AppExchange Partners: Salesforce Now Expects You to Monitor API Usage

In Q4 2025, Salesforce issued a Critical Security Advisory to AppExchange partners, warning of active threats targeting both Salesforce customers and third-party applications.

This advisory was not a general security recommendation. It was a direct call to action for AppExchange partners. Salesforce emphasized that their Partner Business Organization and Packaging Organization now fall within the critical security perimeter, requiring constant vigilance over API activities.

This directive underscores the increasing importance of security within the Salesforce ecosystem, particularly for AppExchange partners who integrate various solutions and services into Salesforce. 

Partners are now expected to actively monitor their API interactions to prevent potential breaches that could affect both their customers and the broader Salesforce environment.

This heightened security responsibility reflects Salesforce’s commitment to maintaining a secure, compliant, and trusted ecosystem for all users of its cloud-based applications and services.

If you’re an Independent Software Vendor (ISV) on Salesforce, you’re likely not operating just a single Salesforce org. Instead, you’re managing a mini-ecosystem comprised of several interconnected orgs. 

Within this ecosystem, two orgs, Partner Business Org (PBO) and Packaging Org, carry a disproportionate amount of risk if compromised, making them high-priority targets for cyber threats.

Partner Business Org (PBO)

Your Partner Business Org typically holds vital data related to your business and customer relationships, including:

• License Management App data, such as customer identities and the Salesforce orgs running your apps.
• CRM and support data linked to your products and customer interactions.
• Environment Hub connections to other Salesforce orgs.

If an attacker compromises your PBO, they gain access to:

• A complete map of your install base, potentially exposing all of your customers.
• The ability to execute highly targeted vishing or phishing attacks using tailored messages like, “We see you’re running version X in org Y…”
• Full access to any integrations or connected apps running from that org, allowing malicious actors to tamper with data flow or exploit vulnerabilities in connected systems.

This is why Salesforce explicitly highlights the Partner Business Org in their security advisories. If compromised, this single org can potentially offer attackers everything they need to manipulate or attack your customers, making it a critical component of your security perimeter.

Packaging Org

Your Packaging Org is where you create, test, and release your 1GP-managed packages, the building blocks of your AppExchange solutions. 

A compromise here introduces significant supply-chain risks. Malicious activity could go unnoticed within what appears to be a routine package update. A breach in the Packaging Org can result in:

• Malicious code being introduced into your app updates, potentially compromising the integrity of your offerings.
• Altered integration settings or connected apps that could mislead customers or cause data leaks.
• Undermined trust in Salesforce-reviewed AppExchange apps, which could result in customers losing confidence in the safety of your products.

From Salesforce’s perspective, if your Packaging Org is flagged as compromised, the safest course of action is to temporarily treat all your apps as unsafe to protect customers, as indicated in the security advisory. 

This may result in immediate disruptions to your business operations and harm your reputation within the Salesforce ecosystem.

For Independent Software Vendors (ISVs), the growing importance of Salesforce security guidelines means that maintaining a secure Partner Business Org (PBO) and Packaging Org has become more crucial than ever. 

Many AppExchange partners are already implementing the basics, such as multi-factor authentication (MFA), profiles, and permission sets, but the key challenge highlighted in the advisory goes beyond these foundational security measures. 

Salesforce’s focus is squarely on monitoring API usage within these high-risk orgs.

In practical terms, this means that you should be able to quickly answer specific questions about API activity within your PBO and Packaging Org, such as:

• What changed?
  • How does today’s API usage compare to last week’s typical pattern?
• Where did it spike?
  • Which objects or time windows saw unusual activity?
• Who or what is responsible?
  • Which connected app, user / integration user, or IP / geography drove the anomaly?
• Is this normal for this org?
  • Is it a legitimate bulk operation, or something that has never happened before

If you can’t find the answers to those questions in just 2–3 clicks for your PBO and Packaging Org, then this call to action from Salesforce couldn’t have come at a better time.

At the same time, most partners don’t want to:

• Stand up a separate SIEM just for a couple of partner orgs
• Build a custom ETL pipeline out of event logs
• Dedicate people to “watch yet another dashboard”

To solve this, ISVs need something that’s native, lightweight, and focused on securing the PBO and Packaging Org without overcomplicating the setup.