Sooner or later a client sees their Microsoft Secure Score and asks the obvious question: "Is 58% good?" The honest answer is "it depends", but that isn't much help to a business owner. Here's how to explain it in a way that leads somewhere useful.

What the number is

Secure Score is Microsoft's own measure of how many of its recommended security settings a tenant has turned on. Each recommendation, called an improvement action, is worth points. The score is the points achieved as a percentage of the points available.

You'll find it in the Microsoft Defender portal, with each action listed by category: identity, devices, apps and data.

What it isn't

  • It isn't a pass mark. There's no score at which a business is "secure", and no insurer sets a Secure Score threshold on its own.
  • It isn't comparable across licences. More licences unlock more actions, so the total points available change. A client on Business Premium can score lower than one on Business Basic while being far better protected.
  • It isn't weighted by risk. Some actions are worth a lot of points but matter little to a small business. Others, such as requiring MFA, matter enormously.

What moves it

The score goes up when a recommended setting is turned on, and Microsoft usually reflects the change within a day or two. It can also move when an action is marked as "risk accepted" or "resolved through a third party", for example when another tool already covers that control.

That last point matters. Marking actions honestly keeps the score meaningful. Marking them to lift the number makes it useless.

How to explain it to a client

Try three sentences:

  1. "This is Microsoft's checklist for your account, and you've done 58% of it."
  2. "Similar businesses average around 52%, so you're in line with them."
  3. "The number matters less than these three items, which are the ones insurers ask about."

Then move straight to the specific gaps. Business owners understand "five accounts nobody uses can still sign in" much faster than they understand a percentage.

Using it in a review

Show the score as context, next to the comparison with similar organisations, and track it from one review to the next. A score that rises after each round of fixes is an easy way to show progress.

See the score next to the answers that matter. The Cyber Insurance Readiness Check includes the tenant's Secure Score as context, alongside 14 answers on the controls insurers ask about.