Salesforce Penetration Testing

Salesforce secures the infrastructure; you are responsible for configuring it. The permission system, custom Apex, Lightning components, and integrations introduce many opportunities for misconfiguration. Our testing finds the vulnerabilities unique to your implementation, custom code, permission sets, sharing rules, and integrations, that automated tools and Salesforce's own security cannot catch for you.

An automated scanner finds known misconfigurations, permission issues, and code-quality problems in your metadata and reports a score. It cannot tell you which of them an attacker can use. Raxis built its own Salesforce toolset for the other half of that problem: it is interactive, and a senior engineer drives it to find every security concern in your org, then manually validates each one, builds proof-of-concept exploits, tests business logic, attempts privilege escalation, and simulates real attacker techniques automation cannot. A scanner tells you what might be vulnerable; a pentest proves how an attacker exploits it and what the business impact is.

No. Our testing is designed to be safe and non-disruptive. We use read-only queries where possible, create test records that do not interfere with real data, and coordinate timing with your team. We can test in a sandbox first, though we recommend some production testing since sandbox configurations often differ. We have tested live Salesforce environments for large enterprises without incident.

Yes, and you should prioritize it. Communities with Guest User access are among the most exploited Salesforce attack vectors, and the 2024 account-takeover disclosures targeted Guest User misconfigurations specifically. We test guest permissions, community sharing settings, unauthenticated access points, and the boundary between authenticated and unauthenticated functionality.

Yes. Custom code is where the most critical vulnerabilities often hide. We test Apex classes, triggers, controllers, and Visualforce pages for SOQL/SOSL injection, improper input validation, "with sharing" versus "without sharing" mistakes, sensitive data in debug logs, hardcoded credentials, and business logic flaws, along with custom Aura and Lightning Web Components. We do not just read the code; we exploit it to prove real-world impact.

Our testing supports PCI DSS (Requirement 11.4), the HIPAA Security Rule, SOC 2 Type II, GDPR, and ISO 27001. Reports map findings to specific control requirements to make audits straightforward. For PCI DSS, if you store, process, or transmit cardholder data in Salesforce, annual penetration testing is mandatory and must cover your application, custom code, integrations, and external-facing components.

We assess both the AppExchange apps installed in your org and the integrations connecting Salesforce to external systems. For apps, we review requested permissions, test for data leakage, and analyze their API calls. For integrations, we test authentication (OAuth, API keys, JWT), data transmission, endpoint security, webhook validation, and whether a third-party system can be leveraged to compromise Salesforce. A vulnerable integration can become a backdoor into your data.

Yes, which is why periodic testing matters. Salesforce ships three releases a year, and each can change defaults or expose new vectors, while your team makes ongoing configuration and code changes. We test your current state for issues from recent updates, permission drift from accumulated changes, and misconfigurations that were not present at your last assessment.

We notify your team immediately rather than waiting for the report. For high-severity issues like exposed customer data, authentication bypass, or privilege escalation, we provide verbal notification with emergency mitigation guidance. After testing, you receive a detailed report with proof-of-concept exploits, remediation steps, and prioritized actions, plus a complimentary retest once you have implemented fixes.

Senior US-based Raxis engineers holding certifications such as OSCP and OSCE, with hands-on Salesforce platform experience. No outsourcing, and no junior testers learning on your org.

It depends on the complexity of your org: custom objects and fields, lines of Apex, number of integrations and APIs, whether you run Communities or Experience Cloud, the number of profiles and permission sets, and your compliance requirements. A focused assessment typically starts around $15,000 to $35,000 and takes one to four weeks. Comprehensive testing of a complex enterprise org with extensive customization runs $35,000 to $75,000 or more and takes four weeks or longer. Contact us for a quote sized to your implementation.