Skip to main content
Cyber Risk Council
Category: Metrics & Reporting

Secure Score

Also known as: Microsoft Secure Score
Simply put

Secure Score is a numerical measurement that reflects how well an organization's security configurations align with a set of recommended practices, typically within a specific vendor's platform. A higher score generally indicates that more recommended controls have been applied, while a lower score suggests improvement opportunities. It is best understood as a directional indicator rather than a guarantee of security or protection against breaches.

Formal definition

Secure Score is a quantitative posture metric that evaluates the state of an environment against a predefined baseline of recommended security controls and configurations, expressing the result as a numeric value or percentage. Scores are typically derived by weighting completed or applied controls against the total set of available recommendations within the assessed scope, and they may vary by vendor platform and product tier. In a virtual CISO context, Secure Score can support prioritization, trend tracking, and executive reporting, but it should not be treated as equivalent to a comprehensive risk assessment, a compliance certification against frameworks such as ISO 27001 or SOC 2, or evidence of overall program maturity. Its usefulness depends on the accuracy of the underlying configuration data, the relevance of the vendor's recommendations to the organization's actual risk profile, and the caveat that improving a score does not by itself establish organizational accountability for security decisions, which remains with the client's officers.

Why it matters

Secure Score gives security leaders and their executive stakeholders a simple, trackable number that translates a complex configuration state into something a board or leadership team can readily understand. In a virtual CISO engagement, this accessibility is valuable: it supports prioritization of remediation work, allows trend tracking over time, and provides a communication anchor for executive reporting. A score that moves in the right direction can help demonstrate that agreed-upon recommended controls are being applied, which is often useful when justifying investment or reporting progress to non-technical decision-makers.

The metric's value, however, depends heavily on how it is interpreted. Secure Score reflects alignment with a specific vendor's set of recommended practices within a defined scope; it is a directional indicator, not a guarantee of security or protection against breaches. Treating a high score as proof of a secure environment is a common and consequential mistake. A score can rise while material risks outside the vendor's assessed scope remain unaddressed, and the relevance of any recommendation depends on whether it maps to the organization's actual risk profile. It is not equivalent to a comprehensive risk assessment or to certification against frameworks such as ISO 27001 or SOC 2.

Just as importantly, improving a Secure Score does not shift accountability. A virtual CISO can use the metric to advise, prioritize, and direct remediation, but legal and organizational accountability for security decisions remains with the client organization and its officers. The score is a tool to inform those decisions, not a substitute for governance or a mechanism that transfers responsibility to the metric or the advisor.

Who it's relevant to

Virtual and fractional CISOs
For a vCISO or fractional CISO, Secure Score is a practical instrument for prioritizing remediation, tracking progress across an engagement, and communicating posture to leadership in accessible terms. It supports advisory and directional guidance but does not replace a comprehensive risk assessment, and the advisor should frame it as one input among several rather than a definitive measure of security.
Executives and board members
Leadership teams and boards benefit from the score as a digestible, trend-oriented indicator when reviewing security investment and progress. They should understand that a rising score is directional evidence of applied controls, not a guarantee against breaches, and that accountability for security decisions remains with the organization's officers regardless of the number reported.
IT and security operations teams
The teams responsible for applying configurations use Secure Score to identify recommended controls that have not yet been implemented within the vendor's assessed scope. Its accuracy depends on the quality of the underlying configuration data, and teams should evaluate whether each recommendation is relevant to the organization's actual risk before acting on it.
Compliance and governance stakeholders
Those focused on compliance should treat Secure Score as supporting evidence of configuration alignment, not as a compliance certification. It is not equivalent to attestation against frameworks such as ISO 27001 or SOC 2, and improving the score does not by itself establish readiness for or certification against those standards.

Inside Secure Score

Configuration-Based Scoring
A Secure Score is typically a numeric or percentage measure generated by a security platform that evaluates an organization's configuration and control settings against a set of recommended baselines. It reflects the degree to which suggested controls have been enabled within the assessed environment.
Recommended Actions
Most Secure Score implementations include a prioritized list of remediation steps or improvement actions, often weighted by their estimated impact on the score. These recommendations guide administrators toward configuration changes the vendor associates with reduced risk.
Point Weighting and Categories
Scores are frequently broken into categories such as identity, device, data, and application settings, with each action assigned a point value. The weighting reflects the platform vendor's assessment of relative importance, which may vary by provider and product.
Trend and Comparison Data
Many Secure Score dashboards show change over time and, in some cases, comparative benchmarks against peer organizations of similar size or industry. These comparisons are vendor-derived and should be interpreted as directional context rather than definitive standing.
Governance and Reporting Input
In many engagements a virtual CISO uses Secure Score outputs as one input into broader governance, risk reporting, and program planning. The score can support executive communication and prioritization but typically informs rather than defines the overall security strategy.

Common questions

Answers to the questions practitioners most commonly ask about Secure Score.

Does a higher Secure Score mean an organization is secure or protected from breaches?
No. A Secure Score is a relative measurement tool that reflects the adoption of recommended configurations and controls within a specific vendor platform; it does not guarantee security or breach prevention. A high score indicates that certain suggested settings have been enabled, but it cannot account for threats outside the scoring model, gaps in areas the score does not measure, or the effectiveness of controls in practice. Treating the score as proof of protection is a common mistake that a security leader would correct. It is better understood as one directional indicator of configuration posture rather than an assurance of overall security.
Is a Secure Score the same as compliance with a framework or standard like ISO 27001, SOC 2, or HIPAA?
No. A Secure Score reflects configuration and control recommendations within a particular vendor's ecosystem and is not equivalent to compliance with any framework or regulation. Standards such as ISO 27001, SOC 2, or HIPAA involve governance, documented processes, evidence, and often independent assessment that a platform score does not measure. A strong score may support readiness in some technical control areas, but it does not assert or substitute for certification or regulatory compliance. Conflating the two can create a false sense of assurance.
How can a virtual CISO use Secure Score within an engagement?
In many engagements, a virtual CISO may reference a Secure Score as one input into a broader risk and program assessment, using it to identify configuration gaps, prioritize remediation, and track directional improvement over time. Because a vCISO typically provides strategy, governance, and executive-level guidance rather than hands-on tool administration, they would generally advise on which recommendations to act on and how to align them with business risk, while implementation is often carried out by the client's internal team or another provider unless explicitly contracted otherwise.
Should every Secure Score recommendation be implemented to raise the score?
Not necessarily. Recommendations vary in relevance depending on an organization's environment, risk tolerance, and operational needs, and pursuing points without context can introduce friction or unintended consequences. A common approach is to evaluate each recommendation against business impact and risk priority rather than treating the maximum score as the goal. The value of this exercise often depends on organizational maturity, defined scope, and stakeholder input, which is why a governance-oriented review typically precedes changes.
Who is accountable for acting on Secure Score findings?
While a virtual CISO may advise on and prioritize Secure Score findings, legal and organizational accountability for security decisions generally remains with the client organization and its officers. The vCISO directs and recommends, but the decision to accept, remediate, or defer a given item, and the resources allocated to do so, typically rest with the client unless a contract specifies otherwise. Clarifying this accountability boundary early helps set expectations for how findings are handled.
How often should a Secure Score be reviewed during an engagement?
Review cadence may vary by provider and by the scope of the engagement. In many engagements, the score is reviewed periodically as part of ongoing program governance so that changes, newly surfaced recommendations, and remediation progress can be tracked over time. Because scores can shift as platforms update their models or as configurations change, treating it as a point-in-time snapshot is less useful than monitoring its trend. Effective review also depends on client cooperation and access to the relevant platform data.

Common misconceptions

A high Secure Score means the organization is secure or protected from breaches.
A Secure Score typically measures adherence to a vendor's recommended configuration settings within a specific platform. It does not measure actual security posture across the full environment, account for controls outside the platform's visibility, or guarantee prevention of any incident. It is an indicator of configuration hygiene, not an assurance of security outcomes.
Achieving a target Secure Score demonstrates compliance with frameworks such as ISO 27001, SOC 2, or HIPAA.
A Secure Score supports readiness and can inform certain technical control areas, but it does not assert compliance or certification against any regulation or standard. Framework alignment requires broader governance, documentation, and evidence beyond what a single platform score captures, and a virtual CISO engagement does not guarantee certification outcomes.
Improving the Secure Score is the job a virtual CISO performs hands-on.
A virtual CISO generally advises on which improvements to prioritize and how they fit organizational risk strategy, but implementing configuration changes is typically an operational task performed by internal teams or contracted providers. The vCISO directs and interprets rather than administering the tooling, and accountability for decisions remains with the client organization.

Best practices

Treat the Secure Score as one input among many in your risk and governance program rather than a standalone objective, and avoid optimizing the number at the expense of controls the platform does not measure.
Review recommended actions against your organization's actual risk profile and operational context before implementing them, since a vendor's weighting may not match your priorities or environment.
Distinguish clearly between raising the score and improving genuine security posture when reporting to executives, and document which risks fall outside the platform's visibility.
Use trend data over time to track program progress, but interpret peer benchmarks cautiously as directional context rather than a definitive measure of standing.
Assign implementation of configuration changes to the appropriate operational teams while using the virtual CISO role to prioritize, interpret, and align actions with strategy and governance.
Confirm that any framework or compliance conclusions are supported by broader evidence and documentation, and do not rely on the Secure Score alone to assert readiness or certification.