Salesforce org security

100 %: inside your org
0: outbound data by default
71: controls self-assessed out of 255 catalogued
10 min: to install

The French text governs. This page is the English version of Sécurité FR.

39 capabilities. What the Discovery offer opens among them: 2. A free org gets a security core: accounts without MFA, guest exposure, public file links, connected apps and OAuth tokens, holders of Modify All Data and View All Data. Its Security score is never called “Healthy”: at low coverage, “Partial” replaces the green. The rest of the security posture starts with the paid plans.

39: capabilities in this family
2: active on installation day, on the Discovery offer
Discovery: entry tier of the family

What this family measures

OrgGuardian Security screen: security score, controls passed, toxic combinations, guest exposure and threat detections. — **Security screen.** The Security score says how many controls pass, and which fail first. Demo data.

Four angles, in the order of the table — word for word, the four sub-headings you will find below, row by row.

Identities and their privileges: who can do what, who no longer uses it, which privileges piled up without ever being removed, and which logins fall outside the ordinary — never-seen country, impossible travel, off-hours login by a privileged account.
Exposed surfaces: what your org exposes without authentication, what its public sites let through, which sensitive fields are readable, who can export in bulk, and which connected apps look like an exfiltration tool.
Data, certificates and agents: encryption at rest, native classification, certificate expiry, and the security posture of your Agentforce agents — a subject that did not exist two years ago and that no vendor questionnaire asks about yet.
What you tune yourself: custom rules, thresholds, per-finding SLA, business criticality scopes, and the costing of risk in euros — with your weights, because an amount computed on the publisher's scale means nothing in your steering committee.

Metrics here too carry stable keys: Security:Score, Security:PermSprawl, Security:GuestSurface, Security:OAuthRisk, Security:BlastRadius, Security:MfaCoverage.

The 39 capabilities, one by one

Capabilities of the family, their minimum offer and their state at install.
Capability	Minimum offer	At install
Identities and their privileges
Over-privilege posture`Security_OverPrivilege` · the free core reads two of its families: holders of Modify All Data and View All Data	Any paid plan	—, display tier: nothing to toggle, the offer is enough
Profile / permission set creation and sensitive-identity monitoring`Security_PrivilegeContainer`	Any paid plan	Open
Permission-sprawl detection (Security)`Security_PermSprawl`	Any paid plan	Closed
Dormant-user posture`Security_DormantUsers`	Any paid plan	—, display tier: nothing to toggle, the offer is enough
Role hierarchy exposure (Security)`Security_RoleHierarchy`	Any paid plan	Open
Privilege matrix and consolidation plan`Security_PrivilegeMatrix` · shows the grid and proposes a consolidation plan; it changes no permission	Any paid plan	Open
Public group and queue exposure`Security_PublicGroups` · third effective-access channel, after org-wide defaults and the role hierarchy	Any paid plan	Open
User access review`Security_AccessExplorer` · lists every right the configuration grants a user and where it comes from, exportable to CSV as review evidence; record access is not evaluated	Any paid plan	Open
Login anomaly detection (country, impossible travel, off-hours) (Security)`Login_Anomaly` · no Shield required: derived from LoginHistory and LoginGeo, at every scan	Any paid plan	Closed
Identity verification failures`Security_IdentityVerification` · `VerificationHistory`, a standard object — no Event Monitoring: a `ReportedDenied` means the user declared the request was not theirs	Any paid plan	Open
Backup and restore posture`Security_BackupPosture`	Any paid plan	Open
Exposed surfaces
Guest-user exposure`Security_Guest`	Discovery	—, display tier: nothing to toggle, the offer is enough
Public site posture and site-to-guest inventory (Experience Cloud)`Security_SitePosture`	Any paid plan	Open
Field exposure scanner (sensitive fields, FLS) (Security)`Security_FieldExposure`	Any paid plan	Open
Data-export risk detection (Security)`Security_DataExport`	Any paid plan	Open
Event Monitoring security events (Security)`Security_EmEvents` · with Shield or the Event Monitoring add-on: report exports, Bulk API 2.0 jobs, Login As sessions and Threat Detection anomalies over the last 7 days; without the license it reads nothing, and a family with no event is declared not measured	Any paid plan	Closed
API data exfiltration detection`Security_ApiExfiltration`	Any paid plan	Open
CORS allowlist exposure`Security_Cors` · `CorsWhitelistEntry`: a pattern listed there lets a third-party domain’s JavaScript call the REST API under the signed-in user’s session	Any paid plan	Open
Authentication entry points`Security_AuthSurface` · the login paths that bypass your IdP. Deliberately partial: the two `MyDomainSettings` switches that would close them are not readable from Apex; the finding says so and gives the Setup path	Any paid plan	Open
API clients: first use and expanding usage`Security_ApiExfil_Clients`	Any paid plan	Open
OAuth app posture`Security_OAuth`	Discovery	—, display tier: nothing to toggle, the offer is enough
Toxic combinations analysis`Security_BlastRadius`	Any paid plan	—, display tier: nothing to toggle, the offer is enough
Attack paths`Attack_Path_Engine` · composes OPEN findings into named paths per principal; it adds no detector	Any paid plan	Open
Data, certificates and agents
Encryption at rest for regulated data`Security_Encryption`	Any paid plan	Open
Native data classification (sensitivity level, compliance)`Security_DataClassification`	Any paid plan	Open
Certificate and TLS expiry monitoring`Cert_Monitor` · org certificates read through a self-call through a named credential, never the session token; the external TLS probe goes through the hosted viewer and needs its consent	Any paid plan	Closed
Outbound endpoint reachability probe (Callouts)`Connectivity_Probe` · active probe: an outbound call goes to the endpoint you designate	Any paid plan	Closed
Agentforce AI agent security posture`Agentforce_Posture`	Any paid plan	Closed
Data Cloud posture`Data_Cloud_Posture`	Any paid plan	Open
Pre-encryption impact analysis`Security_EncryptionImpact`	Any paid plan	Open
Field history tracking posture`Security_FieldHistory`	Any paid plan	Open
What you tune yourself
Custom rules`Custom_Rules`	Any paid plan	Closed
Detector tuning`Detector_Tuning`	Any paid plan	Closed
Finding SLA`Finding_SLA`	Any paid plan	Closed
Business criticality scopes`Criticality_Scoping`	Any paid plan	Closed
Cost of risk`Cost_Of_Risk` · adjustable weights: the amount is yours, not an imposed scale	Any paid plan	Closed
Accepted-risk policies`Accepted_Risk_Policy`	Any paid plan	Open
Rule portability`Rule_Portability`	Any paid plan	Open
Natural-language query`NL_Query`	Any paid plan	Open

— display tier: nothing to toggle, the offer is enough

Source: read from the package code at the moment this page is built — FeatureGate.FEATURE_TIER for the offer, FeatureGate.CODE_DEFAULTS for the state at install, and for the label the full resolution of FeatureToggleAdminController: the enablement guide’s catalogue first, the GateLabels custom labels next, and failing that the technical name as is. The editor’s labels — the whole column, not just that fallback — ship in English: master language en_US, and the package carries no translation file: these are the exact strings your administrator reads in the feature editor, and the site build fails if any of these lists moves without the others. “Closed” does not mean absent: the capability is shipped, it is waiting for a human to open it inside the org — and a capability whose implementation nothing in the package can reach appears on none of these pages: the build drops it instead of selling it.

What this family does not do

No remediation. The product does not remove a permission, close a guest access or revoke a token. It names, it costs, it ranks; you decide.
It does not read your business data. It reads the configuration and the metadata describing who may see what. It does not walk your records and does no content DLP and no antivirus.
It is not a penetration test. A detector observes one named facet; it does not prove the absence of an attack path it does not observe.
It is not a SIEM. Login anomalies are derived from LoginHistory and LoginGeo at every scan; they do not replace continuous event correlation.
Every query runs with your rights. What the user running the scan may not see, the product does not see either — and it says so instead of concluding “healthy”.

The other families

Discovery 38 capabilities Monitoring 14 active on installation day Limits, health, failed logins, async queues, outbound endpoints, Event Monitoring logs. Any paid plan 15 capabilities Code and configuration none active on installation day Apex and declarative linters, coverage, technical debt, configuration drift, state at a past date. Any paid plan 5 capabilities Compliance none active on installation day Findings mapped to eight frameworks, signed attestation, board report. Discovery 28 capabilities Alerts 3 active on installation day Alerting without drowning: deduplication, grouping, escalation, quiet hours, external channels. Discovery 7 capabilities Integrations 1 active on installation day Read REST API, SIEM export, ITSM integration, Agentforce actions.

Is this family in your offer? The grid says so line by line.

See the pricing grid Back to the seven families