What Salesforce Admins Need to Know About Summer ’26 Malware Scanning

A partner uploads a contract to a portal case. Your rep forwards it to the customer under your company’s name. Nobody scanned it, because it arrived over 100 MB, and you are the admin who will be asked why.

The Sophos ransomware report found that leadership was replaced in more than one in five organizations hit last year, and the IBM breach report puts the 2026 average cost at $11.5 million in the United States.

Salesforce malware scanning for admins shipped in Summer ’26 and it is on by default, so you are already running a control you did not choose and probably have not tested. Matt Meyers, CTA, CoFounder and CEO of EzProtect, has spent 19 years in the Salesforce ecosystem and wrote the book on securing digital experiences after living through a breach himself. In this session he reads the Salesforce Help documentation line by line, then proves every limit in a live org.

What you’ll learn:

• The same scanner behaves four different ways. A UI upload is blocked in real time, an API upload lands in your org before it is scanned, a file predating enablement is checked only on download, and a file over 100 MB is never scanned at all.
• Salesforce Files is one of four file types. Legacy Attachments, Documents, and Static Resources sit outside the scanner completely, and your integrations are still writing to them.
• High probability detection is a published threshold, not a bug. Salesforce documents that it flags only files highly likely to be malicious, admins cannot tune it, and the documentation points anyone needing stricter scanning toward partners.

Watch the session, then book a free security assessment to map which of your upload paths are actually covered. See the scanner tested against a disguised threat in our scanner test, and find every past session in the EzProtect video library.