---
title: Security score
description: One number for your organization's security posture - Microsoft Secure Score side by side with what 1Security actually observes in your tenant, with the shortest path to improving both.
icon: Gauge
---

# Security score

The Security score screen answers the question every board asks and every
admin dreads: **"How secure are we - in one number, and compared to whom?"**
It shows three figures side by side: Microsoft Secure Score exactly as the
Defender portal reports it, the 1Security score measured from what actually
happens in your tenant, and a combined headline.

## What You Can Achieve

<Cards>
  <Card
    title="See both halves of the truth"
    description="Microsoft scores what you configured. 1Security scores what is actually happening - sensitive data actually reachable, agents actually ungoverned, accounts actually dormant. The gap between the two is where incidents live."
  />
  <Card
    title="Make 5 minutes count"
    description="Every control shows the points still on the table. The 'If you only have 5 minutes' shortlist ranks them, so even the shortest security session starts with the highest-value fix."
  />
  <Card
    title="Compare against organizations like yours"
    description="Microsoft's comparative averages - all tenants, your size band, your industry - come with the score. You see at a glance whether you are ahead of or behind your peers."
  />
  <Card
    title="Prove the trend"
    description="Ninety days of daily history for both halves, plus the count of remediation actions applied - the improvement and the work behind it, on one card."
  />
</Cards>

## Two providers, one worklist

Every control - Microsoft's and 1Security's - lands in one list, sorted by
the points you can still gain. Microsoft controls carry Microsoft's own
remediation text, tier, rank, threat tags and a deep link into the Defender
portal. 1Security controls carry the measured evidence behind the verdict
("14 of 92 agents have no accountable owner") and a link to the exact screen
in 1Security where the finding is acted on.

Where both providers measure the same fact - device compliance, dormant
accounts, label protection - they are deliberately kept as two controls. A
policy that is configured but not covering real sign-ins is precisely the
insight a single merged number would hide.

## Categories Microsoft doesn't have

The 1Security half adds the categories Secure Score has no coverage for at
all: **AI & agents** (accountable owners, captured instructions, reach into
restricted data), **observed data exposure** (restricted types actually
reachable, outbound sharing going to free consumer mailboxes) and
**monitoring & response** (ingestion freshness, unhandled critical anomalies,
untriaged Defender alerts).

## Waiving a control

A control that genuinely does not apply - a device control in a
cloud-only organization, say - can be waived with a note. Waived controls
leave the possible total entirely, the same semantics Microsoft uses for
"ignored" controls, and the note stays on record. The measured score itself
is never editable: only its standing is.

## Framework impact

1Security controls cite the compliance articles their measurement satisfies -
fix a control and the screen shows which ISO 27001, NIS2 or EU AI Act
articles move with it. The [Compliance screen](/en/docs/screens/compliance)
shows the same measurements from the framework side.

## Getting the Microsoft half

The 1Security half works from the data you already share. The Microsoft half
needs one optional read-only permission (`SecurityEvents.Read.All`), granted
from the [Integrations screen](/en/docs/requirements) with a single
re-consent - no new app registration. Until it is granted, the screen simply
shows the 1Security half alone.

The score is also available programmatically: `GET /security-score` on the
[REST API](/en/docs/reference/api) and the `get_security_score`
[MCP tool](/en/docs/reference/mcp), both under the `evidence:read` scope.