In 2025 the Salesforce estate became the most productive target in SaaS, and not because of a flaw in Salesforce. ShinyHunters claims to have reached 300 to 400 organisations through Experience Cloud guest-user misconfiguration. Stolen vendor OAuth tokens, first Salesloft Drift in August and then Gainsight in November, gave the same group access it claims covered almost 1,000 organisations. ForcedLeak, a prompt-injection chain into Agentforce, was disclosed on 2025-09-25 with a CVSS of 9.4.
Every one of these ran through configuration, permissions or a third party. That pattern is not specific to Salesforce. Verizon's 2025 DBIR found third-party involvement in 30% of breaches, up from 15% the year before. If your customer record lives in Salesforce, your exposure is the sum of what your admins configured and what your vendors were granted.
A CTO cannot audit a sharing model personally and should not try. What a CTO can do is ask for five numbers every quarter, know what a good answer looks like, and refuse a verbal "it's fine". Each number below is a read-only report an admin can produce in an afternoon.
The five numbers
1. How many records can an unauthenticated person reach?
This is the Experience Cloud question. A guest user profile with a checkbox set the wrong way, or a sharing rule that includes the guest, turns a public site into a data export. The 300 to 400 organisations in the ShinyHunters claim were reached this way, which makes it the highest-volume route of the year.
The number to ask for is the count of objects, and then records, that the guest profile of each public site can read. The good answer is a short list of objects the site genuinely needs (a knowledge article, a case form) and zero for everything else. A long list, or "we are not sure", is the answer that needs a project.
2. How many administrators, and what kind of MFA do they use?
Admin count is the blast radius of a single phished account. The trend to ask about is whether it goes down each quarter, since admin permissions accumulate and are rarely removed.
The second half of the question has a deadline. Salesforce is enforcing MFA from June 2026, and phishing-resistant MFA for admin-level permissions. An authenticator app on a phone is MFA. It is not phishing-resistant. The vishing campaigns of 2025 succeeded against people who had MFA and were talked through approving the prompt. The good answer is the number of admin-level users, the number of those on a hardware key or platform authenticator, and a date by which the two numbers match.
3. Which third-party apps hold a token that can read everything?
The Drift and Gainsight incidents were not attacks on your org. They were attacks on a vendor whose token your org had granted. The grant decided the damage. A token with full scope plus refresh_token on an admin-level integration user gives an attacker the org for as long as the token lives.
Ask for the count of connected apps with full scope, and for each one the integration user's permission level and whether it has a login IP range. The good answer is a small number, each with a named owner and a one-line reason. The number that should alarm you is any app on the list nobody can explain.
4. How many admin accounts have not logged in for 90 days?
Dormant privileged accounts are the quiet half of question 2. A former contractor's admin login, an integration user from a retired project, a break-glass account nobody rotated. Each one is a credential that still works and that nobody is watching.
Vulkro reports these as SF-PERM-002, dormant admins, in the posture report. The good answer is zero, with a policy that deactivates after a fixed window. The number itself is less interesting than whether it reaches zero and stays there.
5. How long does a High finding stay open?
The first four numbers describe exposure. This one describes the organisation's ability to reduce it. When a scan reports a High-severity misconfiguration or code finding, how many days pass before it is fixed, and how many Highs are currently past whatever deadline you set?
This is the number most teams cannot produce, because scans are run and their output is read once. It requires findings to be kept across scans, with an owner and a date, so that the same issue seen in March and June is one issue aged 90 days rather than two separate rows.
Where the numbers come from
Each of the five is a read, not a change. vulkro-sf org report --target-org <alias> -O posture.html produces one shareable posture report covering identity, settings, connected apps and packages, as HTML or Markdown. It is the artifact for questions 1 to 4, and the admin can hand it over as is. vulkro-sf compliance kpi produces the executive KPI summary, which is the format to ask for if you want a page rather than a report.
Question 5 needs state that outlives a single run. Vulkro Cloud keeps issues across scans with owners and fix deadlines, so time-to-fix is a column rather than a reconstruction. It has a home view per role: Executive, Security, Engineering and Compliance. The Executive view is the five numbers on one screen across every org you connect, which matters when the answer to "how many orgs do we have" is itself a project.
Cloud also surfaces something a single-number report cannot: Combined Risks, where several weaknesses meet at one entry point. A guest profile that can read Contact is a finding. A guest profile that can read Contact on a public site whose Aura endpoint is enabled is a breach path, and it is reported as one. For why that framing matters more than a count, see attack paths, not findings lists.
What a report does not tell you
A posture report reads the org as it is configured today. It does not know which of your vendors will be compromised next quarter, whether a sharing rule exists for a good business reason, or whether the admin who owns an integration user still works for you. The numbers make the questions concrete. The judgment about which answers are acceptable remains with the people who own the data.
What to do this week
- Put the five questions in the next quarterly review agenda, with the expectation that each one arrives as a number and a report, not a sentence.
- Ask the Salesforce admin to run
vulkro-sf org reporton the production org and send the HTML. Read the connected apps section yourself. - Ask for the admin count and the phishing-resistant MFA count side by side, with the June 2026 deadline against them.
- Decide a fix deadline for High findings (30 days is a common starting point) so that question 5 has something to measure against from next quarter.
To see what the Executive view looks like with data in it, open the sample workspace, which runs on fictional orgs and is read-only.