---
title: Security score
description: One number for your organization's security posture - Microsoft Secure Score side by side with what 1Security actually observes in your tenant, with the shortest path to improving both.
icon: Gauge
---

# Security score

The Security score screen answers the question every board asks and every
admin dreads: **"How secure are we - in one number, and compared to whom?"**
It shows three figures side by side: Microsoft Secure Score exactly as the
Defender portal reports it, the 1Security score measured from what actually
happens in your tenant, and a combined headline.

## What You Can Achieve

<Cards>
  <Card
    title="See both halves of the truth"
    description="Microsoft scores what you configured. 1Security scores what is actually happening - sensitive data actually reachable, agents actually ungoverned, accounts actually dormant. The gap between the two is where incidents live."
  />
  <Card
    title="Make 5 minutes count"
    description="Every control shows the points still on the table. The 'If you only have 5 minutes' shortlist ranks them, so even the shortest security session starts with the highest-value fix."
  />
  <Card
    title="Compare against organizations like yours"
    description="Microsoft's comparative averages - all tenants, your size band, your industry - come with the score. You see at a glance whether you are ahead of or behind your peers."
  />
  <Card
    title="Prove the trend"
    description="Ninety days of daily history for both halves, plus the count of remediation actions applied - the improvement and the work behind it, on one card."
  />
</Cards>

## Two providers, one worklist

Every control - Microsoft's and 1Security's - lands in one list, sorted by
the points you can still gain. Microsoft controls carry Microsoft's own
remediation text, tier, rank, threat tags and a deep link into the Defender
portal. 1Security controls carry the measured evidence behind the verdict
("14 of 92 agents have no accountable owner") and a link to the exact screen
in 1Security where the finding is acted on.

Where both providers measure the same fact - device compliance, dormant
accounts, label protection - they are deliberately kept as two controls. A
policy that is configured but not covering real sign-ins is precisely the
insight a single merged number would hide.

Each 1Security control carries the same readiness chip as a compliance
requirement: its tier and, until its data exists, **Pending** with the wait or
**Not evaluated** with the reason - _Not evaluated · needs Microsoft Defender_
on the Microsoft security alerts control, _needs Microsoft Intune Plan 1_ on
device compliance, _needs Microsoft Entra ID P1_ on Conditional Access
coverage. A control in either state is not evaluated: it earns no points and
its points are taken out of the total possible, so the score is computed over
what was actually measured rather than dragged down by data that is not there
yet. The [Reports](/en/docs/screens/reports#what-a-readiness-tier-means) page
explains the tiers.

## Categories Microsoft doesn't have

The 1Security half adds the categories Secure Score has no coverage for at
all: **AI & agents** (accountable owners, captured instructions, reach into
restricted data), **observed data exposure** (restricted types actually
reachable, outbound sharing going to free consumer mailboxes) and
**monitoring & response** (ingestion freshness, unhandled critical anomalies,
untriaged Defender alerts).

## Waiving a control

A control that genuinely does not apply - a device control in a
cloud-only organization, say - can be waived with a note. Waived controls
leave the possible total entirely, the same semantics Microsoft uses for
"ignored" controls, and the note stays on record. The measured score itself
is never editable: only its standing is.

## Framework impact

1Security controls cite the compliance articles their measurement satisfies -
fix a control and the screen shows which ISO 27001, NIS2 or EU AI Act
articles move with it. The [Compliance screen](/en/docs/screens/compliance)
shows the same measurements from the framework side.

## Getting the Microsoft half

The 1Security half works from the data you already share. The Microsoft half
needs one optional read-only permission (`SecurityEvents.Read.All`) on the
read-only app: re-run consent on the Visibility integration from the
[Integrations screen](/en/docs/requirements) - no new app registration and
no separate module. Until it is granted, the screen simply
shows the 1Security half alone.

The score is also available programmatically: `GET /security-score` on the
[REST API](/en/docs/reference/api) and the `get_security_score`
[MCP tool](/en/docs/reference/mcp), both under the `evidence:read` scope.