Salesforce Shield and Guardian
Shield is still a product. Salesforce Guardian is the wider security, privacy and resilience portfolio that includes it. Here is how they fit.
Salesforce Shield and Salesforce Guardian are often confused. Shield is a product: a set of add-on security tools for your org. Salesforce Guardian is the umbrella name Salesforce now uses for its add-on portfolio for data security, privacy and resilience. Guardian includes Shield, but it is not a new name for Shield.
What it is for
Most Salesforce security comes from configuration: profiles, permission sets, sharing and login policies. Shield and the wider Guardian portfolio add controls for organisations that must prove who accessed what, encrypt sensitive fields, keep audit history longer, manage consent or recover from data loss. These are common demands in financial services, healthcare and the public sector.
Shield components
| Component | What it does |
|---|---|
| Platform Encryption | Encrypts sensitive data at rest in your org, with key management options |
| Event Monitoring | Records detailed user and system activity for security analysis |
| Field Audit Trail | Keeps field history for longer than standard history tracking |
| Data Detect | Scans your data to find sensitive information you may need to protect |
In Spring '26, Salesforce added Shield Experience Enhancements, which bring all four components into one place with guided setup.
What Salesforce Guardian includes
- Shield, and Security Center with Security Mesh
- Customer Identity and Mobile App Security
- Privacy Center, and Data Mask & Seed
- Backup & Recover, and Archive
Salesforce lists Data 360 Governance, Anypoint API Governance and Hyperforce Operating Zone alongside them.
Winter '27 Guardian features, which Salesforce's platform blog lists as GA unless noted, include MCP Risk Scores in Security Center, Security Mesh connectors for DigitSec and WithSecure, Global Consent Manager in Privacy Center, and Platform Encryption for Archive and Backup. Observability Center is in Beta. Salesforce's admin blog says Security Center Essentials has been released at no cost.
How it connects
These tools protect data across every cloud on the Salesforce Platform. Encryption affects how fields behave in search, formulas, reports and integrations. MCP Risk Scores reflect how AI agents and MCP connections now reach org data. Heroku has its own Heroku Shield option for apps running outside the org.
Who it suits
Regulated industries, organisations with formal audit duties, and companies whose security teams want activity data in their own monitoring tools.
Planning and common mistakes
Start with a data classification exercise: which fields are sensitive, and which rule applies to each. Then map each requirement to a control. Don't buy every component by default.
Common mistakes:
- Encrypting fields without checking the effect on reports, filters and matching rules.
- Collecting event logs that nobody reviews.
- Assuming backup is someone else's job.
- Leaving data masking out of sandbox refreshes.
How GeekMidst can help
We can help you classify data, plan a Shield or Guardian rollout and test its effect on your existing configuration. Our org health check reviews permissions and sharing, and our architecture consulting covers security design for new programmes.
Questions we hear
Has Shield been renamed to Guardian?
Do we need Shield to be secure?
Which Guardian features are in beta?
Is Security Center free?
Related reading
Org health check checklist
Review permissions, sharing and settings
→Securing API integrations
Reduce risk from connected systems
→Security and data handling
How we handle client data
→Salesforce product map
Where security fits in the wider lineup
→Sources
Need to tighten Salesforce security?
We can map your security and privacy requirements to the right Shield and Guardian controls.
