Salesforce Security Team: Replacing Email Inbox with Agentforce Conversational Triage
The internal security team at Salesforce replaced an inbox of approximately 110,000 security-related emails over 18 months with an Agentforce-driven conversational triage system in Slack. The core architectural decision was to have AI guide users to complete context in real time during the reporting process, rather than submitting first and filling gaps through follow-up questions. Supported by a quality scorecard of six categories and twelve subcategories, along with continuous simulation testing, 72% of 378 conversations from 261 beta employees were handled instantly, while 28% were converted into complete structured cases requiring no human preliminary triage. All data is self-reported by the vendor with a limited sample size.
Over the past 18 months, the internal security team at Salesforce received approximately 110,000 emails related to security concerns. Roughly half of these originated from employees, and 45% of those employee emails required manual triage. The Corporate Security Operations Center (CSOC) team spent significant time re-routing requests unrelated to security, chasing down missing log details, and deciphering ambiguous short descriptions. Genuine security signals were buried under sheer volume.
In November 2026, the Salesforce security team published an internal practice record detailing how they replaced this email inbox with a Slack-native assistant powered by Agentforce—the Security Reporting Agent. Authors Julissa Marcenaro, Matt Robinson, and Jingqi Wu summarized the core architectural decision as shifting from an invisible backend email parser to an active conversational frontline experience within Slack. This approach guides employees to write comprehensive reports in real time during the conversation, rather than having to fill in blanks after submission through follow-up requests.
This transition involved the coordination of three technical components: Slack served as the conversational entry point; Agentforce executed real-time guided triage and dynamically prompted for missing context; and Service Cloud acted as the underlying engine to generate pre-structured cases and route them directly to CSOC responders. The product team shifted the model from a backend parser to a conversational guide; the engineering team migrated the agent to Agentforce Script, consolidating multiple overlapping topics into a streamlined execution framework; and the operations team analyzed five years of historical data to determine which requests truly belonged to CSOC and which merely created friction—for instance, lost badge requests should be directed to Facilities, and phishing inquiries should be routed directly to Gmail’s native reporting tool.