In today’s threat landscape, internet exposure, i.e. devices that allow inbound connectivity from the public internet, continues to be a major vector for initial access and compromise. Devices that are exposed to the public internet can significantly increase an organization’s attack surface, making them prime targets for initial access, exploitation, and lateral movement.
However, not all internet-facing devices represent a security issue. Many are intentionally exposed to support business-critical scenarios such as hosting web applications, enabling remote access, or supporting communication services. The challenge for security teams is not just detecting internet-facing devices, but understanding why a device is exposed, whether that exposure is expected, and what action should be taken. That’s why we’re introducing a new security recommendation in Microsoft Defender that helps organizations identify, review, and reduce unnecessary internet exposure across their environment.
Understand your internet-facing exposure
This recommendation focuses specifically on devices that are accessible from the public internet, meaning they can receive inbound connections initiated from external sources, not devices that only use the internet for outbound communication.
Externally reachable assets are often the first point of entry for attackers, making this a critical signal for security prioritization.
Microsoft Defender identifies internet-facing devices based on signals that indicate external inbound reachability, including:
- External scan telemetry identifying devices reachable from the public internet
- Network telemetry showing inbound connections from external sources
By correlating these signals, Defender surfaces devices that are externally reachable.
Introducing internet-facing exposure assessment
A new recommendation in Microsoft Defender provides a centralized view of devices that are externally reachable from the public internet, helping you understand and manage exposure across your environment.
This assessment categorizes devices based on their exposure state:
- Exposed devices: Devices that are reachable from the public internet and require review
- Compliant devices: Devices that are not externally reachable, or where the internet exposure has been explicitly validated and accepted by the organization’s security team as intended
- Not applicable devices: Devices that do not exhibit inbound internet exposure
From the recommendation view, you can:
- Drill down into exposed devices and understand why they are reachable
- Review context such as exposed services and connectivity
- Explore device-level details to support investigation
- Track exposure posture across your environment over time
Take action on your internet exposure
To access this recommendation in the Defender portal, navigate to Exposure management → Recommendations → Devices → Misconfigurations. Once Defender identifies internet-facing devices, it provides the context needed to review and take action.
Your action plan
1. Assess your exposure
Review the recommendation to understand which devices in your environment are externally reachable from the public internet and why they were classified as internet-facing.
2. Validate whether exposure is required
Determine if the inbound connectivity is expected for each device. Confirm business need and ownership before taking action.
3. Prioritize high-risk assets
Focus on critical servers or sensitive environments that are exposed to the internet, as they present the highest risk for initial access.
4. Reduce unnecessary exposure
Restrict or remove inbound connectivity where it is not required by closing exposed ports, removing public access, or moving services behind controlled access layers.
5. Track and maintain posture over time
Continuously monitor internet-facing devices to ensure unnecessary exposure is reduced and new exposure is validated as environments evolve.
FAQ
1. Which devices are currently supported?
This recommendation applies to supported Windows client and Windows Server devices. Supported versions include Windows 10, version 1607 and earlier; Windows 10, version 1809 and later; and Windows 11.
2. Why might there be differences between this recommendation and the Internet-facing filter in device inventory?
This recommendation reflects devices observed as internet-facing during the recommendation assessment window. Device exposure can change over time, and different Microsoft Defender experiences may refresh at different times.
As a result, temporary differences may occur between this recommendation and the Internet-facing filter in device inventory.
For the most current device-level view, use the Internet-facing filter in device inventory. If a device was recently remediated or its exposure recently changed, allow time for the recommendation status to refresh.
3. Could regular employee laptops or personal devices appear as internet-facing?
This recommendation evaluates supported devices onboarded to Microsoft Defender for Endpoint and focuses specifically on inbound internet reachability.
Typical internet usage, such as web browsing, generates outbound traffic and does not by itself classify a device as internet-facing.
Devices are identified as internet-facing only when they are externally reachable from the public internet.
As a result:
-
- Personal devices that are not onboarded to Microsoft Defender for Endpoint are not included in this assessment.
- Corporate laptops may appear as internet-facing if they are directly reachable from the internet, which may indicate an unintended network exposure or configuration issue.
Learn more
For additional guidance on investigating and managing internet-facing devices, see:
- Learn how Defender identifies and maps externally reachable devices across your environment Discovering internet-facing devices using Microsoft Defender
- Learn how to review and investigate internet-facing device exposure Investigate devices in Microsoft Defender
- Learn more about Microsoft Secure Score for Devices in Microsoft Defender
- To learn more about endpoint protection with Microsoft Defender, check out our website.
- To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.
Microsoft