diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md
index 7e2b725514..5031d49333 100644
--- a/windows/security/threat-protection/windows-defender-atp/TOC.md
+++ b/windows/security/threat-protection/windows-defender-atp/TOC.md
@@ -32,12 +32,13 @@
 ### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md)
 
 ### [Evaluate Windows Defender ATP](evaluate-atp.md)
-#### [Hardware-based isolation](../windows-defender-application-guard/test-scenarios-wd-app-guard.md)
-#### [Application control](../windows-defender-application-control/audit-windows-defender-application-control-policies.md)
-#### [Exploit protection](../windows-defender-exploit-guard/evaluate-exploit-protection.md)
-#### [Network Protection](../windows-defender-exploit-guard/evaluate-network-protection.md)
-#### [Controlled folder access](../windows-defender-exploit-guard/evaluate-controlled-folder-access.md)
-#### [Attack surface reduction controls](../windows-defender-exploit-guard/evaluate-attack-surface-reduction.md)
+####Evaluate attack surface redcution
+##### [Hardware-based isolation](../windows-defender-application-guard/test-scenarios-wd-app-guard.md)
+##### [Application control](../windows-defender-application-control/audit-windows-defender-application-control-policies.md)
+##### [Exploit protection](../windows-defender-exploit-guard/evaluate-exploit-protection.md)
+##### [Network Protection](../windows-defender-exploit-guard/evaluate-network-protection.md)
+##### [Controlled folder access](../windows-defender-exploit-guard/evaluate-controlled-folder-access.md)
+##### [Attack surface reduction controls](../windows-defender-exploit-guard/evaluate-attack-surface-reduction.md)
 #### [Next gen protection](../windows-defender-antivirus/evaluate-windows-defender-antivirus.md)