Beyond Profiles and Permission Sets: Understanding True Privilege in Salesforce

Get Instant Access to this Content

Learn more about how to secure your business from threats in places you didn't even know existed.

About the session

This presentation explored how privilege in Salesforce is far more expansive than most organizations realize, revealing how common configurations can silently bypass security controls.

What privilege really means in Salesforce and why the platform doesn't define it for you
How profiles, permission sets, and the additive-only model create unintended access
The overlooked risks of connected apps, API access, and Apex execution contexts
Live demo: bypassing record-level security with just a Read-Only profile and a single permission set
Why the most dangerous security principles in your org are rarely the ones anyone is watching

Meet the Speaker

Christopher Calvani | @nulvox 

Security Researcher

Christopher Calvani is a Security Researcher on BeyondTrust’s research team, where he blends vulnerability research with detection engineering to help customers stay ahead of emerging threats. A recent graduate of the Rochester Institute of Technology with a Bachelor of Science in Cybersecurity, Christopher previously supported large‑scale infrastructure at Fidelity Investments as a Systems Engineer intern and advanced DevSecOps practices at Stavvy.