How exposed is your VBA add-in today?

What this VBA protection assessment measures

Most Excel developers ship VBA add-ins that fall over the first time a determined user types the password into one of the free password-removal tools floating around the internet. The assessment grades your current setup on four axes that matter for real-world theft: how the source is stored, whether attackers can read the macro project, how easy it is to copy the workbook off a licensed device, and whether your distribution can be tied back to a specific buyer if a leak happens.

You answer ten short questions about the add-in you ship today - how the file is packaged, whether you rely on the built-in VBA project password, whether sheets are "Very Hidden", whether any of the business logic has been moved out of VBA, and how you handle activation. The result is a letter grade from A to F plus a list of the specific weak links that pull the grade down, so you know where to focus first.

Why the grade matters for Excel and VBA security

The default protection that ships with Microsoft Excel - the VBA project password, the workbook "Protect Structure" option, and the unofficial "VBA project unviewable" trick - were never designed to stand up to a motivated attacker. Each one can be undone in under sixty seconds with a free utility you can find on the first page of any search engine. If your add-in carries pricing models, proprietary calculations, contract logic, audit trails, or anything you'd rather a competitor not copy, those defences are not enough.

A low grade does not mean your work is bad - it means the layer of armour around your work is thin. Most add-ins start at D or F because the standard Excel toolkit simply doesn't include the building blocks needed to do better. The whole point of running this assessment is to show you exactly which layers are missing so you can decide whether the risk is worth fixing.

What you get at the end of the assessment

• A letter grade - a clear A through F rating of how exposed your add-in is right now.
• Your weakest links - the specific gaps that are pulling your grade down, in plain English.
• Your strongest links - the protections you already have in place, so you know what to keep.
• A recommended Excel Armor tier - either the quick protection path (your VBA stays as VBA, wrapped in real obfuscation) or the maximum-protection path (business logic migrated to a compiled .NET XLL, hardened with an industry-standard .NET obfuscator, code-signing scaffolding, licensing hooks).
• A printable PDF report - share with your team, your client, or your compliance lead.

Frequently asked questions about the assessment

Is this assessment free?

Yes. The assessment runs entirely in your browser, costs nothing, and does not require you to enter an email address to see your grade. If you want a copy of the report by email you can request one at the end - that part is optional.

Do you upload my add-in or analyse the file?

No. You answer questions about how your add-in is built and shipped. Nothing leaves your browser. We never see the workbook, the macros, or your customers.

How long does the assessment take?

About two minutes. There are ten multiple-choice questions, with one or two follow-up prompts depending on how you answer.

I'm not sure which answer applies to my add-in. What should I pick?

Pick the closest match. The grade is meant to be directional - if you're between two options, choose the more pessimistic one. You can re-run the assessment any time.

What happens if I score badly?

Nothing happens automatically. You see the grade, you see the weak links, and you decide whether to act. If you want, you can read about the Excel Armor protection tiers on the homepage, take the free PDF guide, or get in touch.