For most of Salesforce’s history, knowing your org’s real security posture meant either paying for the Security Center add-on or stitching together Health Check, the Setup Audit Trail, and a spreadsheet. Smaller teams usually did neither. The Summer ’26 release changes that math. As we covered in The Security Benchmark for Salesforce, knowing what “secure” means is half the battle; the other half is being able to see whether you’re actually meeting it.

What’s New

Two things shipped in Summer ’26 that matter for visibility.

Security Center Essentials is a centralized security dashboard that Salesforce is making available to every customer, in every org, starting in July 2026. It surfaces key security metrics for your org in one place so you can establish a baseline and watch for drift without building tooling yourself. This is a notable shift, because the full Security Center has always been a paid add-on (free only in Developer Edition); Essentials brings a baseline view to orgs that never licensed it.

Security Mesh, part of the paid Security Center, unifies signals from across Salesforce and external partners like Okta and CrowdStrike into a single data fabric. Instead of disconnected alerts in five consoles, it converts that activity into risk scores so anomalies surface faster. Event Monitoring data and Okta user data are going GA this month; CrowdStrike endpoint signals and deeper Agentforce integration are slated for later releases.

Why It Matters

The threat campaigns hitting Salesforce orgs over the past year — vishing-driven OAuth abuse, malicious connected apps, Experience Cloud guest-user exploitation — share a common theme: the victims couldn’t see the activity until the data was already gone. Detection gaps, not platform flaws, are where these attacks live.

Security Center Essentials doesn’t replace a real monitoring program, but it lowers the bar to starting one. If you’ve been running an org with no posture visibility because the paid Security Center wasn’t in budget, you now have a baseline dashboard in every org with no setup project to stand up.

What to Do This Week

• Enable Security Center Essentials and review your baseline metrics. Treat anything surprising as a finding, not noise.
• If you already license Security Center, turn on Security Mesh and connect your Okta tenant once Event Monitoring and Okta data hit GA.
• Map what Essentials shows you against the controls you actually care about. A dashboard is only useful if someone reviews it on a cadence and acts on the deltas.

Deeper Dive

The Visibility Gap This Closes

Salesforce has never lacked for security signals. The platform emits an enormous amount of telemetry: login history, the Setup Audit Trail, Health Check scores, API usage, connected app activity, and — if you license it — the full firehose of Event Monitoring event log files. The problem has never been a shortage of data. It’s been that the data lived in a dozen disconnected places, each with its own interface, retention window, and learning curve.

The practical consequence is that the average org operated with near-zero consolidated visibility. An admin might check Health Check before an audit, glance at login history when something felt off, and otherwise fly blind. The orgs that did better either paid for the multi-org Security Center add-on or built their own pipeline to extract Event Monitoring logs into a SIEM. Both options carried real cost — in licensing, in engineering effort, or in both — which meant most small and mid-sized orgs simply didn’t have a security dashboard at all.

That is the specific gap Security Center Essentials closes. It is not a new data source. It is a consolidation and presentation layer over signals Salesforce already had, now extended to every org rather than only those that license the paid Security Center.

Security Center Essentials vs. the Paid Security Center

It’s worth being precise about what’s broadly available and what’s licensed, because the naming invites confusion.

Security Center (the paid add-on, free only in Developer Edition) was built for organizations managing many orgs. Its core value proposition is multi-org aggregation: pulling posture data, metrics, and policy drift across an entire Salesforce estate into one tenant, with historical trending and the ability to push baseline configurations outward. For consultancies, ISVs, and large enterprises running dozens of production and sandbox orgs, that aggregation is the product.

Security Center Essentials is the broadly-available tier, and it is scoped accordingly. It gives every org a single-org dashboard of key security metrics — the kind of consolidated baseline view that previously required either the paid product or a homegrown solution. You should think of it as the on-ramp: enough to establish a baseline, spot obvious gaps, and monitor for drift, without the multi-org aggregation, deep historical analytics, or policy-push capabilities of the full product.

The honest framing: Essentials is a starting point, not a destination. If you manage one org and have never had posture visibility, it’s a meaningful upgrade. If you manage twenty, it will likely make the case for the paid tier rather than replace it. (Salesforce has confirmed Essentials lands in every org this summer; confirm the exact entitlement and any edition limits against the release notes for your edition before you budget around it.)

What Security Mesh Actually Does

Security Mesh is the more architecturally interesting half of the announcement, and it’s part of the paid Security Center rather than the broadly-available Essentials tier.

The premise is that modern attacks against Salesforce orgs rarely stay inside Salesforce. The vishing campaigns of the past year started with a phone call and an identity provider, moved through OAuth authorization, and ended with bulk data export. The signals that would have caught them early were scattered across Salesforce Event Monitoring, the identity provider (often Okta), and endpoint security tooling (such as CrowdStrike). No single console saw the whole chain.

Security Mesh is Salesforce’s answer to that fragmentation. It ingests signals from Salesforce and from external partners into a unified data fabric and converts disconnected alerts into risk scores. The goal is correlation: a failed-then-successful login at the IdP, followed by a new connected app authorization in Salesforce, followed by an anomalous export volume, becomes one elevated-risk narrative instead of three unrelated log entries in three different tools.

The rollout is phased. Event Monitoring data and Okta user data are reaching GA this month. CrowdStrike endpoint security signals and tighter Agentforce integration in Security Center are slated for later releases. So the cross-platform vision is real but arriving incrementally — plan around what’s actually GA when you build your detection workflows, not the full roadmap.

The Agentforce Angle

Security Center in Summer ’26 also leans on Agentforce for automated risk assessment — proactively analyzing org activity, surfacing unusual behavior, and alerting admins rather than waiting for someone to open a dashboard.

This is genuinely useful and worth a note of caution in the same breath. Automated risk assessment lowers the floor: an org with no dedicated security analyst gets a system that flags anomalies it would otherwise miss. But “the AI will catch it” is not a security program, and an alert nobody is assigned to triage is just a quieter version of no monitoring at all. Treat Agentforce-driven assessment as a force multiplier for a human who owns the response, not a replacement for one. The same governance questions that apply to any Agentforce deployment — what data it can access, where its decision logic lives, whether its actions are auditable — apply here too.

How to Operationalize This Without Drowning in Alerts

A dashboard that nobody reviews and an alert stream that nobody triages are both worse than useless, because they create the illusion of coverage. Turning Security Center Essentials and Security Mesh into actual risk reduction takes a small amount of process.

Establish the Baseline First

Before you react to anything, capture what “normal” looks like. Enable Security Center Essentials, review every metric it surfaces, and document the current state. Some of what you see on day one will be findings — a permission that’s broader than expected, a connected app nobody remembers authorizing, an MFA gap. Resolve those first so your baseline reflects an intentional posture, not an accidental one.

Assign Ownership

Every metric and alert category needs a named owner and a review cadence. Posture metrics might be a weekly admin review. High-severity risk-score alerts from Security Mesh might need same-day triage. The specifics matter less than the fact that they’re written down and someone is accountable. Unowned monitoring decays into noise within a month.

Tune Before You Scale

When Security Mesh signals come online, expect an initial wave of alerts as the system learns your environment. Resist the urge to either ignore the stream or chase every item. Spend the first few weeks tuning: suppress the known-good, raise the thresholds that fire constantly for benign reasons, and confirm that genuinely anomalous activity rises to the top. A tuned, trusted alert stream that fires ten times a week and is always worth looking at beats an untuned one that fires two hundred times and trains everyone to ignore it.

Connect It to a Standard

Visibility is most valuable when it’s measured against something. Map what Security Center surfaces to a concrete benchmark — whether that’s the Security Benchmark for Salesforce, the CIS-style controls you’ve adopted, or your own internal baseline. That turns the dashboard from a collection of numbers into a compliance signal: green means you meet the control, red means you don’t, and drift becomes immediately visible.

Don’t Mistake the Dashboard for the Program

Security Center Essentials closes the visibility gap. It does not close the response gap, the patching gap, or the configuration-hardening gap. It tells you where you stand; acting on what it tells you is still your job. The orgs that get breached after Summer ’26 won’t be the ones that lacked a dashboard — they’ll be the ones that had one and never looked at it.

The Bottom Line

For years, the biggest barrier to Salesforce security visibility wasn’t technical — it was that consolidated posture monitoring sat behind a paid add-on or a build-it-yourself project, and most orgs chose neither. Security Center Essentials lowers that barrier by bringing a baseline dashboard to every org, and Security Mesh points toward a future where signals from Salesforce, your IdP, and your endpoint tooling correlate into a single risk picture.

None of it secures your org on its own. A dashboard is an input to a decision, not the decision itself. But the setup-and-licensing excuse for having no visibility at all is getting much harder to make, and that’s a meaningful change. The question is shifting from whether you can see your security posture to whether you’ll look.

Book a 15-Minute Security Strategy Call

Reference(s):

https://www.salesforce.com/blog/platform-summer-26-release/

https://www.salesforce.com/blog/summer-26-release-architect-highlights/

https://admin.salesforce.com/blog/2026/your-security-center-just-got-an-agentforce-glow-up

‍