Record exposure-score model changes before explaining a trend

Source facts

Microsoft currently describes a rollout in which tenants can use either of two exposure-score models. It warns that scores and recommendation priorities can move because of the model update without necessarily reflecting environmental changes. The score recalculates daily, and Microsoft advises allowing up to 24 hours for remediation to appear. Microsoft Learn.

Applicability

Use this review when interpreting Defender Vulnerability Management exposure-score trends during Microsoft’s scoring-model transition. Record the tenant experience and reporting period alongside the score.

DSE recommendation

DSE recommends annotating trend reports with known model-transition context and the timing of remediation. Explain a score movement only after reviewing the underlying vulnerabilities, asset population and relevant changes. Keep evidence of completed remediation separate from the aggregate score so a reporting change does not become the sole basis for a success or failure claim.

Verification

Compare the score observation time with the remediation record and the documented recalculation window. Sample the affected assets and vulnerabilities to verify the operational outcome. If the model changed during the reporting period, label that comparability limit and review recommendation priorities before reusing an earlier work queue.

Official references

Microsoft Learn: Exposure score in Defender Vulnerability Management. Source reviewed September 17, 2026.