This Switzerland-based manufacturing enterprise supports the construction and building sectors with operations spanning 250+ factories, suppliers, and distributors. With Salesforce clouds (Sales, Service, and Pardot) deployed across a global, multi-org architecture, the company struggled to monitor user activity and detect potential security threats. Salesforce’s native limitations, such as short login history retention and frequent query timeouts, further reduced visibility. The security team needed a way to aggregate activity across orgs, analyze access trends, and proactively detect threats, all without exposing data beyond the enterprise firewall.