Is your org exposed?

Thirteen questions an administrator settles from memory, or in two minutes in Setup. What comes out: a priced exposure profile, itemised line by line, printable — the document you put on a committee table.

Updated · Thirteen questions · About 5 minutes

100 %
inside your org
0
outbound data by default
71/255
controls self-assessed
10 min
to install

Nothing leaves your browser

Your answers go nowhere. There is not even a <form> tag on this page: no submission is structurally possible. The calculation is done in JavaScript, on your machine, by the diagnostic.f36b58a7.js file served from this domain. No audience measurement — this site has none, on any page. And your answers are stored nowhere, neither with us nor in your browser: reload the page and everything is wiped.

And it is verifiable: open the Network tab of your browser, then answer the questions. Once the page has loaded, not a single request goes out.

This is not a matter of comfort. A vendor that sells “no data leaves your org” and whose own assessment tool exfiltrates its prospects' answers disqualifies itself. This page is the demonstration of the posture, not its slogan.

The method, shown before it is applied

The scale was not invented for this page: it is the product's own. OrgGuardian prices the risk carried by an org with a FAIR-lite model — every open finding carries a severity, every severity carries a weight in euros, and the exposure is the sum of those weights. The default weights are written in the package code, in CostOfRiskService.cls:

Weight in euros per finding severity
Finding severityWeight per finding
Critical€50,000
High€15,000
Medium€3,000
Low€500
Info€0

These are orders of magnitude, not invoices. Inside an org, a subscriber can replace them with their own (the product then reads those values instead of these defaults). Here, these are the code defaults, without exception.

One single product rule is not applied on this page: the occurrence uplift. Inside an org, a finding that repeats costs more — +12% per occurrence beyond the first, capped at twelve additional occurrences, that is a maximum factor of 2.44. Here, every risky answer is worth exactly one occurrence, so factor 1. The figure you will get is the floor of the model, never its ceiling.

The thirteen questions, and the detector behind each one

Each one matches a real detector in the package, named under the question along with the key of the finding it produces. If a question strikes you as debatable, you know what to debate: the line of code behind it.

Answer “I don't know” without hesitating whenever that is the case. Those answers are counted separately, at €0, and displayed as such: an unsettled point is not a healthy point.

Question 1 · Authentication Is multi-factor authentication enforced for all your interactive users?

Setup › Permission Sets and Profiles › the “Multi-Factor Authentication for User Interface Logins” permission.

Detector MfaGapCollector · finding Security:MfaGap

Question 2 · Toxic combination Does any account combine full data access, API enabled, and no MFA?

on one and the same user, the combination of profile + permission sets + permission set groups — never the profile alone, which always underestimates. An account caught here may also be caught by question 1: these are two distinct detectors, and the product does add up both findings.

Detector BlastRadiusCollector · finding Security:ToxicCombo

Question 3 · Integration accounts Do your accounts on an integration licence carry a high-risk permission?

Setup › Users, filter on the “Salesforce Integration” licence, then look at their combined permissions.

Detector PrivilegedAccountHygieneCollector · finding Security:PrivHygiene:OverScoped

Question 4 · Connected apps Does a dormant connected app still hold a broad OAuth scope?

Setup › Connected Apps OAuth Usage, last-used column.

Detector ConnectedAppRiskCollector · finding Security:OAuthApp · score = broad scope 30, self-authorisation 25, dormant 20, many tokens 15; finding beyond 40, High from 70

Question 5 · Bulk extraction Do more than three active accounts combine full read access and an export capability?

cross “View All Data” with “Data Export”, “Export Reports” and “API Enabled”. This is the ability to take the whole org out, not to read it.

Detector DataExportRiskCollector · finding Security:DataExport:BulkExport · threshold: more than 3 holders

Question 6 · Guest access Do your Experience Cloud guest profiles have access to objects?

Setup › Digital Experiences › All Sites, then the guest profile of each site › Object Settings.

Detector GuestExposureCollector · finding Security:GuestExposure

Question 7 · Sharing defaults Is any object open in the organisation-wide defaults?

Setup › Sharing Settings, the organisation-wide defaults table, internal and external columns.

Detector SharingExposureCollector · finding Security:Sharing:OWD

Question 8 · Flows Do any active flows run in system context without sharing?

Setup › Flows, the “How to Run the Flow” property (RunInMode).

Detector SharingExposureCollector · finding Security:Sharing:Flow

Question 9 · Privileged passwords Does a privileged account carry “Password Never Expires”?

the permission sets carrying PasswordNeverExpires, crossed with the holders of elevated permissions.

Detector PrivilegedAccountHygieneCollector · finding Security:PrivHygiene:PasswordNeverExpires

Question 10 · Dormant accounts Has a privileged account been dormant for more than 90 days?

Setup › Users, the “Last Login” column, on accounts with elevated permissions only.

Detector PrivilegedAccountHygieneCollector · finding Security:PrivHygiene:Inactive · dormancy threshold: 90 days

Question 11 · Export tools Does a connected app carry the name of a bulk extraction tool?

Setup › Connected Apps, read the names. The detector accepts an allowlist for the tools you use knowingly.

Detector ApiExfiltrationCollector · finding Security:ApiExfil:Impersonation · watched names: dataloader, workbench, postman, talend, jitterbit, mulesoft, dbeaver, informatica

Question 12 · Classification Do your fields carry a native classification?

Setup › Data Classification (data sensitivity level, compliance categorisation, business owner).

Detector DataClassificationCollector · finding Security:DataClassification:Coverage

Question 13 · Encryption at rest Are any fields encrypted at rest?

Setup › Platform Encryption. This question is here for a reason of method: it shows that a finding can be worth €0. A scale that only produces expensive lines is not a scale, it is a sales pitch.

Detector EncryptionPostureCollector · finding Security:Encryption:NoneApplied

Your exposure profile

Local calculation Waiting for your answers

No answer retained so far. Each risky answer will place a line here: the finding the product would raise, its severity, and its weight.

If JavaScript does not run in your browser, this panel will stay empty: the calculation takes place nowhere else. Do the addition by hand then — the full scale further down gives, for each risky answer, the finding, the severity and the weight in euros.

0 finding retained, of which 0 critical €0 of estimated exposure 0 point of uncertainty 13 questions unanswered

What this figure is, and what it is not

It is an estimate computed from your declarations, not a measurement of your org. Nothing here was read from Salesforce: thirteen answers were converted into findings, and the default weights of the model were added up. An optimistic answer produces an optimistic figure — the tool cannot contradict you.

A real scan adds three things that thirteen questions cannot give:

  • Effective permissions. The combination, user by user, of the profile, the standalone permission sets and the permission set groups. This is the only fair measure of a permission: reading the profile alone systematically underestimates, and that is exactly where toxic combinations hide.
  • Occurrences. Here, each answer is worth one finding, so factor 1. Inside an org, one and the same finding carries an occurrence count, and the exposure rises by 12% per occurrence beyond the first (cap: twelve, maximum factor 2.44).
  • Named targets. The profile, the object, the connected app, the field, the flow. A finding with no target cannot be remediated: it can only be commented on. That is the difference between “accounts without MFA” and the list of accounts to handle on Monday.

Finally, this panel computes no health index. The product's index is built on the real population of the open findings of an org, not on thirteen answers. Showing a score out of 100 here would be inventing a precision the method does not have.

The full scale, question by question

Here is the whole of the table that has just been applied. It serves twice: it lets you contest a line of the result by pointing at its source, and it lets you do the calculation by hand if JavaScript does not run.

Mapping between each risky answer, the finding of the product, its severity and its weight
Question and risky answer Finding of the product Severity Weight
1 · MFA missing, without full accessSecurity:MfaGapMedium€3,000
1 · MFA missing, with full accessSecurity:MfaGapHigh€15,000
2 · Full access + API + no MFASecurity:ToxicComboCritical€50,000
3 · Integration with View All Data or Author ApexSecurity:PrivHygiene:OverScopedMedium€3,000
3 · Integration with Modify All DataSecurity:PrivHygiene:OverScopedHigh€15,000
4 · Dormant app with a broad scopeSecurity:OAuthAppMedium€3,000
4 · … and self-authorisedSecurity:OAuthAppHigh€15,000
5 · More than 3 bulk extraction accountsSecurity:DataExport:BulkExportHigh€15,000
6 · Guest profile with readSecurity:GuestExposureMedium€3,000
6 · Guest profile with write or View AllSecurity:GuestExposureCritical€50,000
7 · OWD set to Public Read OnlySecurity:Sharing:OWDMedium€3,000
7 · OWD set to Public Read/WriteSecurity:Sharing:OWDHigh€15,000
8 · System flow without sharingSecurity:Sharing:FlowMedium€3,000
9 · Privileged password that never expiresSecurity:PrivHygiene:PasswordNeverExpiresHigh€15,000
10 · Dormant account with View All DataSecurity:PrivHygiene:InactiveMedium€3,000
10 · Dormant account with Modify All DataSecurity:PrivHygiene:InactiveHigh€15,000
11 · Unclaimed export toolSecurity:ApiExfil:ImpersonationHigh€15,000
12 · No native classificationSecurity:DataClassification:CoverageLow€500
12 · Partial or complete classificationSecurity:DataClassification:CoverageInfo€0
13 · No field encrypted at restSecurity:Encryption:NoneAppliedInfo€0

Maximum exposure reachable through this questionnaire: €223,500, by answering the worst case to each of the thirteen questions. A real scan, for its part, raises one finding per target found — per user, per object, per connected app, per field — where this questionnaire produces at most one per question. The two orders of magnitude have nothing to do with each other, and it is not the job of thirteen answers to bring them closer.

This result is out of date tomorrow

This self-check measures a moment, and it measures it on your word. Its flaw is that of any point-in-time audit: the result is out of date the next day. A permission set assigned, a connected app authorised, an object opened for the length of a data migration — each changes the state without triggering anything.

What protects is not the depth of one pass, it is repetition and comparison with the previous state. That is what the product does, in your org, read-only: it detects and it advises, it never remediates in your place.

Have your org measured See pricing

Your profile was not sent to us

The profile is computed. Now confront it with reality.

The calculation stayed in your browser: we received nothing, and we will receive nothing you have not copied over yourself. Carry the three figures of the summary below — findings kept, critical ones, estimated exposure — and the first scan will measure your answers instead of believing them.

Or by e-mail: contact@orgguardian.com