Signal criteria, definitions, and risk classifications are refined to better reflect current security best practices and emerging threats.
Where: This change applies to Lightning Experience in Enterprise and Unlimited editions. Available exclusively to Signature Success customers. The Health Assessments Agent requires the Foundations add-on. To inquire about access, contact your Salesforce account executive.
Who: Users with the System Administrator profile can generate reports.
Why: These refinements help you prioritize remediation efforts and maintain a stronger security posture aligned with Salesforce security enforcements.
New Controls Added
MFA and Phishing Resistant MFA enforcement signals help you evaluate your org's compliance with multi-factor authentication requirements and identify areas where phishing-resistant authentication methods can strengthen security.
Severity and Classification Changes
Several signals receive updated severity levels to better reflect their security impact:
- Missing DKIM email authentication signal upgraded from High to Critical, emphasizing the importance of email authentication in preventing spoofing and phishing attacks.
- Wildcard URL in allow list findings reclassified from Critical to Medium, differentiating the risk level compared to lack of HTTPS.
- Profiles with zero active users now receive lower severity for missing IP restrictions, focusing remediation efforts on profiles that actively affect user access.
Signals Temporarily Removed
Third-party app signals related to secrets requirement in flows are temporarily removed pending redesign. These signals return in a future release with improved detection and guidance.
Reporting Improvements
All reports generated after this release use a static identifier, making it easier to track and compare reports over time.
Bug Fixes and Corrections
Several reporting issues are resolved:
- Incorrect guest user visibility findings no longer appear in reports.
- Standard Report Visibility finding now correctly reflects the security posture when visibility is disabled.
- Trusted IP range at the network finding is updated with the corrected title Absence of restricted Network Access.