Decades on the Offense

Led by an offensive-security team whose founder holds CISSP, OSCP, and OSCE, with two decades breaking into enterprise systems at IBM X-Force Red, Trustwave SpiderLabs, and IntegSec.

Real Human Pentesters

Not a scanner reselling a dashboard. Experienced operators manually chain misconfigurations into proven attack paths a tool will never produce.

Platform-Deep, Not Checklist

We know the Salesforce sharing model, Apex sharing semantics, and Experience Cloud pitfalls, not just a generic web-app checklist.

Why Salesforce Orgs Get Breached

Salesforce secures its platform, but everything you build and configure on top of it is your responsibility. Under the shared responsibility model, the highest-impact risks come from configuration and custom code, not the infrastructure.

✓

Broken Access Controls

Sensitive custom objects and fields hidden from the UI but still reachable through the API, over-permissioned profiles, and permissive sharing rules routinely expose data no one intended to share.

✓

Guest & Experience Cloud Exposure

Public Experience Cloud sites and guest user access are a leading source of real-world Salesforce data leaks when object and sharing settings aren't locked down.

✓

Insecure Apex & SOQL Injection

Custom Apex that skips CRUD/FLS enforcement or concatenates user input into SOQL queries opens the door to injection and unauthorized data access, classic app-layer flaws on a SaaS platform.

✓

Connected Apps & OAuth Sprawl

Over-scoped connected apps, third-party integrations, and unmanaged OAuth tokens expand your attack surface and create paths for data exfiltration well beyond the login page.

The Salesforce Attack Surface We Test

Effective Salesforce testing spans both the configuration (SaaS) layer and the custom-development (PaaS) layer. We assess your org the way an external attacker, a malicious insider, and an over-permissioned integration each would.

Salesforce Security Assessment Policy

Access Model

OLS, FLS, and record-level sharing

Guest & Sites

Experience Cloud, guest users, public pages

Custom Code

Apex, Visualforce, LWC, SOQL injection

Integrations

Connected apps, OAuth, APIs, tokens

Indentity

SSO, MFA, session and login policies

Configuration & Access Review

We audit profiles, permission sets, sharing rules, and Object/Field/Record-Level Security to find where data is reachable by users, or the API, that should never see it.

Authenticated Exploitation

Starting from a standard low-privilege user, we chain misconfigurations and code flaws to demonstrate privilege escalation and unauthorized access to sensitive records.

Apex & Custom Code Testing

We review custom Apex, Visualforce, and Lightning components for SOQL injection, missing CRUD/FLS checks, insecure sharing keywords, and unsafe API exposure.

Guest & External Attack Simulation

We probe Experience Cloud sites and guest access the way an unauthenticated outsider would, surfacing exposed objects and data before they end up in a breach headline.

Do You Still Need Salesforce's Approval to Pentest?

Short answer: no. Since January 31, 2023, Salesforce no longer requires customers to request prior approval, or even give advance notice, before performing a penetration test or security assessment of their own org. This changed the old process many teams still remember, where you had to submit a request and wait for authorization before any testing could begin.

Gemini_Generated_Image_q9aqlq9aqlq9aqlq 1

Testing is now governed by Salesforce's Security Assessment Agreement, which sets the rules of engagement: production data handling, prohibited techniques like denial-of-service, and how to report confirmed findings. IntegSec tests fully within those terms, so there's no authorization queue between you and a real assessment. We handle the agreement details and can scope and begin quickly.

Ask us about testing your org

How IntegSec Tests Salesforce

Offensive expertise applied to the platform that runs your customer relationships. We don't just run the Health Check, we demonstrate what a real attacker can reach and how to shut it down.

Salesforce Penetration Testing

Expert-led, manual penetration testing that simulates external attackers, malicious insiders, and abused integrations against your Salesforce org.

Object-, Field-, and Record-Level Security exploitation
Guest user and Experience Cloud attack testing
Apex, Visualforce, and Lightning code security testing
SOQL injection and API abuse
Connected app, OAuth, and integration testing

What You Get: Documented attack chains with proof-of-exploit, business-impact risk ratings, and prioritized, admin- and developer-ready remediation guidance.

Salesforce Security Assessment & Health Review

A deep configuration and posture review of your org against Salesforce and industry best practices, ideal ahead of an audit, a new rollout, or a security review.

Profile, permission set, and sharing model analysis
Guest user and public site configuration hardening
Session, MFA, SSO, and login policy review
Connected app and API access inventory
Salesforce Shield and monitoring recommendations

Audit & Compliance Support: Evidence and reporting that support SOC 2, ISO 27001, and internal audit, and satisfy customer and vendor security requirements.

Let’s Talk

WHY CHOOSE US

Why Teams Choose IntegSec forSalesforce

Deep Platform Expertise

Our testers understand the Salesforce security model end to end: the sharing architecture, Apex sharing semantics, and Experience Cloud pitfalls that generic web pentesters miss.

Real Attack Paths, Not Scan Noise

Automated scanners and the built-in Health Check list settings. They do not chain them into a breach. We do, proving by hand exactly which records a guest user, insider, or over-scoped integration can reach.

Fast to Start, Safe to Run

No Salesforce approval queue, no operational disruption. We scope tightly, coordinate with your team, and test within Salesforce's assessment terms.

Audit-Ready Reporting

Clear technical detail for your team plus an executive summary and evidence your auditors, customers, and leadership can act on immediately.

SAP Penetration Testing FAQ

Common questions from security, Basis, and audit teams evaluating an SAP penetration test.

Offensive testing of your org and custom development, targeting risks unique to the platform: misconfigured Object-, Field-, and Record-Level Security, over-permissioned profiles, exposed guest and Experience Cloud users, vulnerable Apex and Visualforce, SOQL injection, and insecure connected apps and OAuth integrations.
Offensive testing of your org and custom development, targeting risks unique to the platform: misconfigured Object-, Field-, and Record-Level Security, over-permissioned profiles, exposed guest and Experience Cloud users, vulnerable Apex and Visualforce, SOQL injection, and insecure connected apps and OAuth integrations.
Offensive testing of your org and custom development, targeting risks unique to the platform: misconfigured Object-, Field-, and Record-Level Security, over-permissioned profiles, exposed guest and Experience Cloud users, vulnerable Apex and Visualforce, SOQL injection, and insecure connected apps and OAuth integrations.
Offensive testing of your org and custom development, targeting risks unique to the platform: misconfigured Object-, Field-, and Record-Level Security, over-permissioned profiles, exposed guest and Experience Cloud users, vulnerable Apex and Visualforce, SOQL injection, and insecure connected apps and OAuth integrations.
Offensive testing of your org and custom development, targeting risks unique to the platform: misconfigured Object-, Field-, and Record-Level Security, over-permissioned profiles, exposed guest and Experience Cloud users, vulnerable Apex and Visualforce, SOQL injection, and insecure connected apps and OAuth integrations.

Explore More Security Solutions

IntegSec provides specialized offensive security testing across the platforms and industries that run your business.

SAP & ERP Security

Penetration testing for S/4HANA, NetWeaver, RFC, Fiori, and HANA environments.

Oracle ERP Security

Penetration testing for E-Business Suite, PeopleSoft, JD Edwards, and Fusion Cloud ERP.

Microsoft Dynamics Security

Testing for D365 Finance & Operations, Business Central, legacy AX/NAV/GP, and Power Platform.

SaaS & Technology

SOC 2-ready vulnerability assessments and penetration testing for software companies.

Salesforce Penetration Testing.Find What Attackers Can Reach.