diff --git a/exposure-management/query-enterprise-exposure-graph.md b/exposure-management/query-enterprise-exposure-graph.md
index c2a23cabca..49de49cb64 100644
--- a/exposure-management/query-enterprise-exposure-graph.md
+++ b/exposure-management/query-enterprise-exposure-graph.md
@@ -205,7 +205,7 @@ This query results in a list of users logged into more than one critical device,
 let IdentitiesAndCriticalDevices = ExposureGraphNodes
 | where
  // Critical Device
- (set_has_element(Categories, "device") and isnotnull(NodeProperties.rawData.criticalityLevel) and NodeProperties.rawData.criticalityLevel.criticalityLevel < 4)
+ (set_has_element(Categories, "device") and isnotnull(NodeProperties.rawData.criticalityLevel) and NodeProperties.rawData.criticalityLevel.criticalityLevel > 4)
  // or identity
  or set_has_element(Categories, "identity");
 ExposureGraphEdges