Microsoft Secure Score vs CIS Microsoft 365 Benchmark vs CISA ScubaGear: which one proves your tenant is secure?

The short version: None of the three "proves" your tenant is secure. Secure Score is a trend line from Microsoft, the CIS Microsoft 365 Foundations Benchmark is the audit checklist people recognise as evidence, and CISA's ScubaGear is a free, read-only baseline checker. Use Secure Score to track, CIS to evidence, ScubaGear to cross-check.

If you manage a Microsoft 365 tenant, you have probably been handed a number and a question. The number is your Secure Score. The question, from a director, an insurer, a customer's security questionnaire or an auditor, is some version of "so is it secure?" This guide compares Microsoft Secure Score vs CIS benchmark vs ScubaGear, explains what each one actually measures, and shows which to use for which job. All three are free to run. They are not interchangeable.

We write this as a Hong Kong based managed service provider (MSP) that runs all three against client tenants across APAC, the UK and EU, and the Middle East. Where something comes from a primary source we link to it; where we are describing our own practice we say so.

What is the real question behind "Secure Score vs CIS vs ScubaGear"?

The real question is not "which tool is best". It is "what am I trying to show, and to whom?" There are three different jobs hiding in that comparison:

• Tracking: am I getting better or worse over time?
• Evidencing: can I hand someone a defensible document that says which settings are in place and which are not?
• Cross-checking: does an independent baseline agree with what I think I have configured?

Secure Score is built for the first job, the CIS benchmark for the second, and ScubaGear is most useful for the third. Most confusion comes from using one tool for another tool's job, for example quoting a Secure Score percentage to an insurer as if it were an audit result.

What is Microsoft Secure Score and what does it measure?

Microsoft describes Secure Score as a measurement of an organisation's security posture, where a higher number means more recommended actions have been taken. You find it in the Microsoft Defender portal. It covers Microsoft products such as Entra ID, Exchange Online, SharePoint Online, Teams and the Defender family, plus some non-Microsoft products such as Okta, Salesforce and Zoom.

How the score is built. Each recommended action is worth 10 points or fewer. Most are binary: turn the setting on and you get all the points. Others score proportionally. Microsoft's own example is a 10-point action to protect all users with multifactor authentication: if 50 of 100 users are protected, you get 5 points.

Who maintains it. Microsoft. The recommendations, the point values and the weighting are Microsoft's decisions, and they change over time.

What it produces. A percentage, a history graph, a list of recommended actions and a comparison against organisations like yours. It is a dashboard, not a report you can sign.

What it can and cannot see. Secure Score reads settings that are visible to Microsoft through its own services and APIs, and it lets you mark an action as covered by a third-party tool or an alternative mitigation. That last feature is useful and also a weakness: the status of those items is whatever an administrator told the portal. Microsoft also states plainly that the score "isn't an absolute measurement of how likely your system or data could be breached" and should not be read as a guarantee against a breach.

How does licensing affect Secure Score?

Microsoft says it shows the full set of possible recommendations for a product, regardless of licence edition, subscription or plan, so that you can see best practice. In practice that means some of the points on the table can only be earned if you hold the right licence, or if you cover the same risk with a third-party product and record it as such. A tenant on Microsoft 365 Business Premium and a tenant on E5 should therefore not be compared by raw percentage without asking what each can actually enable.

This is why a percentage on its own tells you less than it appears to. Two tenants with an identical score can have very different real exposure, and a tenant with a lower score may be doing the important things well and simply lacking the licence for lower-value items.

What is a good Microsoft Secure Score?

Microsoft does not publish a pass mark. Its portal compares you with organisations of similar profile and lets you set your own target, but "good" is a judgement you have to make, not a threshold you can look up. As a working guide:

• Treat the trend as more meaningful than any single reading.
• Look at which actions are still open, not only how many points are missing. Ten points of unmanaged administrator accounts matter more than ten points of cosmetic settings.
• Check whether the open items are open because of licensing, business decisions (accepted risk) or neglect. Only the last one is a problem.

Our own hardening work aims for a Secure Score of 80 or more, but we use that as a delivery target, not as proof of security.

What is the CIS Microsoft 365 Foundations Benchmark?

The CIS Microsoft 365 Foundations Benchmark is a prescriptive configuration guide from the Center for Internet Security, a non-profit that develops its benchmarks through a consensus process with practitioners. The current version is 7.0.0, released on 19 May 2026 according to a summary from Advanced, which reports 21 new recommendations, around 55 updated and a new identifier scheme. The PDF is available from CIS for non-commercial use. If you read an older article that cites v3, v4 or v5, check the version before you compare numbers.

What it measures. Specific, numbered settings across Entra ID, Exchange Online, SharePoint, Teams, Purview, Intune and more. Each recommendation states the rationale, an audit procedure and a remediation procedure. That structure is what makes it auditable: a control either passes, fails, or is not applicable.

Who maintains it. CIS and its community of contributors, with versioned releases. Changes are published and traceable, which matters when someone later asks "against which version did you assess?".

What do CIS Level 1 and Level 2 mean?

Every recommendation is assigned a profile:

• Level 1 is the core baseline: minimum settings that should be configured on any tenant and should cause little or no disruption to users.
• Level 2 is for higher-security environments, for example those handling sensitive data or facing strict compliance requirements. Level 2 settings are more stringent and may reduce convenience or need more effort to manage.

Level 1 is where most small and mid-sized businesses should start. Level 2 is a decision, not a default: some controls will change how people work, so each one should be accepted, scheduled or consciously declined.

Which CIS controls are manual?

Most recommendations can be audited through PowerShell or Microsoft Graph, and version 7.0.0 moved more of them into the automated category. Some still cannot be read reliably through an API. Examples of the kind of thing a person has to check are whether a break-glass process exists and is tested, how a setting is enforced by policy outside the tenant, or whether a configuration shown in a portal matches what a named group of users actually experiences. This is the practical gap between a script and an audit: a script reports what it can read; an auditor decides what to do with what it cannot.

What is CISA ScubaGear?

ScubaGear is an open-source PowerShell assessment tool from the US Cybersecurity and Infrastructure Security Agency (CISA). It checks a tenant against CISA's Secure Cloud Business Applications (SCuBA) secure configuration baselines, which are written policy documents for Microsoft 365 products. The GitHub repository lists Entra ID, Exchange Online, SharePoint, Teams, Power BI, Power Platform and a security suite among the products it assesses.

Who maintains it. CISA, as part of the SCuBA project. The baselines were written for US federal civilian agencies, and CISA ties the project to its Binding Operational Directive 25-01, but the tool is published under a Creative Commons Zero licence and anyone can run it.

What it produces. HTML, JSON and CSV reports listing each baseline policy and whether the tenant conforms. It is read-only: it queries configuration and does not change the tenant.

What it needs from you. A person to install and run it, and later to write a configuration file that records exclusions and accepted risk. Without that second step, the report is a list of failures that includes things you may have decided to accept.

Limits. It is a point-in-time check against one government's baseline. Some baseline items cannot be verified automatically and are reported for manual review, and a baseline written for federal agencies is stricter in some places and silent in others compared with what a 40-person company needs.

How do the three compare?

Secure Score vs CIS benchmark vs ScubaGear at a glance

• Maintained by: Secure Score is Microsoft; the benchmark is the Center for Internet Security community; ScubaGear is CISA.
• What it checks: Secure Score checks Microsoft-defined recommended actions; the benchmark checks numbered CIS recommendations at Level 1 and Level 2; ScubaGear checks the SCuBA baseline policies.
• How it runs: Secure Score is built into the Defender portal and is always on; the benchmark is a document you audit against, by script, tool or person; ScubaGear is a PowerShell tool you run.
• Automation: Secure Score is fully automated but sees only what Microsoft can read, plus whatever you tell it; the benchmark is mostly automatable with some manual controls; ScubaGear is automated with some items flagged for manual review.
• Licence dependence: high for Secure Score (the denominator includes features you may not own); moderate for the benchmark (some recommendations apply only with certain licences); low for ScubaGear, though some checks only make sense where a feature exists.
• Output: a percentage and history for Secure Score; a per-control pass/fail record for the benchmark; HTML, JSON and CSV for ScubaGear.
• Cost to run: all three are free to run. The cost is the time to run, interpret and fix.
• Accepted as evidence: Secure Score alone is weak evidence because it is a vendor self-assessment; a dated, version-stamped CIS assessment is the more familiar format for auditors and insurers; ScubaGear output is credible and technical but less commonly requested outside government. Every insurer, customer and auditor decides for itself what it accepts.

ScubaGear vs CIS benchmark: where do they differ?

The honest answer is that they overlap heavily and differ in purpose.

• Origin: the CIS benchmark is a general, cross-industry consensus standard. ScubaGear's baselines come from a US federal agency built for government tenants.
• Strictness: SCuBA baselines tend to be written as "shall" and "should" policies for agencies with a high threat model. CIS separates Level 1 and Level 2 so you can choose your depth.
• Recognition: the CIS Microsoft 365 Foundations Benchmark is the one insurers' questionnaires and customer due-diligence teams are more likely to name. SCuBA is a strong cross-check but a less common request.
• Tooling: ScubaGear is itself a tool and reports straight away. The CIS benchmark is a document, so you need a scanner, a script or an auditor to produce results against it.

If you run both and they disagree, that is useful: it shows you where a setting is a matter of baseline philosophy rather than a gap.

Worked example: when the score and the benchmark disagree

Our public sample report for a fictitious client, Acme Capital, shows the pattern. It has a Secure Score of 47% and a CIS pass rate of 61%, which is 72 of 118 controls, graded C. Those two numbers are measuring different things. The score reflects Microsoft's recommended actions and the licences available; the pass rate reflects a specific list of numbered controls, including ones the score never looks at. A tenant can sit low on one and moderate on the other, and neither number tells you which ten fixes to do first. That ranking is the real output of an audit.

Which should you use, and when?

Use Secure Score when you want a trend line

It is already there, it updates itself and it costs nothing. Check it monthly, record the number, and look at what moved. Do not use it as the only answer to an external question.

Use the CIS benchmark when someone wants evidence

When an insurer, a customer or an auditor asks how your tenant is configured, a dated assessment against a named benchmark version, with each control marked pass, fail or not checked, is the document they recognise. Say which version and which level you assessed against.

Use ScubaGear as an independent cross-check

If you have an in-house administrator comfortable with PowerShell, run it quarterly or after major changes, and compare against the benchmark. Expect to spend time on the configuration file for exclusions.

Use none of them alone

Each has blind spots. The strongest position is a score you watch, a benchmark you can show, and a cross-check that does not share the same assumptions.

What does a typical journey look like?

1. Baseline the score. Record Secure Score, open actions and the licences you hold.
2. Audit against the benchmark. Assess Level 1 first, and Level 2 where your data or customers justify it, including the manual controls.
3. Triage. Sort findings by risk and effort. Separate real gaps from licence gaps and accepted risks.
4. Remediate in order. Start with identity: multifactor authentication, administrator accounts, legacy authentication, then email protection, devices and sharing.
5. Re-check on a schedule. Re-run, keep dated reports, and note what changed. Configuration drifts as people add apps and exceptions.

What are the common traps?

• Chasing points. Flipping the cheapest settings raises the percentage without reducing risk. Fix by risk, not by points.
• Ignoring break-glass accounts. Emergency access accounts are meant to bypass normal controls, which is why they need their own monitoring, strong credentials and a tested procedure. Tools can flag them; they cannot decide how you protect them.
• Report-only Conditional Access. A policy in report-only mode shows up in the console and looks like progress, but it enforces nothing. Confirm the policy is switched on and that you have tested sign-in impact first.
• Exclusions that never expire. A Conditional Access policy with a long exclusion list, or a service account excluded "temporarily" years ago, quietly becomes the real policy. Review exclusions every time.
• Comparing scores across tenants. Different licences, different sizes and different accepted risks make raw percentages misleading.
• Treating a clean report as a guarantee. Even Microsoft says Secure Score is not a guarantee against breach, and CISA describes ScubaGear as a point-in-time assessment.

Where does Brocent fit?

Brocent Cloud Service is a Hong Kong based MSP. For Microsoft 365 we run Secure Score, ScubaGear and CIS checks under the hood, add the manual controls that scripts cannot read, and then do what the tools do not: interpret the result, put the fixes in order and write it up as evidence. We do not sell the tool, because the tools are free. We sell the interpretation, the prioritised roadmap and the evidence.

Our CIS Benchmark Audit covers CIS Level 1 and Level 2 including manual controls, with a prioritised roadmap and effort estimates. Published prices, one-off and excluding tax, are by headcount:

• 1 to 10 users: US$450
• 11 to 25 users: US$990
• 26 to 75 users: US$1,800
• 76 to 150 users: US$2,900
• Over 150 users: quoted

You grant read-only access once, and the report arrives 5 to 7 business days later with a debrief call. The report is designed to be used as evidence; whether a particular insurer or auditor accepts it is their decision, and we do not promise otherwise. You can see how the output is laid out in the sample report, and how the engine works on the security auditor page. If you would rather have continuous monitoring and re-checks, our managed IT security services cover that. You can also work through the IT security self-assessment questions to see how your organisation looks beyond Microsoft 365, or contact us with questions.

Related how-tos

To act on what the three tools report, start with how to improve your Secure Score and the one-page Microsoft 365 security checklist.

Frequently asked questions

Is Microsoft Secure Score enough to prove my tenant is secure?

No. It is a useful trend indicator from the vendor, but it is a self-reported posture score that includes items you may not be licensed for and items an administrator has marked as covered elsewhere. Microsoft itself says it is not a guarantee against a breach.

Is the CIS benchmark better than Secure Score?

They do different jobs. The CIS benchmark gives a control-by-control audit trail against a named version, which is why it is more commonly used as evidence. Secure Score is better for continuous tracking because it updates itself. Using both is normal.

What is a good Microsoft Secure Score?

Microsoft publishes no pass mark. Compare yourself with similar organisations in the portal, watch the trend and look at which actions remain open and why. A moderate score with the high-risk items done is better than a high score reached through cosmetic changes.

ScubaGear vs CIS benchmark: which should I run first?

Run the CIS benchmark first if the goal is evidence, because it is the format third parties recognise. Run ScubaGear if you want a free, read-only cross-check from a different baseline, or if you work with US government customers.

Do I need to be a US government agency to use ScubaGear?

No. The baselines were written for US federal civilian agencies, but the tool is published openly under a Creative Commons Zero licence and any administrator can run it. Expect some baseline items to be stricter than a small company needs.

Are Secure Score, CIS and ScubaGear free?

All three are free to run. The CIS benchmark PDF is free for non-commercial use. The cost is the administrator time to run them, interpret the results and make the changes safely.

Which CIS version is current, and what are Level 1 and Level 2?

Version 7.0.0, released in May 2026, is current at the time of writing. Level 1 is the core baseline with little or no disruption to users. Level 2 is for higher-security environments and may reduce convenience or need more management.

Does a CIS audit make us compliant or satisfy our insurer?

No audit does that by itself. A benchmark audit shows which settings are in place and which are not. Compliance and insurance decisions belong to the regulator or insurer, and our report is designed to be used as evidence in that conversation, not to replace it.