Risk evaluation framework changelog

The Risk Evaluation Framework (REF) changelog documents MSEM-initiated changes that affect how security risk is evaluated in your environment. Changes reflect updates to inputs and components of the REF - such as scope, weights, and coverage - not the underlying scoring formula.

Review this changelog if you notice unexpected changes to:

• Your risk-based secure score

• Recommendation risk levels

Understanding REF updates

MSEM initiates REF changes, not customer actions. They might include:

• New recommendations introduced to the framework to expand risk visibility across emerging security scenarios

• New asset risk factors added to evaluations to improve attack surface coverage and strengthen risk assessment depth

• Risk weighting updates to improve evaluation accuracy and better reflect relative security impact

• Evaluation scope or domain definition changes to provide more granular and context-aware risk evaluation metrics

Note

These changes reflect updates to risk evaluation inputs and components. The core scoring formula remains stable.

Changelog

Note

This changelog includes publicly available changes only. Private preview updates are communicated separately through preview communications and in-app experiences.

Date	Change type	Description	More information
30 June 2026	New recommendations added	200+ multi-cloud recommendations are now generally available.	What's new in Defender for Cloud
26 July 2026	New recommendations added	80+ Defender for SQL Vulnerability Assessment recommendations are now generally available	Database-level recommendations experience for SQL Vulnerability Assessment