Microsoft Security Exposure Management
Vulnerabilities and exposureReview Security Initiatives in Microsoft Security Exposure Management
In brief
The article now uses updated Microsoft Security Exposure Management terminology, adds prerequisite guidance and a direct link to the initiatives page, and refreshes navigation steps, headings, anchors, and descriptions of favorites and initiative trends.
What Defender admins need to know
Administrators can use the revised steps and terminology when reviewing security initiatives; no required configuration change is stated.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Review security initiatives
Microsoft Security Exposure Management offers a focused, metric-driven way of tracking exposure in specific security areas using security initiatives. This article describes how to view initiatives and their scores, set target scores, check score trends and history, and review associated metrics and recommendations. Before you start, review the prerequisites for security initiatives.
Work with security initiatives
Microsoft Security Exposure Management offers a focused, metric-driven way of tracking exposure in specific security areas using security initiatives. This article describes how to view initiatives and their scores, set target scores, check score trends and history, and review associated metrics and recommendations. Before you start, make sure you understand security initiatives and review the prerequisites.prerequisites and permissions needed for working with Security Exposure Management.
Prerequisites
Before working with security initiatives, review the following prerequisites and notes:
- Learn about security initiatives in Exposure insights before you start.
- Review prerequisites and permissions needed for working with Security Exposure Management.
- Initiatives that are in preview are marked accordingly. These preview initiatives are still in development, and are subject to change.
- Note that with the integration of Defender for Cloud in the Defender portal, some legacy elements have been updated - for example, threat-based initiatives from the initiative catalog might have been temporarily removed and could return in future releases.
View the security initiatives page
The initiativesExposure insights initiatives page provides detailed insights into your security initiatives and their progress.
Navigate to the Microsoft Defender portal.
From the Exposure management section on the navigation bar, select Exposure insights -> Initiatives to open the Exposure insights initiatives page.
:::image type="content" source="./media/initiatives/initiatives-window.png" alt-text="Screenshot of the Security Exposure Management Initiatives window.":::
Use the Filter by device groups positioned at the top right corner to refine the filter.
:: :::image type="content" source="media/initiatives/filter-by-dg.png" alt-text="Screenshot of device group filter":::
Choose the device groups relevant for you, and the initiatives data are recalculated (only when related to Endpoints data).
:: :::image type="content" source="media/initiatives/filter-by-dg-pane.png" alt-text="Screenshot of the filter by device groups side pane.":::
At the top ofReview the initiativespage, reviewlisted on thehighlighted key initiativespage by scrolling and drilling down per your needs.To
setmark an initiativeto appear in the top initiative bar in the dashboard oras a favorite on the initiatives page, select the star icon in the initiatives window or Mark as favorite in the individual initiative.You can review the following information for all initiatives:
- 14 day change trend graph highlighting how the initiative score changes over the past 14 days
- Initiative name
- Favorite indicator (toggle on/off)
to display in the key initiatives banner - Current score of the initiative
- Programs or workloads contributing to or required by this initiative
Select an initiative to open the small overview and then select Open initiative page to review or remediate issues. The initiative page includes additional information including:
- Your target score for the initiative
- A means to set a custom target score appropriate to your organization's needs
- Description
- A metric trends graph and drift change, if applicable.
- History of score changes
- Related threats
:::image type="content" source="./media/initiatives/initiatives-ransomware.png" alt-text="Screenshot of the ransomware initiative.":::
Set a target score for a security initiative
To set a custom target score for an initiative, follow these steps:
:::image type="content" source="./media/initiatives/set-initiative-target-score.png" alt-text="Screenshot of the window to set the initiative target.":::
CheckReview security initiative score trends
The changes in your score provide you with useful feedback about how well you're meeting the goals of your initiatives.
- From the
individualinitiativedetails page,page for a specific initiative, check the overall 14 day change trend graph and 14 day drift change to track the changes in your initiative score, visually and as a percentage. - For initiatives with metrics, you can examine the trend and drift data per metric as well.
CheckReview security initiative history
Use the History view to examine how an initiative score changed over time:
Select an initiative to open the small overview and then select Open initiative page-> History to view changes over time.
Browse to the time table to choose a specific time point to examine.
- If needed, filter for specific time points. Use the following views to review initiative metrics and related recommendations:
To review metrics associated with your initiative, select Exposure insights -> Initiatives-> Security metrics.
Sort by heading, as needed.
Select Exposure insights
->Initiatives-Initiatives > Security recommendations to view recommendations related to your initiative.You only see those recommendations that are currently applied to assets and active in Microsoft Secure Score or Microsoft Defender for Cloud.
:::image type="content" source="media/initiatives/initiatives-security-recommendations.png" alt-text="Screenshot of the initiative's security recommendation tab.":::
Next stepsReview security events
Security events track initiative and metric score drops to help you understand how they affect your organization's security posture.
- In the Microsoft Defender portal, select Exposure management > Exposure insights > Events to open the Events page.
- Select the time range you need in the calendar drop-down.
- To filter by initiative score drop events or metric score drop events, select Filter or the score drop event quantity.
- Select a specific event to open it in Initiatives or Metrics.
Related content
@@ -1,59 +1,66 @@ ----title: Review security initiatives in Security Exposure Management+title: Review Security Initiatives in Microsoft Security Exposure Management description: Learn how to effectively manage and track security initiatives using Microsoft Security Exposure Management to improve your organization's security posture. ai-usage: ai-assisted #customer intent: As a security administrator, I want to understand and manage security initiatives so that I can improve my organization's security posture. ms.topic: how-to-ms.date: 06/15/2026-ms.custom: sfi-image-nochange, msecd-doc-authoring-1014+ms.author: dlanger+author: dlanger+ms.date: 07/30/2025+ms.custom: sfi-image-nochange --- # Review security initiatives +[Microsoft Security Exposure Management](microsoft-security-exposure-management.md) offers a focused, metric-driven way of tracking exposure in specific security areas using security initiatives. This article describes how to view initiatives and their scores, set target scores, check score trends and history, and review associated metrics and recommendations. Before you start, review the [prerequisites for security initiatives](#prerequisites).+ ## Work with security initiatives -[Microsoft Security Exposure Management](microsoft-security-exposure-management.md) offers a focused, metric-driven way of tracking exposure in specific security areas using security initiatives. This article describes how to view initiatives and their scores, set target scores, check score trends and history, and review associated metrics and recommendations. Before you start, review the [prerequisites](#prerequisites).+[Microsoft Security Exposure Management](microsoft-security-exposure-management.md) offers a focused, metric-driven way of tracking exposure in specific security areas using security initiatives. This article describes how to view initiatives and their scores, set target scores, check score trends and history, and review associated metrics and recommendations. Before you start, make sure you understand [security initiatives](exposure-insights-overview.md#security-initiatives) and review the [prerequisites and permissions needed](prerequisites.md) for working with Security Exposure Management. ## Prerequisites -- Learn about [initiatives](exposure-insights-overview.md#security-initiatives) before you start.+Before working with security initiatives, review the following prerequisites and notes:++- Learn about [security initiatives in Exposure insights](exposure-insights-overview.md#security-initiatives) before you start. - [Review prerequisites and permissions needed](prerequisites.md) for working with Security Exposure Management. - Initiatives that are in preview are marked accordingly. These preview initiatives are still in development, and are subject to change. - Note that with the integration of Defender for Cloud in the Defender portal, some legacy elements have been updated - for example, threat-based initiatives from the initiative catalog might have been temporarily removed and could return in future releases. -## View initiatives page+<a name="view-initiatives-page"></a>+## View the security initiatives page -The initiatives page provides detailed insights into your security initiatives and their progress.+The [Exposure insights initiatives](https://security.microsoft.com/exposure-initiatives) page provides detailed insights into your security initiatives and their progress. > [!NOTE] > All information shown on the Initiative pages that is related to Endpoints data is based on the user's scope. This includes, initiative scores, metrics progress, and history reasoning. 1. Navigate to the [Microsoft Defender portal](https://security.microsoft.com/). -2. From the Exposure management section on the navigation bar, select **Exposure insights -> Initiatives** to open the [Exposure insights initiatives](https://security.microsoft.com/exposure-initiatives) page.+1. From the Exposure management section on the navigation bar, select **Exposure insights -> Initiatives** to open the [Exposure insights initiatives](https://security.microsoft.com/exposure-initiatives) page. :::image type="content" source="./media/initiatives/initiatives-window.png" alt-text="Screenshot of the Security Exposure Management Initiatives window."::: -3. Use the **Filter by device groups** positioned at the top right corner to refine the filter.+1. Use the **Filter by device groups** positioned at the top right corner to refine the filter. -:::image type="content" source="media/initiatives/filter-by-dg.png" alt-text="Screenshot of device group filter":::+ :::image type="content" source="media/initiatives/filter-by-dg.png" alt-text="Screenshot of device group filter"::: -4. Choose the device groups relevant for you, and the initiatives data are recalculated (only when related to Endpoints data).+1. Choose the device groups relevant for you, and the initiatives data are recalculated (only when related to Endpoints data). -:::image type="content" source="media/initiatives/filter-by-dg-pane.png" alt-text="Screenshot of the filter by device groups side pane.":::+ :::image type="content" source="media/initiatives/filter-by-dg-pane.png" alt-text="Screenshot of the filter by device groups side pane."::: -5. At the top of the initiatives page, review the highlighted key initiatives by scrolling and drilling down per your needs.+1. Review the initiatives listed on the page by scrolling and drilling down per your needs. -6. To set an initiative to appear in the top initiative bar in the dashboard or on the initiatives page, select the **star** icon in the initiatives window or **Mark as favorite** in the individual initiative.+1. To mark an initiative as a favorite on the initiatives page, select the **star** icon in the initiatives window or **Mark as favorite** in the individual initiative. -7. You can review the following information for all initiatives:+1. You can review the following information for all initiatives: - **14 day change trend graph** highlighting how the initiative score changes over the past 14 days - **Initiative name**- - **Favorite** indicator (toggle on/off) to display in the key initiatives banner+ - **Favorite** indicator (toggle on/off) - **Current score** of the initiative - **Programs** or workloads contributing to or required by this initiative -8. Select an initiative to open the small overview and then select **Open initiative page** to review or remediate issues. The initiative page includes additional information including:+1. Select an initiative to open the small overview and then select **Open initiative page** to review or remediate issues. The initiative page includes additional information including: - Your target score for the initiative - A means to set a custom target score appropriate to your organization's needs - Description@@ -62,9 +69,11 @@ The initiatives page provides detailed insights into your security initiatives a - A metric trends graph and drift change, if applicable. - History of score changes - Related threats-:::image type="content" source="./media/initiatives/initiatives-ransomware.png" alt-text="Screenshot of the ransomware initiative."::: -## Set target score+ :::image type="content" source="./media/initiatives/initiatives-ransomware.png" alt-text="Screenshot of the ransomware initiative.":::++<a name="set-target-score"></a>+## Set a target score for a security initiative To set a custom target score for an initiative, follow these steps: @@ -76,18 +85,20 @@ To set a custom target score for an initiative, follow these steps: :::image type="content" source="./media/initiatives/set-initiative-target-score.png" alt-text="Screenshot of the window to set the initiative target."::: -## Check trends+<a name="check-trends"></a>+## Review security initiative score trends The changes in your score provide you with useful feedback about how well you're meeting the goals of your initiatives. -1. From the individual initiative details page, check the overall **14 day change trend graph** and **14 day drift change** to track the changes in your initiative score, visually and as a percentage.+1. From the initiative page for a specific initiative, check the overall **14 day change trend graph** and **14 day drift change** to track the changes in your initiative score, visually and as a percentage. 1. For initiatives with metrics, you can examine the trend and drift data per metric as well. -## Check history+<a name="check-history"></a>+## Review security initiative history Use the History view to examine how an initiative score changed over time: -1. Select an initiative to open the small overview and then select **Open initiative page-> History** to view changes over time. +1. Select an initiative to open the small overview and then select **Open initiative page-> History** to view changes over time. 1. Browse to the time table to choose a specific time point to examine. 1. If needed, filter for specific time points.@@ -102,9 +113,10 @@ Use the History view to examine how an initiative score changed over time: Use the following views to review initiative metrics and related recommendations: 1. To review metrics associated with your initiative, select **Exposure insights -> Initiatives-> Security metrics**.+ 1. Sort by heading, as needed. -1. Select **Exposure insights -> Initiatives-> Security recommendations** to view recommendations related to your initiative.+1. Select **Exposure insights > Initiatives > Security recommendations** to view recommendations related to your initiative. You only see those recommendations that are *currently* applied to assets and active in Microsoft Secure Score or Microsoft Defender for Cloud. @@ -114,9 +126,17 @@ Use the following views to review initiative metrics and related recommendations :::image type="content" source="media/initiatives/initiatives-security-recommendations.png" alt-text="Screenshot of the initiative's security recommendation tab."::: -## Next steps+## Review security events++Security events track initiative and metric score drops to help you understand how they affect your organization's security posture.++1. In the [Microsoft Defender portal](https://security.microsoft.com), select **Exposure management** > **Exposure insights** > **Events** to open the [Events](https://security.microsoft.com/exposure-events) page.+1. Select the time range you need in the calendar drop-down.+1. To filter by initiative score drop events or metric score drop events, select **Filter** or the score drop event quantity.+1. Select a specific event to open it in **Initiatives** or **Metrics**.++## Related content -- [Improve security insights with exposure insights overview](exposure-insights-overview.md)+- [Exposure insights overview](exposure-insights-overview.md) - [Review security metrics](security-metrics.md)-- [Explore security events](security-events.md) - [Review security recommendations](security-recommendations.md)