---
schema_version: "1"
id: fbfc8ecefe09acde3d43d11085f892f97040bf1c471696be0a84af44df7ae604
title: Refined Signal Criteria, New MFA Coverage, and Severity Updates
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_security_health_review_refined_signal_criteria.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_security_health_review_refined_signal_criteria.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: ee65136a0abb91b5a4aff0449cc7b636f689289dd8bb34605640cf9a47447036
description: Signal criteria, definitions, and risk classifications are refined to better reflect current security best practices and emerging threats.
products:
  - Cross Cloud
release: "262"
---
# Refined Signal Criteria, New MFA Coverage, and Severity Updates

Signal criteria, definitions, and risk classifications are refined to better reflect current security best practices and emerging threats.

**Where:** This change applies to Lightning Experience in Enterprise and Unlimited editions. Available exclusively to Signature Success customers. The Health Assessments Agent requires the Foundations add-on. To inquire about access, contact your Salesforce account executive.

**Who:** Users with the System Administrator profile can generate reports.

**Why:** These refinements help you prioritize remediation efforts and maintain a stronger security posture aligned with Salesforce security enforcements.

## New Controls Added

MFA and Phishing Resistant MFA enforcement signals help you evaluate your org's compliance with multi-factor authentication requirements and identify areas where phishing-resistant authentication methods can strengthen security.

## Severity and Classification Changes

Several signals receive updated severity levels to better reflect their security impact:

- Missing DKIM email authentication signal upgraded from High to Critical, emphasizing the importance of email authentication in preventing spoofing and phishing attacks.
- Wildcard URL in allow list findings reclassified from Critical to Medium, differentiating the risk level compared to lack of HTTPS.
- Profiles with zero active users now receive lower severity for missing IP restrictions, focusing remediation efforts on profiles that actively affect user access.

## Signals Temporarily Removed

Third-party app signals related to secrets requirement in flows are temporarily removed pending redesign. These signals return in a future release with improved detection and guidance.

## Reporting Improvements

All reports generated after this release use a static identifier, making it easier to track and compare reports over time.

## Bug Fixes and Corrections

Several reporting issues are resolved:

- Incorrect guest user visibility findings no longer appear in reports.
- Standard Report Visibility finding now correctly reflects the security posture when visibility is disabled.
- Trusted IP range at the network finding is updated with the corrected title **Absence of restricted Network Access**.