Is your org exposed?
Thirteen questions an administrator settles from memory, or in two minutes in Setup. What comes out: a priced exposure profile, itemised line by line, printable — the document you put on a committee table.
- 100 %
- inside your org
- 0
- outbound data by default
- 71/255
- controls self-assessed
- 10 min
- to install
Nothing leaves your browser
Your answers go nowhere. There is not even a <form> tag on this
page: no submission is structurally possible. The calculation is done in JavaScript,
on your machine, by the diagnostic.f36b58a7.js file served from this domain. No audience
measurement — this site has none, on any page. And your answers are stored
nowhere, neither with us nor in your browser: reload the page and everything is
wiped.
And it is verifiable: open the Network tab of your browser, then answer the questions. Once the page has loaded, not a single request goes out.
This is not a matter of comfort. A vendor that sells “no data leaves your org” and whose own assessment tool exfiltrates its prospects' answers disqualifies itself. This page is the demonstration of the posture, not its slogan.
The method, shown before it is applied
The scale was not invented for this page: it is the product's own. OrgGuardian prices the risk
carried by an org with a FAIR-lite model — every open finding carries a
severity, every severity carries a weight in euros, and the exposure is the sum
of those weights. The default weights are written in the package code, in
CostOfRiskService.cls:
| Finding severity | Weight per finding |
|---|---|
| Critical | €50,000 |
| High | €15,000 |
| Medium | €3,000 |
| Low | €500 |
| Info | €0 |
These are orders of magnitude, not invoices. Inside an org, a subscriber can replace them with their own (the product then reads those values instead of these defaults). Here, these are the code defaults, without exception.
One single product rule is not applied on this page: the occurrence uplift. Inside an
org, a finding that repeats costs more — +12% per occurrence beyond the first,
capped at twelve additional occurrences, that is a maximum factor of 2.44. Here,
every risky answer is worth exactly one occurrence, so factor 1. The figure you
will get is the floor of the model, never its ceiling.
The thirteen questions, and the detector behind each one
Each one matches a real detector in the package, named under the question along with the key of the finding it produces. If a question strikes you as debatable, you know what to debate: the line of code behind it.
Answer “I don't know” without hesitating whenever that is the case. Those answers are counted separately, at €0, and displayed as such: an unsettled point is not a healthy point.
Your exposure profile
No answer retained so far. Each risky answer will place a line here: the finding the product would raise, its severity, and its weight.
If JavaScript does not run in your browser, this panel will stay empty: the calculation takes place nowhere else. Do the addition by hand then — the full scale further down gives, for each risky answer, the finding, the severity and the weight in euros.
What this figure is, and what it is not
It is an estimate computed from your declarations, not a measurement of your org. Nothing here was read from Salesforce: thirteen answers were converted into findings, and the default weights of the model were added up. An optimistic answer produces an optimistic figure — the tool cannot contradict you.
A real scan adds three things that thirteen questions cannot give:
- Effective permissions. The combination, user by user, of the profile, the standalone permission sets and the permission set groups. This is the only fair measure of a permission: reading the profile alone systematically underestimates, and that is exactly where toxic combinations hide.
- Occurrences. Here, each answer is worth one finding, so factor 1. Inside an org, one and the same finding carries an occurrence count, and the exposure rises by 12% per occurrence beyond the first (cap: twelve, maximum factor 2.44).
- Named targets. The profile, the object, the connected app, the field, the flow. A finding with no target cannot be remediated: it can only be commented on. That is the difference between “accounts without MFA” and the list of accounts to handle on Monday.
Finally, this panel computes no health index. The product's index is built on the real population of the open findings of an org, not on thirteen answers. Showing a score out of 100 here would be inventing a precision the method does not have.
The full scale, question by question
Here is the whole of the table that has just been applied. It serves twice: it lets you contest a line of the result by pointing at its source, and it lets you do the calculation by hand if JavaScript does not run.
| Question and risky answer | Finding of the product | Severity | Weight |
|---|---|---|---|
| 1 · MFA missing, without full access | Security:MfaGap | Medium | €3,000 |
| 1 · MFA missing, with full access | Security:MfaGap | High | €15,000 |
| 2 · Full access + API + no MFA | Security:ToxicCombo | Critical | €50,000 |
| 3 · Integration with View All Data or Author Apex | Security:PrivHygiene:OverScoped | Medium | €3,000 |
| 3 · Integration with Modify All Data | Security:PrivHygiene:OverScoped | High | €15,000 |
| 4 · Dormant app with a broad scope | Security:OAuthApp | Medium | €3,000 |
| 4 · … and self-authorised | Security:OAuthApp | High | €15,000 |
| 5 · More than 3 bulk extraction accounts | Security:DataExport:BulkExport | High | €15,000 |
| 6 · Guest profile with read | Security:GuestExposure | Medium | €3,000 |
| 6 · Guest profile with write or View All | Security:GuestExposure | Critical | €50,000 |
| 7 · OWD set to Public Read Only | Security:Sharing:OWD | Medium | €3,000 |
| 7 · OWD set to Public Read/Write | Security:Sharing:OWD | High | €15,000 |
| 8 · System flow without sharing | Security:Sharing:Flow | Medium | €3,000 |
| 9 · Privileged password that never expires | Security:PrivHygiene:PasswordNeverExpires | High | €15,000 |
| 10 · Dormant account with View All Data | Security:PrivHygiene:Inactive | Medium | €3,000 |
| 10 · Dormant account with Modify All Data | Security:PrivHygiene:Inactive | High | €15,000 |
| 11 · Unclaimed export tool | Security:ApiExfil:Impersonation | High | €15,000 |
| 12 · No native classification | Security:DataClassification:Coverage | Low | €500 |
| 12 · Partial or complete classification | Security:DataClassification:Coverage | Info | €0 |
| 13 · No field encrypted at rest | Security:Encryption:NoneApplied | Info | €0 |
Maximum exposure reachable through this questionnaire: €223,500, by answering the worst case to each of the thirteen questions. A real scan, for its part, raises one finding per target found — per user, per object, per connected app, per field — where this questionnaire produces at most one per question. The two orders of magnitude have nothing to do with each other, and it is not the job of thirteen answers to bring them closer.
This result is out of date tomorrow
This self-check measures a moment, and it measures it on your word. Its flaw is that of any point-in-time audit: the result is out of date the next day. A permission set assigned, a connected app authorised, an object opened for the length of a data migration — each changes the state without triggering anything.
What protects is not the depth of one pass, it is repetition and comparison with the previous state. That is what the product does, in your org, read-only: it detects and it advises, it never remediates in your place.