This guide explains Microsoft Defender exposure levels, what drives them and how to reduce them.
Microsoft Defender gives each of your devices an exposure level: low, medium or high. It is a quick way to see which machines are most at risk and where to focus your effort. This guide explains what the levels mean, what drives them and how to reduce them.
How Defender calculates exposure
Exposure reflects how vulnerable a device is to attack. Microsoft Defender Vulnerability Management looks at known software vulnerabilities, missing security updates, insecure configurations and the severity and exploitability of each weakness. These combine into an exposure score for the device, which is then shown as low, medium or high.
The three exposure levels
High exposure
A high exposure device has serious weaknesses that attackers could exploit. Common causes include missing critical operating system or application updates, unsupported software, software with known actively exploited vulnerabilities, and weak security settings. These devices should be fixed first.
Medium exposure
A medium exposure device has some weaknesses but fewer or less severe ones. Typical causes are a few missing updates, older but still supported software and settings that are not fully hardened. Medium is a signal to tidy up before issues build.
Low exposure
A low exposure device is well maintained, with current updates, supported software and sound configuration. Low does not mean zero risk, but it means the obvious doors are closed.
Where to see exposure in Microsoft 365
In the Microsoft Defender portal, open the device inventory to see the exposure level for every onboarded device. You can sort and filter by exposure, open a device to see the specific vulnerabilities and security recommendations, and view trends across the organisation over time.
Reducing exposure
- Patch quickly. Apply operating system and application updates, starting with critical ones.
- Remove or replace unsupported software. Anything that no longer receives updates is a standing risk.
- Follow security recommendations. Defender lists prioritised actions with the biggest impact first.
- Harden settings. Turn on features such as disk encryption, firewall and attack surface reduction rules.
- Onboard every device. Machines that are not reporting are blind spots.
- Track progress. Review exposure each month and as part of your regular IT review.
Why it matters
Most breaches exploit known weaknesses that already have a fix. Exposure levels turn a long list of technical issues into a simple priority list, so you spend time on the devices that matter most.
Key takeaways
- Exposure reflects how vulnerable a device is to attack, based on software vulnerabilities, missing updates, insecure configuration and the severity of each weakness.
- High exposure devices should be fixed first. Low does not mean zero risk, but it means the obvious doors are closed.
- Patch quickly, remove unsupported software, follow Defender recommendations and onboard every device.
Microsoft Defender exposure levels: frequently asked questions
What do low, medium and high exposure mean in Microsoft Defender?
High means serious weaknesses that attackers could exploit, and those devices should be fixed first. Medium means some weaknesses, fewer or less severe, and is a signal to tidy up. Low means a well-maintained device with current updates, supported software and sound configuration.
How does Defender calculate exposure?
Microsoft Defender Vulnerability Management looks at known software vulnerabilities, missing security updates, insecure configurations and the severity and exploitability of each weakness, and combines them into an exposure score shown as low, medium or high.
Where can I see exposure levels?
In the Microsoft Defender portal, open the device inventory to see the exposure level for every onboarded device. You can sort and filter by exposure, open a device to see its vulnerabilities and recommendations, and view trends over time.
Related reading: Microsoft Defender consulting.
Total Solutions IT monitors and reduces exposure for our managed customers. Call 02 6061 4222 to find out how we can help.
