Why Are Platform Ecosystems - Like Salesforce - Often Targeted?

"Platform ecosystems are notoriously hard to secure because the way they're compromised is not easily scanned for using automation. This is specifically because these application stacks use non-human identities (NHI) and have deep integrations with other software and data platforms. Trust relationships, and long-lived and poorly monitored credentials grant access to treasure troves of systems and data."

"By targeting and compromising software trusted to communicate, query, or operate in the context of the Salesforce integration creates a threat to the Salesforce ecosystem, and it's not something Salesforce can directly secure. The failure is in the third party integrations."

Salesforce issued a security warning about rising threat actor activity targeting misconfigurations in publicly accessible sites, particularly through permissive guest user configurations in Experience Cloud. Cybercriminals exploit these vulnerabilities to gain unauthorized access to sensitive data, which they then use for targeted social engineering and voice phishing attacks. This threat follows an October 2025 breach where hackers claimed to steal 1 billion records from Salesforce customer databases. Platform ecosystems like Salesforce are attractive targets because they contain sensitive customer information, credential data for lateral movement, and present significant security challenges. These platforms are difficult to secure due to non-human identities, deep integrations with other software, and poorly monitored long-lived credentials that provide access to extensive systems and data.

Read at Securitymagazine