Securing Salesforce with Salesforce: Retiring the Catch-All Inbox for an Agentic Frontline

In the agentic AI era where attackers move from initial access to lateral movement in minutes, security operations teams (CSOC) cannot afford to lose hours sifting through an inbox. When triage operates at the speed of manual email reviews, the window for containment narrows fast. Staying ahead of modern threats meant rethinking how security intake works from the ground up: turning intake into real-time frontline defense that gives expert responders the minutes they need to act. In the past, Salesforce received approximately 110,000 emails regarding security concerns every 18 months. Roughly half of those came from employees, and 45% of those employee emails required manual triage. Our CSOC team spent hours redirecting misrouted requests which had nothing to do with security, chasing down missing log details, and deciphering ambiguous one-liners. The real signal was buried beneath sheer volume. The Security Reporting Agent, an Agentforce-powered, Slack-native assistant built by our internal security team, changed that equation. Today, it serves as the frontline entry point for internal security concerns at Salesforce: triaging reports, opening structured cases, answering common questions, and routing non-security issues to the right teams. This means our expert responders can focus on high-impact incidents. An AI Architecture Built for Slack Meeting employees where they already work required far more than a simple Slack integration. It demanded tight collaboration across our product, engineering, and operations teams. Product shifted the model from an invisible backend email parser to an active frontline conversational experience in Slack, guiding employees to write comprehensive reports in real time rather than having to fill in the blanks after submission through follow up requests. Engineering re-architected the agent on the latest generation of Agentforce, migrating from legacy agent configurations to Agentforce Script. This consolidated multiple overlapping topics into a lean execution framework, dramatically improving response accuracy and anchoring Salesforce’s contextual case engine to real-time Slack interactions. Operations defined the boundaries. Operations analyzed five years of historical intake to understand the shape of security demand, determining what truly belonged with CSOC and what was creating unnecessary friction. How the Security Reporting Agent Works: Built entirely on our own platform, the system unites three core technologies into a single operational loop: Smarter Scoping and Objective Quality Historical data quickly revealed that common queries had better destinations elsewhere: lost badge requests belonged with Facilities, phishing inquiries needed immediate redirection to Gmail’s native reporting tool, and general IT questions required dedicated support queues, among others. Real security threats need dynamic questioning that produces an actionable, structured case ready for a responder on the very first touch. This is something an inbox could never provide. Because report quality is rarely a simple pass/fail metric, we built an automated evaluation framework: The Scorecard: 6 primary categories and 12 graded subcategories with target success thresholds between 85% and 98%. Continuous Simulation: Automated testing harnesses run simulated conversations continuously against this scorecard, detecting subtle regressions in factual accuracy, technical completeness, tone, and empathy before they reach production. Early Signal and What Comes Next To test the effectiveness of our agent, we launched the agent internally in production beta. Results showed that across 378 qualifying conversations held by 261 employees: 72% of interactions were handled entirely on the spot by the agent. It either answered directly or routed to the correct department without opening a ticket. 28% of interactions were genuine security concerns converted into complete, structured cases requiring zero preliminary intake work from human analysts. Extrapolating these early patterns across Salesforce’s 83,000+ employees, the trajectory is clear: fewer back-and-forths, complete context on first touch, and valuable responder bandwidth concentrated on critical threats. As Customer Zero, our goal was to prove that retiring the catch-all inbox isn’t a distant aspiration; rather, it’s an actionable playbook other security operations teams can adopt right now using the same foundational tools: Slack for conversational reporting , Agentforce for guided triage , and Service Cloud for structured case management . By aligning Product, Engineering, and Operations around an agile architecture and quality scorecards, we built an intelligent frontline our employees trust and our responders rely on. Note: The Security Reporting Agent is internal reporting for Salesforce employees only. Salesforce customers and partners should continue to report security concerns to security@salesforce.com . Security Resources Curious about more ways to bolster the security of your Salesforce org? Check out our guide for additional guidance and resources Get the resources