Salesforce Security: Shield, Event Monitoring, OAuth & Agentforce AI

Salesforce Shield & security FAQ

What is Salesforce Shield?

Salesforce Shield is an add-on security layer for Salesforce that includes three core capabilities: Platform Encryption (encrypting data at rest using AES-256), Event Monitoring (detailed audit logs of user and API activity), and Field Audit Trail (extended history retention up to 10 years in Shield+). Shield also includes Transaction Security Policies, Security Center, and encryption key management. It is available as an add-on to most Salesforce editions.

How much does Salesforce Shield cost?

Salesforce Shield is typically priced at approximately $25 per user per month as an add-on to existing Salesforce licenses, though actual pricing is heavily contract-dependent and larger organizations commonly negotiate discounts. Salesforce Shield+ (available in Unlimited+ or as an upgrade) adds Real-Time Event Monitoring, 10-year Field Audit Trail, and Einstein Data Detect at approximately $50 per user per month. Salesforce does not publicly list Shield pricing — contact your AE or use CalculateForce to model the cost against your current license tier.

What is the difference between Salesforce Shield and Shield+?

Salesforce Shield includes Platform Encryption, Event Monitoring (batch logs), Field Audit Trail with 6-month retention, Transaction Security Policies, and Security Center. Shield+ (or Unlimited+) adds Real-Time Event Monitoring (streaming events, not batch), Field Audit Trail with up to 10-year retention, and Einstein Data Detect for automatic PII/PCI/PHI classification. Shield+ is available as part of the Unlimited+ bundle or as an add-on.

What is Salesforce Platform Encryption?

Salesforce Platform Encryption allows you to encrypt data at rest across standard and custom fields using AES-256 encryption. It supports customer-managed keys (BYOK — bring your own key), key rotation policies, and key caching. Platform Encryption is available only with Salesforce Shield. Important: not all Salesforce features work on encrypted fields (e.g., certain SOQL filters, formula fields, and workflow criteria may be affected), so field selection requires planning.

What does Salesforce Event Monitoring track?

Salesforce Event Monitoring logs 50+ event types including: login events (including MFA usage, IP, browser, and outcome), API calls (volume, endpoint, user), report exports, list view access, URI events, Apex execution, data loader events, setup changes, permission changes, and more. With Shield+, Real-Time Event Monitoring streams these events immediately rather than batch delivery, enabling instant detection and Transaction Security Policy enforcement.

What is Salesforce Field Audit Trail?

Field Audit Trail (FAT) extends the standard 18-month field history retention in Salesforce. With Salesforce Shield, FAT retains up to 6 months of history per field. With Shield+, retention extends to 10 years. FAT stores changes to up to 60 fields per object and is useful for compliance requirements under GDPR, SOC 2, HIPAA, and PCI DSS. Data is stored in the Big Object infrastructure and can be queried via SOQL.

What are Salesforce Transaction Security Policies?

Transaction Security Policies are rule-based policies that trigger on Salesforce events and can block or alert on specific activity. Examples: block login from outside a country whitelist, alert when a report exports more than 2,000 records, require MFA re-authentication for admin actions, or block bulk API access from unknown IPs. With Shield, policies use Apex or Condition Builder. With Shield+, policies run on real-time streaming events rather than batch logs.

Does Salesforce Shield solve all Salesforce security problems?

No. Salesforce Shield is a powerful set of tools, but it solves only a subset of Salesforce security risk. Shield helps with encryption, monitoring, and audit — but it does not prevent over-permissioned connected apps, weak OAuth governance, excessive user permissions, sandbox data exposure, or AI agent overreach. A comprehensive Salesforce security posture requires Shield plus permission governance, connected app review, integration security, and security monitoring processes.

What is Agentforce security?

Agentforce security refers to the controls and governance applied to Salesforce AI agents, including: restricting which data the agent can access (via permission sets), limiting which actions it can perform (topic and action library controls), monitoring agent activity via Event Monitoring (AgentConversation events), protecting against prompt injection attacks via Einstein Trust Layer, and auditing MCP-connected tools that interact with Salesforce.

How does Agentforce change Salesforce security?

Agentforce and Einstein AI agents can access records, summarize data, update fields, trigger flows, call external APIs, and interact with business workflows — all without a human user explicitly initiating each action. This creates new security considerations: the agent can inherit over-broad permissions, may be susceptible to prompt injection via CRM data, and its actions may not be adequately logged. Security reviews should address agent permissions, action library scope, audit logging, and prompt injection protections before scaling Agentforce deployments.

What is MCP security for Salesforce?

MCP (Model Context Protocol) security for Salesforce refers to the risks and controls around AI tools that connect to Salesforce via MCP servers. MCP servers allow AI assistants (Claude, ChatGPT, Copilot) to query and act on Salesforce data. Security concerns include: over-scoped OAuth tokens granted to the MCP server, lack of audit logging for MCP-originated queries, prompt injection risk via CRM data, and unauthorized record modifications. Salesforce MCP security requires reviewing connected app scopes, OAuth governance, and Event Monitoring coverage for API calls originating from AI tools.

Why is Salesforce connected app security important?

Connected apps allow external tools to access Salesforce through OAuth and APIs. Stale, unknown, or over-scoped connected apps are among the most common sources of Salesforce data exposure. If a connected app holds a valid refresh token with admin-level scopes, it can access all CRM data indefinitely — even if the user who authorized it has left the company. A connected app audit should be performed quarterly and after any significant integration changes.

Can Salesforce APIs create a data exposure risk?

Yes. Salesforce APIs allow large-scale data access. A user or integration with API-enabled permission and a broad profile can extract millions of records via REST, SOAP, or Bulk API with no built-in volume limit. API security should include least-privilege access, dedicated integration users with narrow permissions, login IP restrictions, and regular review of API activity via Event Monitoring.

Why are sandboxes a security risk?

Sandboxes often contain full or partial copies of production data but have weaker security controls, broader developer access, and third-party integrations for testing. Without Data Mask configured, a full sandbox contains real customer records accessible to anyone with sandbox access. Sandbox security practices should include Data Mask on sensitive fields, restricted developer access, and removal of external integrations from non-production environments.

How often should we audit Salesforce security?

Connected apps, OAuth access, admin permissions, and integration users should be reviewed at least quarterly. Event Monitoring logs should be reviewed weekly (or monitored via Transaction Security Policies in real time). A full security assessment should be performed annually, after major integrations or AI deployments, post-acquisition, or after any security incident involving CRM data.