Security for Sales Teams: CRM Data, Devices and Deal Room Risk

Sales teams carry the customer list, the pricing and the pipeline on laptops and phones that travel everywhere, and they talk to strangers for a living, which makes them one of the easiest routes into an organisation's most valuable commercial data. Sellers export CRM reports to work offline, share proposals through links that never expire, use personal messaging apps with customers, and are trained to respond quickly to anyone who might buy. Attackers exploit each of those habits, and the commercial damage from a stolen pipeline or a fraudulent payment instruction to a customer lands on the sales relationship. This guide covers the human and process side of sales security: CRM data handling and exports, devices and travel, deal rooms and document sharing, impersonation and payment fraud around deals, leavers and territory changes, and how to measure progress. It is for sales operations and revenue operations leaders, CRM owners and the security teams that support them. AI agents and AI SDRs in the CRM are covered in AI Agents in Sales and CRM, which this page does not repeat.

Key takeaways

• Exports are the main leak. Most sales data loss starts as a report exported to a spreadsheet; limit export rights, require approval for bulk exports and log them.
• Sellers are targeted by phone as well as email. Callers posing as IT support talked customer-facing staff into approving malicious connected apps in the ShinyHunters Salesforce campaign; no seller should ever approve an app or read out a code on request.
• Deal rooms need expiry and named access. Proposals, pricing and contracts shared through anonymous links outlive the deal; use named guest access with expiry dates.
• Payment detail changes are verified out of band. Attackers impersonate both your sellers and your customers to redirect payments; a call to a known number stops most of it.
• Leavers are the predictable insider risk. Departing sellers are the people most likely to take a customer list; watch exports and downloads around resignation and remove access on the last day.

What sales holds and who wants it

Sales data is valuable to criminals for fraud and extortion, and to competitors and departing employees for its commercial content. The table maps the main assets to the threat and the control.

CRM data handling and exports

The CRM platform's own hardening is covered in Securing the customer relationship management (CRM) platform itself. For the sales team, four habits matter most.

• See what you need, not the whole database: a seller needs their territory and their accounts. Ask the CRM owner to set record visibility by team or territory, not organisation-wide read access, and to restrict field visibility for data such as personal mobile numbers.
• Separate export from view: most CRMs treat export as its own permission. HubSpot, for example, documents separate Export, Export without approval and Approve exports permissions, so exports can be routed to a sales operations approver. Give export without approval to a small group only.
• Work in the CRM, not in spreadsheets: use CRM views and dashboards for forecasting rather than weekly exports. Where an extract is unavoidable, keep it in the approved document store with a deletion date, never in personal email or a personal cloud drive.
• Never approve an app or read out a code for a caller: in the ShinyHunters Salesforce campaign, attackers phoned staff, posed as IT support and had them enter a connection code that approved a modified data loader app, which then bulk-exported CRM data through the API. Connected app approval should sit with administrators, not sellers. See the How to review Salesforce connected apps and integration users.

Sales tools and integrations

Sales stacks add enrichment tools, dialers, sequencing tools, browser extensions and meeting recorders, each connected to the CRM or the mailbox with an OAuth grant. Each grant is a non-human identity that keeps working after the seller who approved it leaves. New sales tools should go through procurement, connect with a dedicated integration user rather than a seller's login, and appear on the OAuth inventory. The Salesloft Drift breach showed how tokens held by one sales integration opened hundreds of customer CRM tenants. See the SaaS and OAuth App Governance Guide.

Devices, travel and working in public

Sellers work from airports, hotels, client sites and trade shows. The controls are the standard ones, applied without exceptions for senior sellers.

Customer conversations on personal messaging apps are a common gap: they sit outside retention, legal hold and offboarding. Agree which channels are approved for customer contact and how business conversations are kept. See the Securing Messaging Apps Guide.

Deal rooms, proposals and document sharing

Late-stage deals involve security questionnaires, pricing, draft contracts and sometimes the customer's own confidential information. That material often travels as "anyone with the link" shares that never expire.

• Named access over anonymous links: in SharePoint and OneDrive, for example, the external sharing level can be set to Anyone, New and existing guests, Existing guests, or Only people in your organization. For deal material, use guest access for named customer contacts rather than Anyone links.
• Expiry by default: set a maximum for Anyone link expiration and use the setting that makes guest access to a site or OneDrive expire after a set number of days, so closed and lost deals stop sharing automatically.
• Dedicated deal rooms for high-value or regulated deals: virtual data rooms add per-document permissions, view-only modes, watermarking and access reports. See the Secure File Sharing and Virtual Data Rooms buyer's guide.
• Customer data received in the deal: network diagrams, security reports and data samples from the prospect belong in the deal room, not in a seller's inbox, and are deleted when the deal closes or is lost.
• E-signature: send contracts from the organisation's e-signature account, not a personal one, so templates, audit trails and signer verification stay under control. See Securing the e-signature platform itself.

See the Secure File Sharing Guide for the wider policy.

Impersonation and payment fraud around deals

Deals create predictable moments for fraud: a contract is signed, an invoice is due, a customer is waiting for bank details. The FBI's IC3 reported 305,033 business email compromise incidents worldwide with exposed losses of $55,499,915,582 between October 2013 and December 2023 (public service announcement I-091124-PSA, 11 September 2024), and advises verifying any request to change account information through a secondary channel.

• Fake seller to customer: an attacker with access to a seller's mailbox, or a lookalike domain, sends the customer "updated" bank details. Tell customers at contract stage that your bank details will never change by email alone and how to verify.
• Fake customer to seller: a "procurement contact" asks for a security questionnaire, a reference list or a login to a trial environment. Verify new contacts through the known account relationship before sharing.
• Fake executive to seller: an urgent request from "the CEO" to approve a discount or send a contract outside process. See the Business Email Compromise Awareness for Finance Teams Guide for the verification habits finance uses.
• Mailbox rules after takeover: attackers create rules that hide customer replies. Sellers should report rules they did not create, and security should alert on new forwarding rules.

Outbound email rules matter too. In the UK, the ICO's PECR guidance allows marketing emails to corporate bodies without prior consent, treats sole traders and some partnerships as individuals who need consent or the soft opt-in, and requires every message to identify the sender and give a valid opt-out address. AI-assisted outreach rules are in AI Agents in Sales and CRM.

Leavers, territory changes and insider risk

A departing seller's customer list has obvious value to the next employer. The controls are timing and visibility, not suspicion of individuals.

1. Before notice: keep export rights narrow so there is less to take.
2. At resignation: HR tells IT the same day. Insider risk tools can watch for unusual activity near the leaving date; Microsoft Purview's Data theft by departing users policy template, for example, is triggered by a resignation or termination date from the HR connector or by deletion of the Entra account, and looks for downloads from SharePoint Online, printing and copying data to personal cloud storage and messaging services.
3. Last day: disable the account, revoke mobile sessions and OAuth grants, reassign records and sequences, and remove access to deal rooms and partner portals. See the Employee Offboarding Security Guide.
4. Territory moves: remove access to the old territory when the new one is granted. Mover access creep is common in sales because reorganisations are frequent.

Any monitoring of employees must be proportionate, transparent and agreed with HR, legal and, where relevant, works councils. See the Insider Risk Executive Briefing.

Implementation: a phased rollout

The phases, timings and targets on this page are NHI Mgmt Group recommendations; adjust them to your sales cycle.

1. Baseline (weeks 1 to 3): list who can export from the CRM, how many exports ran last quarter, which sales tools hold OAuth grants, and how deal documents are shared.
2. Quick wins (weeks 3 to 6): enforce MFA on the CRM and mailboxes, move export without approval to a small group, and set expiry on external sharing links.
3. Tools and devices (weeks 6 to 10): require managed devices or app protection for CRM mobile apps, review and remove unused sales tool grants, and move integrations to integration users.
4. Process (weeks 8 to 12): add payment verification wording to contract templates, set up a deal room standard for high-value deals, and connect HR leaver dates to IT.
5. Training (ongoing): a 30-minute role-based session using vishing for connection codes, fake procurement contacts and bank detail change lures. See the Role-Based Security Training Programme Guide.
6. Test and roll back: pilot export approval with one sales team for two weeks, measure approval turnaround, then extend. Keep the previous permission set so it can be restored quickly if forecasting breaks during quarter end.

Decision guidance

• Small team: MFA everywhere, a password manager, company-owned CRM and e-signature accounts, and a single owner for exports. A full insider risk tool is unlikely to be proportionate.
• Growing team with sales operations: export approval, territory-based visibility, OAuth reviews each quarter and a deal room standard.
• Large or regulated organisation: single sign-on and conditional access for sales tools, endpoint and email DLP, insider risk policies tied to HR events, and CRM event logs in the SIEM.
• Quarter end: do not change sales permissions in the last two weeks of a quarter; schedule changes for the start of a quarter, when friction costs least.
• Personal phones: where the organisation will not issue phones, app protection policies that keep CRM data inside managed apps are the practical middle ground.

Detection and measurement

Log and alert on bulk or unusual CRM exports, report exports by users who rarely export, new connected app or OAuth approvals by non-admins, new mailbox forwarding rules, sign-ins from new countries during travel, and downloads near leaving dates. See the Impossible Travel and Anomalous Sign-In Detection guide.

Common failure patterns

• Organisation-wide read access. Every seller can see every account, so one compromised login exposes the whole customer base.
• Connected app approved by a seller on a call. The pattern behind the ShinyHunters Salesforce campaign.
• Exports as the reporting system. Weekly spreadsheets in personal drives become the copy that leaks.
• Proposals shared with anonymous, permanent links. Pricing and customer data stay reachable long after the deal.
• Personal e-signature and messaging accounts. Contracts and conversations leave with the seller.
• Leaver access removed late. Mobile sessions and sales tool grants survive the account being disabled.

Framework mapping

Practitioner checklist

• Set CRM record visibility by territory or team, not organisation-wide.
• Limit export without approval to a small named group and log every export.
• Allow only administrators to approve connected apps and OAuth grants.
• Enforce MFA on CRM and mailboxes and alert on new forwarding rules.
• Require managed devices or app protection policies for CRM mobile access.
• Use named guest access with expiry for deal documents and a deal room for high-value deals.
• Add bank detail verification wording to contracts and invoices.
• Connect HR leaving dates to IT and remove all sales access on the last day.
• Train sellers with vishing, fake procurement and payment change lures twice a year.

Standards and references

• FBI IC3: Business Email Compromise, the $55 Billion Scam (I-091124-PSA)
• ICO: Electronic mail marketing (Guide to PECR)
• Microsoft Learn: Insider risk management policy templates
• Microsoft Learn: Manage sharing settings for SharePoint and OneDrive
• HubSpot Knowledge Base: HubSpot user permissions guide
• NHI Mgmt Group: ShinyHunters Salesforce Data Theft Campaign 2025

Related NHI Mgmt Group resources: AI Agents in Sales and CRM · Securing the customer relationship management (CRM) platform itself · Security for Marketing Teams · Security Awareness and Human Risk Management Guide