What to Do in the First 24 Hours After a Salesforce Data Breach

Most Salesforce teams don’t have a breach response plan. IT security knows security but not Salesforce, and Salesforce teams know the platform but not security. That gap is where the damage happens.

In this Salesforce Security Office Hours session, Matt Meyers, Salesforce CTA and CoFounder and CEO of EzProtect walks through the NIST Threat Response Lifecycle applied to Salesforce, covering detection, containment, recovery, and validation.
What you’ll learn:

• Password resets don’t revoke OAuth tokens. Integration sessions using refresh tokens survive org-wide resets and must be revoked separately.
• Your metadata needs the same scrutiny as your data. Attackers change Apex code, scheduled jobs, and routing logic silently. If you’re only checking records after a breach, you’re missing half the damage.
• You need a firefighting team before the fire starts. Know who gets the call at 2 AM, what tokens get revoked first, and whether your cyber insurance covers a third-party connected app compromise.

The average breach goes undetected for 204 days, but the most damage happens in the first 24 hours if you do not have a strategy in place. Watch the session and build your plan before you need one.