learn the patterns that showed up in 2025 and the API monitoring + governance steps that help you catch abnormal behavior early—before it becomes a customer issue.

Download the White Paper