Today on the Salesforce Admins Podcast, we talk to Laura Pelkey, Director of Customer Security Communications and Engagement, and Sabrina Simeroth, Product Manager for Security Center at Salesforce.

Join us as we chat about security essentials for the summer and how Salesforce is helping admins protect their data.

You should subscribe for the full episode, but here are a few takeaways from our conversation with Laura Pelkey and Sabrina Simeroth.

Why admins are a target

Security doesn't take a summer vacation. And while AI is helping all of us do more things faster than ever before, it's also helping hackers deliver new types of targeted attacks at scale. And as privileged users, admins are finding themselves in the crosshairs.

Luckily, Salesforce is rolling out key security enhancements over the summer to help you protect your org. I sat down with Laura Pelkey and Sabrina Simeroth to talk about what threats are out there and how you can be prepared.

MFA requirements to protect your credentials

Because AI makes it easier than ever to imitate someone's writing style or even their voice, the biggest threats that Laura and her team are seeing are different variations of phishing attacks. In the end, it's all about getting someone's credentials and then using that access to do damage.

That's why Salesforce is requiring all customers to use multi-factor authentication (MFA), as opposed to the gentle nudging we've done in the past. However, MFA can still be vulnerable to man-in-the-middle attacks, so admins and other privileged users will need to use a stronger phishing resistant MFA. Finally, Salesforce will require step-up authentication for users attempting a sensitive or unusual action, like exporting a large file.

I don't have to tell you that these kinds of changes can often be met with resistance. Laura recommends framing things in terms of what they protect your users from. Does a salesperson really want a hacker to email everyone on their contact list from their account? It's not about making you jump through hoops—it's about protecting you from real risks.

Security Center Essentials and Health Check give admins a central view

We also checked in with Sabrina about how her team is trying to make it easier to get a handle on essential security configurations across the platform and what settings are most critical. Coming in July, the new Security Center Essentials will let you see everything in one place instead of having to wade through a bunch of permissions and toggles.

Health Check will help you prioritize which changes will get you the biggest bang for your buck, and help you track your security posture over time. "It's all about allowing admins to navigate the security space in a way that helps to reduce the complexity and provide some guidance," Sabrina says.

There's a lot more from Laura and Sabrina about security on Salesforce and what's coming next, so make sure to listen to the full episode. And don't forget to subscribe to the Salesforce Admins Podcast to catch us every Thursday.

Podcast swag

Salesforce Admins on the Trailhead Store

Learn more

Salesforce Help: Security-Related Product Updates to the Salesforce Platform: User Identity, Data Protection, and Access Controls
Trailhead: Use Health Check to Scan Your Security Configurations

Admin Trailblazers Group

Admin Trailblazers Community Group

Social

Full show transcript

Mike Gerholdt: This week on the Salesforce Admins Podcast, we're talking security with Laura Pelkey and Sabrina Simeroth. The threat landscape is moving fast and with AI in the mix, attackers are getting better at targeting privileged users like Salesforce Admins. But in this episode, it isn't about fear, it's about readiness, trust, and the systems admins can put in place to protect our orgs. We'll cover MFA enforcement, phishing-resistant MFA, step-up authentication, and how Security Center Essentials gives admins a clearer view of the settings that matter most because today's admin isn't just managing features. They're designing secure, trusted systems that help businesses move forward. So, let's move forward with this podcast and get Laura and Sabrina on. So, Laura and Sabrina, welcome to the podcast.

Laura Pelkey: Hello?

Sabrina Simeroth: Thank you. Thanks for having us.

Mike Gerholdt: Absolutely. Well, it's always good to talk security. I feel like I was watching the news the other day and they talk about kids when they go to school and then they have the summer off and there's that summer slump of information. I feel like maybe over the summer we kind of have a security slump because we're taking time off and we're going to water slides and watching tornadoes in the Midwest, but maybe I'm just crazy thinking about that. Laura, why don't you catch us up and tell us what's going on with security and some of the newest things in summer 26?

Laura Pelkey: I would love to. And I was just going to say our catchphrase, which I feel like I repeat every time we do a podcast together and that security never sleeps even in the summer.

Mike Gerholdt: Oh, yes. Right. That could also be a fun summer action film.

Laura Pelkey: Yes. I would see it.

Mike Gerholdt: I would.

Laura Pelkey: Yeah. So, I mean, we're halfway through the year, which is crazy already. And I'd say in the last year we have seen the security landscape and the threat landscape shift tremendously. And especially, I mean, I think a lot of people at Salesforce and a lot of people who are listening are very aware of and use on a day-to-day basis, AI nowadays, which is great. It's a very powerful tool. But what we're seeing in the security landscape is that AI-driven cyber threats have emerged and hackers have really up-leveled their ability to create and execute targeted cyber attacks faster than ever before. So, it's kind of crazy the speed at which this is happening. And unfortunately, I think we're going to see their capabilities get better and better as these tools evolve.

Mike Gerholdt: Well, that's not fair. We're supposed to use AI for good.

Laura Pelkey: Yeah. Well, the good news is, so yes, I agree. The good news is that providers are now using the same AI models or better AI models if you're in the lucky groups to enhance the security of their platforms and products. So, now the playing field has really been evened out.

Mike Gerholdt: Well, that's good.

Laura Pelkey: Yeah. But we're in a really interesting time right now with cybersecurity and AI.

Mike Gerholdt: I mean, I feel like everybody's trying to figure out AI and now that kind of only muddies the water of impersonating other people or the speed at which it can replicate good or bad effective use of, I don't know, text messages or different spoofing. Can you walk us through how does Salesforce leverage AI to proactively block the type of threats that you're seeing today?

Laura Pelkey: Yeah. So, there are some really common threats that just across the industry we're seeing that AI is being used for. So, account takeovers and this is a really common one. This is where attacker might use AI to create a phishing campaign, which targets users and tries to get access to their account. And then once they're inside a user account, they can then utilize all of the privileges that that user has to continue carrying out their attack. So, it's really about getting credentials, finding creative ways to get around our existing solutions to get those and then get that user profile and exploit it.

Mike Gerholdt: Yeah. I think one thing that you've pointed out in the past is identity-based social engineering. So, I'd love for you to kind of expand on what makes admins and some privileged users such high-value targets for that.

Laura Pelkey: Yeah, that's a great question. So, identity-based social engineering is when attackers create very highly personalized ...