Copado Buys Valo.ai for Salesforce Security Observability

Copado announced on November 4, 2026 that it has acquired Valo.ai, adding security and operational observability for Salesforce environments to its governed software-delivery platform. The acquisition extends Copado’s oversight beyond the release process into the connections, permissions and risks that persist after applications enter production.

Copado’s Agentia offering already uses context-aware AI agents to automate software planning, development, testing and releases under enterprise governance controls. The Valo deal addresses a different stage: once those changes are live, administrators still need to establish what is connected, who has access, what has changed and where operational risks are emerging. Chief executive Ted Elliott said that requirement becomes more important as AI agents join everyday operations, framing the acquisition as the start of a connection between governed delivery and governed operations.

Valo.ai was founded by leaders with experience building Salesforce security and platform technologies, including Salesforce Shield. Its product examines the live environment, where integrations, permissions and AI agents can create risks that release governance cannot always see.

What Valo Shows Operations Teams

Valo gives Salesforce administrators and operations teams a prioritized view of connected applications, dormant integrations, excessive permissions and unused accounts. Each user, profile and permission set receives a risk score, while a side-by-side comparison helps expose unnecessary access, including access retained by former employees. A separate map assigns risk scores to connected applications and integrations so dormant or risky connections stand out.

Findings also cover license spend. The platform flags inactive users and people who may need only a lower-cost license, and it identifies opportunities to reduce administrative effort. Its role is to surface and prioritize issues; the customer’s team decides what action to take. In Copado’s example, an administrator can find an integration that no longer serves a business purpose but still has Salesforce access, review its permissions and decide whether to remove that access.

Capabilities are at different stages. Valo’s visibility into which AI agents, including Agentforce, have access to a Salesforce organization is labeled early release. That distinction matters because broader agent governance is part of the planned expansion, while the current product centers on people, permissions, connected apps and licenses.

A Phased Path to Governed Remediation

The companies’ deeper integration remains on a phased roadmap. Copado plans to feed Valo’s production intelligence into development, testing and release workflows, turning an identified risk into a recommended change that can be validated and deployed through a governed process. The longer-term design also connects post-deployment impact with remediation, extending governance beyond the moment of release.

Human control is explicit in that design. AI can help find, prioritize and propose actions, while production changes remain subject to customer approvals and an audit trail. AI will not make changes by itself. The closed loop is not fully shipping: Valo’s visibility and Copado’s release workflows exist today, while their deeper integration is phased across live, pilot and planned work.

Standalone Availability and Salesforce Shield

Valo.ai will remain available as a standalone product, and existing customers will continue to receive service and support. Copado plans to introduce additional integrated capabilities in phases, with availability and timing details to be announced. The roadmap also includes broader AI-agent governance and expansion into additional enterprise business systems beyond the initial Salesforce focus.

Copado is positioning Valo alongside Salesforce Shield rather than as a substitute. Shield records activity and provides encryption and audit history. Valo interprets what that activity means, identifies actions for teams to consider and finds unused licenses; it does not replace Shield’s encryption or audit history. An operational-governance assessment offers customers an initial read on their exposures, a prioritized review list and a clear view of what is live versus what remains on the roadmap.

For Salesforce teams, the immediate gain is a consolidated view of production exposure. For Copado, the larger test is connecting those findings to governed remediation while preserving a clear line between detection, recommendation and human-approved change.