diff --git a/src/content/docs/reference/policies/SecurityLogging.mdx b/src/content/docs/reference/policies/SecurityLogging.mdx
index f01a941..4f5c5f6 100644
--- a/src/content/docs/reference/policies/SecurityLogging.mdx
+++ b/src/content/docs/reference/policies/SecurityLogging.mdx
@@ -33,7 +33,7 @@ The following event keys are available:
 
 All keys accept the following sub-keys:
 
-- `Enabled`: A Boolean. If `false`, the event is not recorded. The default is `true`.
+- `Enabled`: A Boolean. If `true`, the event is recorded. The default is `false`.
 - `UrlLogging`: Controls how much URL information the event records. The default is `full`.
   - `full`: Log complete URLs, including paths and parameters. Any password in the URL is masked.
   - `domain`: Log only URL hostnames.
@@ -47,5 +47,7 @@ All keys accept the following sub-keys:
 
 <PolicyCompat policy="SecurityLogging" />
 
+As of version 157, `SecurityLogging` events defaults to `false`, meaning `Enabled` must be explicitly set to `true` for the relevant telemetry to be sent.
+
 **CCK2 Equivalent:** N/A\
 **Preferences Affected:** `browser.download.enterprise.telemetry.enabled`, `browser.download.enterprise.telemetry.fileLogging`, `browser.download.enterprise.telemetry.urlLogging`, `browser.policies.enterprise.telemetry.blocklistDomainBrowsed.enabled`, `browser.policies.enterprise.telemetry.blocklistDomainBrowsed.urlLogging`, `browser.safebrowsing.enterprise.telemetry.unsafeDownload.enabled`, `browser.safebrowsing.enterprise.telemetry.unsafeDownload.urlLogging`, `browser.safebrowsing.enterprise.telemetry.unsafeSiteVisit.enabled`, `browser.safebrowsing.enterprise.telemetry.unsafeSiteVisit.urlLogging`, `extensions.enterprise.telemetry.addonInstall.enabled`, `print.enterprise.telemetry.printPage.enabled`, `print.enterprise.telemetry.printPage.urlLogging`