{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend/", "slug": "dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend", "url": "https://update.dsesecurity.com/updates/dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend/" }, "title": "Record exposure-score model changes before explaining a trend", "summary": "Can a Defender exposure-score change occur without a corresponding change in the environment?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:31:42+00:00", "modified_at": "2026-09-17T16:46:30+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 196, "potentially_affected": "Use this review when interpreting Defender Vulnerability Management exposure-score trends during Microsoft's scoring-model transition. Record the tenant experience and reporting period alongside the score.", "dse_recommendation": "DSE recommends annotating trend reports with known model-transition context and the timing of remediation.", "primary_source": { "name": "Exposure score in Defender Vulnerability Management - Microsoft Defender Vulnerability Management | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-exposure-score", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft currently describes a rollout in which tenants can use either of two exposure-score models. It warns that scores and recommendation priorities can move because of the model update without necessarily reflecting environmental changes. The score recalculates daily, and Microsoft advises allowing up to 24 hours for remediation to appear. Microsoft Learn.

\n

Applicability

\n

Use this review when interpreting Defender Vulnerability Management exposure-score trends during Microsoft’s scoring-model transition. Record the tenant experience and reporting period alongside the score.

\n

DSE recommendation

\n

DSE recommends annotating trend reports with known model-transition context and the timing of remediation. Explain a score movement only after reviewing the underlying vulnerabilities, asset population and relevant changes. Keep evidence of completed remediation separate from the aggregate score so a reporting change does not become the sole basis for a success or failure claim.

\n

Verification

\n

Compare the score observation time with the remediation record and the documented recalculation window. Sample the affected assets and vulnerabilities to verify the operational outcome. If the model changed during the reporting period, label that comparability limit and review recommendation priorities before reusing an earlier work queue.

\n

Official references

\n

Microsoft Learn: Exposure score in Defender Vulnerability Management. Source reviewed September 17, 2026.

", "content_text": "Source facts\nMicrosoft currently describes a rollout in which tenants can use either of two exposure-score models. It warns that scores and recommendation priorities can move because of the model update without necessarily reflecting environmental changes. The score recalculates daily, and Microsoft advises allowing up to 24 hours for remediation to appear. Microsoft Learn.\nApplicability\nUse this review when interpreting Defender Vulnerability Management exposure-score trends during Microsoft’s scoring-model transition. Record the tenant experience and reporting period alongside the score.\nDSE recommendation\nDSE recommends annotating trend reports with known model-transition context and the timing of remediation. Explain a score movement only after reviewing the underlying vulnerabilities, asset population and relevant changes. Keep evidence of completed remediation separate from the aggregate score so a reporting change does not become the sole basis for a success or failure claim.\nVerification\nCompare the score observation time with the remediation record and the documented recalculation window. Sample the affected assets and vulnerabilities to verify the operational outcome. If the model changed during the reporting period, label that comparability limit and review recommendation priorities before reusing an earlier work queue.\nOfficial references\nMicrosoft Learn: Exposure score in Defender Vulnerability Management. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nMicrosoft currently describes a rollout in which tenants can use either of two exposure-score models. It warns that scores and recommendation priorities can move because of the model update without necessarily reflecting environmental changes. The score recalculates daily, and Microsoft advises allowing up to 24 hours for remediation to appear. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-exposure-score).\n\n## Applicability\n\nUse this review when interpreting Defender Vulnerability Management exposure-score trends during Microsoft’s scoring-model transition. Record the tenant experience and reporting period alongside the score.\n\n## DSE recommendation\n\nDSE recommends annotating trend reports with known model-transition context and the timing of remediation. Explain a score movement only after reviewing the underlying vulnerabilities, asset population and relevant changes. Keep evidence of completed remediation separate from the aggregate score so a reporting change does not become the sole basis for a success or failure claim.\n\n## Verification\n\nCompare the score observation time with the remediation record and the documented recalculation window. Sample the affected assets and vulnerabilities to verify the operational outcome. If the model changed during the reporting period, label that comparability limit and review recommendation priorities before reusing an earlier work queue.\n\n## Official references\n\n[Microsoft Learn: Exposure score in Defender Vulnerability Management](https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-exposure-score). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend/", "url": "https://update.dsesecurity.com/updates/dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Record exposure-score model changes before explaining a trend", "item": "https://update.dsesecurity.com/updates/dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend/", "url": "https://update.dsesecurity.com/updates/dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend/", "headline": "Record exposure-score model changes before explaining a trend", "description": "Can a Defender exposure-score change occur without a corresponding change in the environment?", "abstract": "Can a Defender exposure-score change occur without a corresponding change in the environment?", "articleBody": "Source facts\nMicrosoft currently describes a rollout in which tenants can use either of two exposure-score models. It warns that scores and recommendation priorities can move because of the model update without necessarily reflecting environmental changes. The score recalculates daily, and Microsoft advises allowing up to 24 hours for remediation to appear. Microsoft Learn.\nApplicability\nUse this review when interpreting Defender Vulnerability Management exposure-score trends during Microsoft’s scoring-model transition. Record the tenant experience and reporting period alongside the score.\nDSE recommendation\nDSE recommends annotating trend reports with known model-transition context and the timing of remediation. Explain a score movement only after reviewing the underlying vulnerabilities, asset population and relevant changes. Keep evidence of completed remediation separate from the aggregate score so a reporting change does not become the sole basis for a success or failure claim.\nVerification\nCompare the score observation time with the remediation record and the documented recalculation window. Sample the affected assets and vulnerabilities to verify the operational outcome. If the model changed during the reporting period, label that comparability limit and review recommendation priorities before reusing an earlier work queue.\nOfficial references\nMicrosoft Learn: Exposure score in Defender Vulnerability Management. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:31:42+00:00", "dateModified": "2026-09-17T16:46:30+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Record exposure-score model changes before explaining a trend" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 196, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Exposure score in Defender Vulnerability Management - Microsoft Defender Vulnerability Management | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-exposure-score" } } ] } }