Prepared for Orange Cyberdefense

Orange Cyberdefense is a managed security provider under NIS2. The Salesforce org that quotes and orders its contracts deserves the scrutiny it sells.

Order intake is up 15% and a new Spanish entity has launched. The stated goal is one Salesforce CPQ calculation model across all countries.

Book the session Why Flosum, specifically

+10.6%revenue growth, H1 2026

+15%order intake, H1 2026

3,300cyberdefenders

14 monthsto build the CPQ module

Where Orange Cyberdefense is headed

Orange Cyberdefense is growing by adding countries to one global lead-to-cash model.

Orange Cyberdefense España launched in H1 2026 through the partnership with MasOrange.

Salesforce CPQ extends Sales and Service Cloud to harmonise lead-to-cash, starting with the Netherlands, Belgium and the UK.

The goal is one calculation model for all countries and CPQ as the first step to automated renewals.

Expansion

Spain launched with MasOrange

Standardisation

One CPQ model across countries

Renewals

Automation planned on CPQ

Pressures

A security provider’s own systems are the first place customers and regulators look.

NIS2

Managed security service providers are listed in Annex I.

Commercial pace

Order intake up 15%.

Pricing accuracy

Vendor and distributor prices flow into quotes.

Customer data

Contracts and contacts under GDPR.

What leadership has said

The CEO names agility and anticipation as the company’s edge.

In a market being reshaped by artificial intelligence, geopolitical tensions, and an increasingly sophisticated threat landscape, our strength lies in remaining agile, anticipating change, and transforming innovation into tangible value for our customers.
Hugues Foulon, CEO, Orange Cyberdefense
Anticipating change applies to the change process inside Salesforce too.

Technology alone is never enough.
Hugues Foulon, CEO, Orange Cyberdefense

Orange Cyberdefense’s Salesforce reality

Quotes, orders and contracts for Orange Cyberdefense run through Salesforce.

What is published.

Sales and Service Cloud: In use across the organisation
Salesforce CPQ: Global lead-to-cash, live after 14 months
Integrations: Vendors, distributors, currency conversion
AFAS: Orders handed to Finance from Salesforce

What’s at risk

CPQ concentrates pricing logic; one bad release misprices every country at once.

If this happens	Why it is plausible	What it costs
Faulty price rule deployed	One calculation model for all countries	Wrong quotes across markets.
Contract data lost	Contracts and renewals	Renewal forecasting breaks.
Untracked config change	NIS2 Annex I provider	Audit finding at a security firm.
Customer data in test	Contracts and contacts	GDPR exposure.

Why it’s imperative for Orange Cyberdefense to choose Flosum

Why it’s imperative for Orange Cyberdefense to choose Flosum: its own platform has to pass the audit it prepares customers for.

Each row ties an Orange Cyberdefense priority to a control.

Orange Cyberdefense initiative	Exposure today	Flosum capability	Outcome
Country rollout	CPQ change breaks other countries	Dependency checks and rollback	Each country lands safely
NIS2	Untracked change	Audit trail and drift detection	Proof of control on demand
Renewals	Contract loss	Point-in-time backup and restore	Renewal data intact
GDPR	Real data in test	Masking and data held in your own cloud	No real customers in test

Flosum is rated 4.80 on G2 and 4.97 on AppExchange.

Flosum DevOps

Governed CPQ releases let each new country go live without touching the others.

CPQ is shared by every country.

Where it bites today

Global CPQ model

What Flosum changes

Admin clicks, developer code and AI-generated changes all go through the same version control, approvals and audit trail.
Metadata is merged component by component, so two people editing the same Flow or profile do not overwrite each other.
A dependency graph catches the deployment that would fail before it reaches production.
If a release goes wrong, one-click rollback puts the org back.
Release evidence is produced as the work happens and kept beyond Salesforce’s native 180-day Setup Audit Trail.
Teams on Flosum report 40% higher development velocity and 75% fewer merge conflicts.

How Orange Cyberdefense would measure it

Lead time from request to production
Failed or rolled-back deployments per quarter
Changes shipped with a complete approval record

Flosum Backup & Archive

Record-level restore protects quotes, orders and contracts.

Contract data drives renewals.

Where it bites today

Renewal automation planned
Salesforce’s Weekly Export runs every 7 days and deletes files after 48 hours; its Data Recovery Service costs $10,000, takes 6 to 8 weeks and returns no metadata.

What Flosum changes

Backups run near-continuously, and restores can target a single field, a record or the full org at a point in time.
Data, metadata, files and the relationships between records are all protected.
Backups can live with Flosum or in your own AWS, GCP, Azure or private cloud, with keys you hold.
Backups sit completely apart from Salesforce, the segregation DORA Article 12(3) asks for.
Salesforce bought Own in 2024. Flosum stays independent of the platform it protects.

How Orange Cyberdefense would measure it

Recovery point objective for the org
Time to restore a single corrupted record set
Restore drills passed per year

Flosum Sandbox Management

Warm-start sandboxes give CPQ testers realistic price books.

Pricing needs realistic test data.

Where it bites today

Vendor price integrations
Full sandboxes refresh on a 29-day clock

What Flosum changes

Developer sandboxes arrive ready to work: Flows disabled, PII masked, production data seeded, access locked and the pipeline reconnected.
Full-copy sandboxes stay in continuous sync with production, so the 29-day refresh window stops setting the schedule.
Teams need fewer full-copy licenses, and the 25 to 100 developer sandboxes in Enterprise editions stop sitting idle.

How Orange Cyberdefense would measure it

Hours from refresh to a usable sandbox
Full-copy sandbox licences in use

Sandbox Management is in early access; Flosum offers a 30-minute working demo on your own metadata.

Flosum Data Masking

Masking keeps customer contracts out of test orgs.

A security firm cannot leak its own data.

Where it bites today

GDPR

What Flosum changes

Masking happens before data lands in the sandbox, which turns it from a best-effort cleanup into a guarantee.
Because masking is part of sandbox provisioning, every new developer sandbox is masked by default.
Encryption keys can stay with your team.
Masked sandboxes are locked to a minimal set of users, which supports GDPR, HIPAA and GxP programs.

How Orange Cyberdefense would measure it

Share of sandboxes masked at creation
Real customer records found outside production (target: zero)

Org protection from configuration errors

Drift detection flags changes made outside the pipeline.

NIS2 expects controlled change.

Where it bites today

NIS2 Annex I

What Flosum changes

Automatic org synchronization flags drift when someone changes production outside the pipeline.
Release evidence is produced as the work happens and kept beyond Salesforce’s native 180-day Setup Audit Trail.
If a release goes wrong, one-click rollback puts the org back.

How Orange Cyberdefense would measure it

Out-of-process changes detected per month
Time to detect and revert a bad change

Why now

Each new country added to CPQ raises the cost of an uncontrolled release.

Expansion is happening now.

2023CPQ live in NL, BE, UK

H1 2026Spain launched; order intake +15%

NextMore countries onto one CPQ model

NextAutomated renewals

The first 90 days

Map the CPQ release path
One price-rule change through Flosum
Restore drill on contracts
NIS2 change-control report

Next step

A 45-minute session with the lead-to-cash team: one CPQ release, one restore.

Bring the Salesforce product owner and the CISO for internal IT.

Your CPQ in a Flosum pipeline
Timed restore of a contract
NIS2 change-control report

Book the session

Prepared by Flosum for Orange Cyberdefense, October 24, 2026. Orange Cyberdefense names and program names belong to their owners.