Windows only boots with Secure Boot off. Is it safe to leave it that way?

Windows can run with Secure Boot disabled, so leaving it off does not automatically mean the computer is infected. But you lose a layer of protection that checks boot software before Windows starts, making it easier for unauthorized boot-level code to run.

It is not a general malware blocker. Staying away from suspicious sites helps, but it does not replace updates, backups, and normal security precautions.

That violation is worth troubleshooting rather than just ignoring. Check the computer or motherboard manufacturer's instructions for updating the BIOS or UEFI firmware and restoring the default Secure Boot keys. Firmware menus vary, and changing the wrong boot settings can leave Windows unable to start, so make a note of the current settings first.

Also check whether the system uses any alternate bootloader or dual-boot setup. Restoring default keys may affect what can boot, so don't assume it is harmless for every configuration.

One practical downside: some games and other software require Secure Boot to be enabled. Most Windows applications can still run without it, but a particular game's security requirements might stop it from launching.

Think of the risk in terms of what Secure Boot protects. It is designed to prevent untrusted boot components from loading, including some attacks that might follow physical access to a machine. That layer can matter more on a laptop that gets carried around, though it can also help against boot-level malware.