a. Is the product installed "secure by default"?
b. Is the product installed so that critical executables, libraries, configuration files, registry keys, etc.
cannot be modified by untrusted parties?
c. Does the software run with limited privileges? If not, how is privilege separation performed?