# Record exposure-score model changes before explaining a trend

> Can a Defender exposure-score change occur without a corresponding change in the environment?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:31:42+00:00
- Modified: 2026-09-17T16:46:30+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Can a Defender exposure-score change occur without a corresponding change in the environment?

## Potentially affected

Use this review when interpreting Defender Vulnerability Management exposure-score trends during Microsoft's scoring-model transition. Record the tenant experience and reporting period alongside the score.

## DSE recommendation

DSE recommends annotating trend reports with known model-transition context and the timing of remediation.

## Article

## Source facts

Microsoft currently describes a rollout in which tenants can use either of two exposure-score models. It warns that scores and recommendation priorities can move because of the model update without necessarily reflecting environmental changes. The score recalculates daily, and Microsoft advises allowing up to 24 hours for remediation to appear. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-exposure-score).

## Applicability

Use this review when interpreting Defender Vulnerability Management exposure-score trends during Microsoft’s scoring-model transition. Record the tenant experience and reporting period alongside the score.

## DSE recommendation

DSE recommends annotating trend reports with known model-transition context and the timing of remediation. Explain a score movement only after reviewing the underlying vulnerabilities, asset population and relevant changes. Keep evidence of completed remediation separate from the aggregate score so a reporting change does not become the sole basis for a success or failure claim.

## Verification

Compare the score observation time with the remediation record and the documented recalculation window. Sample the affected assets and vulnerabilities to verify the operational outcome. If the model changed during the reporting period, label that comparability limit and review recommendation priorities before reusing an earlier work queue.

## Official references

[Microsoft Learn: Exposure score in Defender Vulnerability Management](https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-exposure-score). Source reviewed September 17, 2026.

## Primary reference

- Name: Exposure score in Defender Vulnerability Management - Microsoft Defender Vulnerability Management | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-exposure-score
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Record exposure-score model changes before explaining a trend,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-198-record-exposure-score-model-changes-before-explaining-a-trend/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.