We are introducing an updated exposure score model in Microsoft Defender Vulnerability Management, now available in public preview.
Security teams use the exposure score to understand vulnerability posture, prioritize remediation, and explain progress to leadership. The updated model helps make that score more useful by bringing in additional vulnerability risk signals and asset context, so teams can better understand where risk is concentrated and which remediation actions are likely to have the greatest impact.
Why we updated the exposure score
Customers told us they needed the exposure score to better reflect real-world vulnerability risk and to make remediation progress easier to explain.
In the previous model, some remediation actions did not always result in visible score movement. Prioritization also relied heavily on severity, even though severity alone does not always tell the full story. A vulnerability with a high CVSS score may not always represent the same level of practical risk as one that is more likely to be exploited or that affects a more exposed or business-critical asset.
We also heard that asset-level scoring could be difficult to interpret. In some cases, the score for a device was influenced too heavily by the most severe CVE, while other vulnerabilities on the same device had limited impact, even when they represented meaningful accumulated risk.
The updated model addresses these customer pain points by combining vulnerability risk, exploitability signals, and asset context into a more representative exposure score. The goal is to help security teams move from a score that explains “how severe are the vulnerabilities?” to a score that better helps answer “where should we focus remediation first, and why?”
What changed
CVE risk scoring now uses additional risk signals
The updated model uses a multi-factor CVE risk score instead of relying primarily on CVSS severity.
This includes EPSSas one of the signals used to estimate exploitation likelihood. The model also uses normalized CVE data across vulnerability sources to improve consistency in how vulnerabilities are scored.
As a result, the score can better represent which vulnerabilities are more likely to be exploited, rather than only how severe they appear theoretically.
Asset scoring now considers all vulnerabilities on a device
The asset exposure score now considers all vulnerabilities affecting a device, weighted by vulnerability risk and asset context, rather than relying primarily on the most severe CVE.
This gives security teams a more complete view of device exposure. It also means remediation work across a device can contribute more visibly to reducing exposure, instead of only changes to the single highest-severity vulnerability driving the score.
Asset context is included
The updated model incorporates important asset context, such as whether a device is internet-facing and, where configured, the device criticality level.
This helps prioritize vulnerabilities on assets that may carry higher business or exposure risk. For example, the same vulnerability may require different levels of urgency depending on whether it affects an exposed or business-critical device.
Organization score is based on asset scores
The organization-level exposure score is calculated from individual asset scores, giving you a more representative view of vulnerability exposure across your environment.
This helps connect organization-level posture to the actual assets and vulnerabilities that contribute to risk.
Recommendation impact is more closely aligned with score movement
Recommendation impact is now calculated using asset-CVE level data. This improves the relationship between the predicted impact shown on a recommendation and the score movement you should expect after remediation is completed and reflected in the product.
When remediation is reflected in Defender Vulnerability Management, the updated model is designed to make the expected score impact more visible and more closely aligned with observed score movement.
Why this matters
The updated exposure score is not just a new calculation. It is a more accurate reflection of real-world vulnerability risk.
By combining vulnerability risk signals, exploitability likelihood, and asset context, the updated model gives security teams a clearer path from insight to action. It helps teams prioritize remediation based on the risk that matters most, explain why priorities changed, and show remediation progress more clearly over time.
What to expect during the transition
When the updated model is enabled for your organization:
- Your score may change. The score may go up or down because the calculation model changed. This does not necessarily mean your security posture changed or that new vulnerabilities were introduced.
- Treat the updated score as a new baseline. Because the model changed, direct comparison with the previous score should be done carefully.
- Recommendation priorities may shift. Recommendations may appear in a different order because impact values are calculated using the updated model.
- Score updates are calculated daily. After remediation actions are completed and reflected in Defender Vulnerability Management, allow up to 24 hours for score changes to appear.
- Score levels remain unchanged. The score bands remain 0-29 for low, 30-69 for medium, and 70-100 for high.
During public preview, we recommend reviewing the updated score as a new baseline and validating recommendation priorities with your existing remediation workflows.
Common questions
Why did my score increase after the update?
Your score may increase because the updated model uses additional risk signals and asset context. A higher score after enablement does not necessarily mean new vulnerabilities were introduced or that your environment became less secure. We recommend treating the updated score as a new baseline.
Did my security posture change if my score changed?
Not necessarily. Your score may change because the scoring model changed, not because your environment changed.
Should I compare the updated score to my previous score?
Use the updated score as a new baseline. The new model uses additional signals and a different calculation approach, so direct comparison may not be meaningful.
Why did recommendation priority change?
Recommendation impact is now calculated using updated asset and CVE risk signals, so some recommendations may move up or down in priority.
Do I need to take immediate action if my score changed?
A score change after enablement does not necessarily require immediate action. Review your updated recommendations, validate priority changes against your remediation process, and use the updated score as your new baseline.
How to get started
The updated exposure score is available in public preview. To view it:
- Go to the Microsoft Defender portal.
- Navigate to Exposure management > Vulnerability management > Overview.
- Review the exposure score card.
- Select Improve score to view security recommendations prioritized by updated impact values.
For more information, see the updated documentation:
- Exposure score in Defender Vulnerability Management: https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-exposure-score
- Security recommendations: https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-security-recommendation
Share feedback
We want your feedback during public preview. Use the feedback button in the Microsoft Defender portal or contact your Microsoft account team.
Microsoft
