Salesforce not only asks ethical hackers to “break into” its technology — it has also invested more than $23 million to date in a Bug Bounty Program that encourages it. The program is a critical part of Salesforce’s strategy to identify security gaps, protect customer data, and address potential risks before malicious actors can exploit them.

Why it matters: Agentic AI is raising the urgency for organizations to secure ‌systems increasingly responsible for autonomous decision-making without human input. Bug bounty programs help organizations stay ahead of potential cyberattacks, manipulation, and exploitation, strengthening protections for their systems and data.

Go deeper: Bug bounty hunters don’t just look for security flaws‌ — ‌they also test for AI bias and behaviors that could present risks. Unlike traditional coding, where engineers dictate every step, AI agents are given a desired outcome and autonomously determine how to reach it. This kind of decision-making demands extra scrutiny to ensure trust.

The hacker perspective: “My role is to think like a malicious actor in the era of agentic AI – to anticipate their moves and uncover vulnerabilities before they can exploit them. Salesforce’s bug bounty program is well known among the ethical hacker community – we look forward to diving deeper with Salesforce into our findings and fortifying the entire digital ecosystem,” said Avinash Sudheer (naaash), an ethical hacker with Salesforce’s Bug Bounty Program. 

The Salesforce perspective: “As we venture further into the era of agentic AI, where AI agents are increasingly used to support critical business operations, ensuring the protection of data and accounting for potential loopholes is paramount,” said Brad Arkin, Chief Trust Officer. “Engaging with ethical hackers through our bug bounty program is a critical frontline defense for proactively identifying and mitigating vulnerabilities.”

As we venture further into the era of agentic AI, where AI agents are increasingly used to support critical business operations, ensuring the protection of data and accounting for potential loopholes is paramount.

Brad Arkin, Chief Trust Officer

Fast Facts:

• In 2024 alone, Salesforce paid over $3 million in bounties to its bug bounty network.
• Approximately 480 ethical hackers participated in the program in 2024, disclosing over 4,000 reports of potential vulnerabilities. 
• Salesforce has awarded individual bounty payouts as high as $60,000.

What’s next: Salesforce is continually expanding its Bug Bounty Program, strengthening its ethical hacker community, and monitoring risks to ensure AI agents can be used in a more trusted way. 

Explore further:

• Learn more about Salesforce’s Bug Bounty Program
• Read more about how companies can set up their own bug bounty programs
• Hear from one of Salesforce’s top ethical hackers about his bug bounty experience
• Learn more about Salesforce’s cybersecurity initiatives and trust commitment 

To inquire about participating in Salesforce’s invitation-only bug bounty program, contact security@salesforce.com.

Blog Article: Here