New Microsoft Secure Score recommendations for AI-Readiness

Microsoft Defender now brings together six security recommendations for AI-Readiness to help organizations strengthen endpoint trust against AI-accelerated cyberattacks. Together, these recommendations provide a layered security baseline that helps reduce externally visible entry points, establish hardware-backed trust in device startup, isolate critical Windows security functions, protect kernel code integrity, and limit the reuse of local administrator credentials for lateral movement.In the Microsoft Defender portal, go to Exposure Management > Recommendations > Devices > Misconfigurations, and filter by the AI-Readiness tag to view the complete recommendation set, affected devices, exposed critical devices, points achieved, and potential impact on the Devices Secure Score. Use this view to prioritize remediation, assign ownership, track exceptions, and monitor adoption throughout the device estate.Four new recommendations are available for AI-Readiness:- Establish a hardware root of trust with TPM 2.0: Helps protect cryptographic keys, device identity, and boot measurements with hardware-backed security.- Isolate critical security functions with VBS: Helps protect critical security functions in an isolated environment that is separate from the operating system kernel.- Enforce kernel code integrity with HVCI: Helps validate kernel-mode code, block untrusted code, and prevent executable kernel memory from being writable.- Limit lateral movement with Windows LAPS: Helps prevent local administrator credentials from being reused by managing a unique password for each device.The AI-Readiness collection also includes two existing recommendations:- Reduce unnecessary internet exposure on internet-facing devices: Helps identify and remediate devices that are unnecessarily accessible from the public internet.- Protect the startup process with Secure Boot: Helps ensure that devices start by using trusted firmware and software.