Agent Security Console for Salesforce
Agentforce and external agents can read, change, and delete business-critical records on plain-language instructions. TrailSight inspects how those agents are configured, watches how they behave at runtime, and names the blind spots native tooling leaves behind — as prioritized findings your security team can act on.
The visibility gap
Teams switch on agents for productivity — often without security in the room. Those agents act on natural-language prompts, reach data through OAuth-connected apps and APIs, and trigger actions that read, create, update, and delete records. The same flexibility that makes them useful is what makes them risky, and it doesn't map cleanly onto a config checklist or a static SIEM rule.
Agentforce agents are native to Salesforce: you can see their instructions, allowed actions, and confirmation requirements. External agents connecting in over Hosted MCP are far thinner — you typically get the login and after-the-fact logs, but not a real-time, tool-by-tool account of what they did. Treating both the same is a mistake.
Posture checks tell you how an agent is set up. They don't tell you whether a token is being abused, whether an agent is acting outside its declared scope, or whether a prompt-injection attempt just steered it off-script. TrailSight covers both configuration risk and runtime behavior.
Generic Salesforce security reviews and SIEM correlation rules were written for users and integrations, not agentic behavior. They rarely model agent actions, MCP doorways, confirmation gates, or the link between a config change and the activity that follows it — so agentic risk slips through the seams.
Event logs can lag by hours, and for standard external agents the per-tool detail may never be visible from the platform alone. If you don't know where visibility stops, "no alerts" reads as "no risk" — exactly the assumption attackers rely on.
What TrailSight does
TrailSight reads the configuration and activity Salesforce already produces, analyzes it for agent-specific risk, and turns it into findings with severity, business impact, the likely path, and a recommended fix. It answers three questions security teams keep asking: are these agents configured safely, are they behaving as expected, and what can't the platform see?
Catch unsafe agent setups before they become incidents:
Watch what agents actually do, and alert on what's off:
Name what the platform can't see, and what to do about it:
Built on the signals Salesforce already produces:
*Conversation-based prompt-injection review is available as an opt-in add-on.
Detection coverage
Coverage spans how agents are configured and how they behave — for both native Agentforce and external agents connecting in.
Destructive actions with no confirmation, instruction-only guardrails, and agent setups that have drifted from their approved state.
Actions broader than the job needs, vague definitions an agent could misapply, and a description that doesn't match what an action really does.
Trust Layer detection switched off while write-capable agents run, and — as an opt-in add-on — manipulation attempts inside agent conversations.
Full-API scopes, long-lived or never-expiring tokens, missing modern login protections, relaxed approval, and admin-level reach for external apps.
Out-of-hours bursts, create-then-delete chains, failure streaks, and agents touching objects or actions they've never used before.
Mass reads of regulated objects and policy-threshold breaches — measured against each agent's learned normal and your own rate limits.
Toxicity, prompt-injection, and PII-masking switches turned off; beta models on production data; AI processing allowed to fall back out of region.
Write-capable MCP doorways, newly activated access, and the explicit blind spots that come with standard Hosted MCP traffic.
Every finding carries severity, plain-language impact, evidence, and the affected component — structured and exportable for SOC and SIEM workflows.
How it works
A read-first pipeline: TrailSight only reads the configuration and logs it collects — it never writes during analysis. Remediation, when you choose it, is deliberate and audited.
Securely gather agent and action definitions, Trust Layer and OAuth posture, MCP access, Setup Audit Trail, Event Monitoring logs, and login events — per org.
Bring configuration and activity into one model, with a remembered baseline so changes and drift stand out from normal.
Run deterministic, explainable checks on configuration and behavior first; reserve AI assistance for genuinely borderline judgment calls.
Produce business-readable findings with evidence, affected component, actor where known, and a recommended fix — duplicates merged.
Rank by impact-driven severity, with the reasoning and likely path spelled out so teams fix the most dangerous things first.
Triage in the console, preview and apply safe single-setting fixes, and export findings into SOC and SIEM workflows — every action audited.
Why security teams use it
A purpose-built lens on agent activity surfaces dangerous setups and anomalous runtime patterns early — instead of reconstructing them after the fact.
See effective permissions, OAuth scope, and MCP capability per agent — the real blast radius, not just what's directly attached.
Misconfiguration and platform blind spots are flagged distinctly, so teams invest in the right compensating controls rather than guessing.
Impact-driven severity, plain-language explanations, and merged duplicates keep the board signal-rich instead of drowning analysts.
Multi-org coverage, persistent triage, and an audit trail give security a durable record as agent adoption scales across the estate.
Deep links into Salesforce, zero-impact previews, and safe single-setting changes move teams from detection to resolution in one place.
Example findings
Representative examples of the findings TrailSight produces. Severity reflects real impact — most issues are not Critical, and that's the point.
A connected app serving a Hosted MCP agent is granted full-API access with long-lived refresh tokens, and the only native real-time signal is its login.
Why it matters: a stolen or misused token inherits do-anything access with almost no forensic trail and no per-tool visibility to catch it in the act.
A destructive action on a regulated object runs without human confirmation; the only guardrail is instruction text telling the agent not to.
Why it matters: a single misread or injected instruction can destroy or corrupt data, because written guardrails can be talked around and enforced gates can't.
The org-wide prompt-injection control is switched off on an org running agents that can change records.
Why it matters: manipulated input can flow straight to the model and steer agent actions, with the safety net that would catch it turned off.
An external-AI connection that can create, update, or delete records was switched on after the previous baseline — new write capability appearing between reviews.
Why it matters: write access for an external agent should be deliberately justified and watched. A doorway that opens quietly is exactly the change a security team needs to catch early.
History tracking is disabled on an object an active write-capable agent can modify, so record changes leave no field-level trail.
Why it matters: without history, agent-driven changes to regulated data can't be reconstructed for audit or forensics.
Built for governed environments
TrailSight fits where agent governance is non-negotiable — financial services and banking, healthcare, public sector, and large regulated enterprises — and where security needs auditability, isolation, and a controlled rollout.
Target environments, not customer claims — we don't publish customer names or logos.
Tell us about your Salesforce estate and the agents you're rolling out, and we'll walk you through what TrailSight surfaces — configuration risk, runtime anomalies, and the blind spots you'll want compensating controls for.
