Credential configuration
Keep supported Named Credential and External Credential evidence connected to the application or integration under review.
Security Observatory overview
Review Salesforce exposure with evidence you can trace.
Create accountable records for supported observed applications and integrations, connect them to OAuth and user context, and retain the evidence behind each review.
Currently in sandbox validation. Not yet available for public installation.
Email: info@fortmilo.co.uk
Governed application lifecycle
Move from observed evidence to accountable review context
Security Observatory maintains durable governed application records from supported evidence sources. Records can hold a business owner, technical owner, vendor, purpose, business context, review status, last-reviewed date and relevant renewal or review context, while retaining links to source provenance, OAuth usage and associated findings. Human-entered governance context is preserved across rescans where the current record model supports it.
- ObserveCollect supported, bounded evidence.
- Create or reconcileLink observed evidence to a durable governed asset conservatively.
- Add contextRecord ownership, vendor, purpose and review details when known.
- Retain provenanceKeep the source and evidence boundary visible.
Credentials and endpoints
Review the outbound integration surface
Review Named Credentials, External Credentials and outbound endpoints alongside Remote Site Settings, CSP Trusted Sites, the CORS allowlist and certificates as supporting evidence where relevant.
Endpoint and egress controls
Review supported endpoint configuration and related findings without claiming comprehensive integration discovery.
Traceable context
Retain source provenance and link relevant findings back to the governed record.
OAuth context
See authorisation evidence with the user and application
Correlate the application, retained OAuth authorisation evidence, supported user state, stale or non-use evidence when available, governed context and associated findings.
An authorisation record does not prove a credential currently works, and Security Observatory never probes it.
Public exposure
Review Salesforce Sites and Experience Cloud surfaces
Supported Salesforce Sites and Experience Cloud evidence brings public-surface context into the same review as applications, connections and findings. Conclusions remain bounded to the evidence sources the scan could assess.
Independent governance rationale
What a Security Benchmark for Salesforce control reference means
The Security Benchmark for Salesforce (SBS) is an independent project, not a Salesforce product or a Fortmilo benchmark, and it is not endorsed or supported by Salesforce. Security Observatory uses version-bound control references as pointers to retained evidence, not as statements that a control is satisfied, compliant, certified, secure or passed. Where human judgement is required or a source is unsupported, the review retains Manual Required or Not Covered as applicable.
SBS material is attributed under CC BY-SA 4.0; Security Observatory identifies the referenced source/version and any mapping modifications.
Evidence integrity
Missing evidence must never become a clean result.
Source provenance, observed-zero, unavailable, incomplete and intentionally unretained evidence remain distinct so a review does not overstate what the scan established.
Collection and retention occur inside the subscriber Salesforce organisation. The authenticated browser prepares allow-listed CSV content; downloading creates a separate file boundary outside Salesforce.
Sensitive evidence boundary
No tokens · No session IDs · No secrets · No certificate bodies · No raw IPs
This describes evidence retained, displayed and exported by Security Observatory.
Product guide
Five focused review areas
Each area states what the Observatory surfaces and how far the evidence goes.
Findings
Triage retained risk evidence and open safe detail.
Open Findings →External Connections
Review governed applications, OAuth, credentials, endpoints and public Salesforce surfaces.
Open External Connections →Identity & Access
Review supported users, session exposure, login evidence and selected powerful access.
Open Identity & Access →Entitlements & Assets
Review licence capacity, bounded assignment evidence and governed application records.
Open Entitlements & Assets →Evidence & Coverage
Review provenance, source availability, completeness and bounded retained history.
Open Evidence & Coverage →Supporting coverage
Identity, privileged access and entitlement evidence
Supporting review areas cover active, inactive, frozen, administrative and stale-login users; sessions and failed-login evidence; API Enabled, delegated administration and login access; selected powerful permissions; and bounded licence evidence.
Scope boundary
V1 limitations
V1 scope current as of 21 September 2026.
- Free V1 is single-org.
- It is read-only and advisory, performs no automatic remediation, and does not revoke tokens, remove permissions or alter assessed endpoints or Salesforce security configuration.
- Historical evidence is bounded to 1–10 retained completed scans. Current defaults are Developer Edition 1, Sandbox 3 and Production 3.
- OAuth usage rows follow scan-retention cleanup even when governed application and source records are longer-lived.
- Licence assignment evidence is bounded to 1,000 retained records per family across Package Licences, Permission Set Licences and Salesforce User Licences. Safe capture can be lower because Salesforce transaction and DML headroom must be preserved.
- Package Licence capacity evidence is available for managed packages that expose a Salesforce
PackageLicenserecord. This is not a complete installed-package inventory. - The asset and governance CSV does not export the complete governance record.
- External Client App inventory is not included in V1.
- Some Tooling API evidence requires the subscriber to complete self-callout setup.
- SBS control references remain evidence pointers; Manual Required and Not Covered remain explicit where applicable.
- Unavailable or incomplete evidence is not presented as zero.
Future direction
Paid extensions for continuous monitoring, longer evidence history and estate-wide governance are under consideration for a later release.
Request access
Continue the product review
Security Observatory is not yet available for public installation. Contact Fortmilo to request access when it becomes available.
Email: info@fortmilo.co.uk