Today on the Salesforce Admins Podcast, we talk to Laura Pelkey, Director of Customer Security Communications & Engagement, and Kylie McKlveen, Director of Product Marketing at Salesforce.

Join us as we chat about how admins can level up the security of their orgs using a simple framework for understanding security in Salesforce.

You should subscribe for the full episode, but here are a few takeaways from our conversation with Laura Pelkey and Kylie McKlveen.

The three key areas of Salesforce security

Security can feel complicated and unapproachable, especially at the pace at which the Salesforce platform is evolving and changing. How can admins keep up and make sure that their org's data is protected?

Luckily, Laura and Kylie are here to help. It starts with a practical framework for understanding Salesforce security. They break it down into three key areas:

Invisibles: What Salesforce is already doing to protect your org. Examples include network-level security, infrastructure, application-level security, and a global 24/7 threat response and monitoring team.
Configurables: What you can do as a Salesforce Admin to improve your Salesforce security. Think security settings, controls, and layering permission sets to follow the principle of least privilege.
Enhanceables: Extra steps you can take to protect sensitive data or meet industry-specific regulations. These are tools you can add to your org, like Salesforce Shield, Security Center, and Salesforce Backup and Recover.

Put it all together, and you have a clear plan of action for how you can level up the security of your org.

How Agentforce will bring agentic security to your org

"There's a lot of amazing AI technology out there now," Laura says, "but unfortunately, the attackers, the hackers, the bad guys, whatever you want to call them, are also leveraging this technology, and they're doing so in ways that make it harder to spot when malware is happening."

In the Dreamforce Security Keynote, they demonstrated this by doing a live deepfake of a Salesforce executive. It's getting easier for attackers to use AI for social engineering or even just a better-worded phishing attack.

Luckily, Salesforce is fighting back with two new features coming soon. With Agentforce in Security Center, you will be able to detect, investigate, and remediate threats to your org with a simple conversation. Agentforce in Privacy Center will help automate some of the hard work around complying with constantly evolving regulations.

These new agentic features will make security and compliance faster, easier, and more accessible.

Walking through the security steps you can take right now

For now, Laura and Kylie's advice to improve your Salesforce security is to dive into the configurables. The "Trusted Enterprise Security" video series is a handy guide to walk you through all of the steps you can take to drastically improve the security of your org.

Check out the Dreamforce Security Keynote on Salesforce+ to learn more about what threats are out there and how you can fight back. And remember to subscribe to the Salesforce Admins Podcast so you never miss an episode.

Podcast swag

Salesforce Admins on the Trailhead Store

Learn more

Security Keynote: Protecting the Agentic Enterprise
The 360 Blog: Laura on security
The 360 Blog: Reduce Manual Security Tasks With Agentforce in Security Center
The 360 Blog: Automate Manual Compliance Processes with Agentforce in Privacy Center
YouTube series: Trusted Enterprise Security: Built on Salesforce
Meet the Long-Lost Fourth Member of Snap, Crackle and Pop

Admin Trailblazers Group

Admin Trailblazers Community Group

Social

Full show transcript

Mike Gerholdt:

This week on the Salesforce Admins Podcast, we're diving into some security framework that you've either seen online or at Dreamforce, specifically wrapping your head around invisibles, configurables, and enhanceables. So this week I am joined by longtime podcaster and security champion Laura Pelkey and new voice and new to the Salesforce Trusted Services Team, Kylie McCleven. They are both here to help us unpack how we can think about the security layers baked into the platform, the settings they control, and the tools available for us to go even further. Plus we also jump into a little bit about what AI means for keeping your org secure. This is a fun podcast, and we also bring in a little bit of pop culture. I won't ruin it, but Sylvester Stallone does make an appearance in this episode. So with that, let's get Laura and Kylie on the podcast. So Kylie and Laura, welcome to the podcast.

Laura Pelkey:

Hey, Mike.

Kylie McKlveen:

Hey, thanks for having us.

Mike Gerholdt:

I know. This is going to be fun, even though... Well Laura's a long time podcaster, so she makes security fun, but Kylie's a new voice. So Laura, let's start with you. Refresh everybody, what you've been up to at Salesforce since we've last chatted.

Laura Pelkey:

Yeah, I know it's been a little while. I'm very happy to be back on the pod. Thank you for having me. So I'm actually coming up on my nine-year anniversary at Salesforce, which is crazy. Can't believe it's been that long. And lately I've been at Dreamforce speaking, writing a lot of blogs about security, and still just trying to get the word out there to our customers about how to be secure with their Salesforce data.

Mike Gerholdt:

Yep, absolutely. And Kylie, you're a new voice to the podcast, so welcome. Tell us a little bit about how you got started at Salesforce and what you do.

Kylie McKlveen:

Thanks, yeah, what do they say, long time listener, first time caller? So yeah, I work on our product marketing team for our trusted services products. I've actually just joined this team within the last year when Salesforce acquired Own or formerly Own Backups. So loving my new role and really excited to work with Laura and yourself working with customers on helping them with their security.

Mike Gerholdt:

Now, trusted services sounds big and massive and like a lot of stuff. What are some of the products that maybe Salesforce admins are familiar with that fall under that umbrella?

Kylie McKlveen:

Yeah, that's a great question. So Shield, Salesforce Shield, which consists of event monitoring, data detect, platform encryption, and field audit trail. It's also security center. And then with the acquisition of Own, we also added backup and recover, archive, data mask and seed, so that was enhanced with seeding capabilities. We also have privacy center. So those are some of the products admins would be familiar with.

Mike Gerholdt:

Yeah, no, I think we saw a few of those in the admin keynote. So Laura, you're still on the mission and I'm with you on security-mind...

From Invisible to Intentional: A Practical Way Admins Can Approach Salesforce Security