Microsoft Defender Vulnerability Management - Simply Explained
Microsoft Defender Vulnerability Management goes far beyond running a vulnerability scan and installing patches. The real challenge isn't finding vulnerabilities. It's deciding which weaknesses create the most risk, what should be fixed first, who should fix it, and whether the remediation actually worked. A vulnerability scan might return hundreds or thousands of CVEs. Defender Vulnerability Management adds the device, threat, exposure, and business context needed to turn that enormous list into practical security work.
ㅤ
PATCH MANAGEMENT VS VULNERABILITY MANAGEMENT
Patch management focuses on applying fixes. You update Windows, install a newer browser version, remove outdated software, or change a configuration. Vulnerability management answers a broader set of questions: Which issue should be addressed first? How urgent is it? Which devices are affected? Who owns the remediation? And did the fix actually eliminate the vulnerability? A critical CVE on an isolated test system might represent less immediate risk than a lower-rated vulnerability on a finance laptop that handles sensitive information and is exposed to active threats. Severity matters, but context matters more.
ㅤ
DISCOVERY: KNOW WHAT YOU ACTUALLY HAVE
Before Defender can prioritize vulnerabilities, it needs visibility into your environment. Defender Vulnerability Management continuously tracks weaknesses across devices, including outdated software, missing updates, unsafe configurations, and other security gaps. Through Defender for Endpoint signals, Microsoft can understand operating systems, installed software, versions, and known vulnerabilities across onboarded devices. Unlike a traditional periodic scan, this information changes as your environment changes.
ㅤ
DEVICE DISCOVERY
Organizations frequently have devices that aren't included in their official inventory. Device discovery can use managed Defender for Endpoint devices to identify other systems visible around them on the network. That might uncover an old server, unmanaged workstation, printer, router, or another device that was never properly onboarded. Device inventory shows systems Defender already knows about. Device discovery helps expose the gaps outside that known inventory. You can't manage the vulnerability of a device you don't know exists.
ㅤ
SOFTWARE INVENTORY
Defender also builds an inventory of software across onboarded devices. Security teams can see applications, publishers, versions, affected devices, and vulnerabilities associated with installed software. Instead of manually checking hundreds of computers, teams can begin with a vulnerable application and identify every affected device, or begin with a particular device and investigate the software requiring attention. This makes it much easier to understand the actual scale of a vulnerability.
ㅤ
MORE THAN SOFTWARE PATCHES
Depending on licensing, configuration, platforms, and enabled capabilities, Defender Vulnerability Management can assess more than conventional desktop applications. This can include digital certificates, browser extensions, firmware, hardware security configurations, network shares, and other configuration weaknesses. The correct remediation isn't always installing a patch. Sometimes the appropriate response is changing a configuration, removing software, restricting access, or replacing outdated hardware.
ㅤ
PRIORITIZATION: WHAT SHOULD YOU FIX FIRST?
CVSS provides a useful general severity rating for vulnerabilities, but it doesn't understand your organization's individual environment. Defender Vulnerability Management adds additional context. Is a public exploit available? Is the vulnerability associated with active threat activity? Are there related alerts inside your environment? How many devices are affected? What roles do those devices perform? The important question changes from "Which CVE has the highest score?" to "Which vulnerability creates the most exposure for our organization?"
ㅤ
EXPOSURE SCORE AND SECURE SCORE FOR DEVICES
Exposure Score provides a broader indication of your organization's exposure. Lower is better, but it shouldn't be interpreted as a guarantee of security. Secure Score for Devices looks at security configurations and recommended protections across devices. These scores provide direction and allow teams to monitor whether security improvements are reducing exposure over time. They aren't substitutes for investigating individual vulnerabilities and recommendations.
ㅤ
SECURITY RECOMMENDATIONS
The practical work happens through recommendations. A recommendation can connect a vulnerability with the affected software, exposed devices, and an action that can reduce the risk. This allows teams to move from a general vulnerability warning to a specific remediation plan. The surrounding context can also significantly change priority. A vulnerable file sitting unused inside an archive represents a different situation from vulnerable software actively running and listening for network traffic.
ㅤ
THREAT ANALYTICS
Defender can connect vulnerability management with Microsoft's threat analytics. This helps teams understand emerging threats and active attack campaigns. Security teams can investigate whether their organization is affected, which devices are exposed, whether related alerts already exist, and what mitigations could reduce risk while a permanent solution is prepared. This is another reason vulnerability management shouldn't simply mean patching everything in severity order.
ㅤ
REMEDIATION: TURN FINDINGS INTO WORK
Defender Vulnerability Management isn't a universal patching engine. Its role is to identify vulnerabilities, prioritize them, create remediation work, track progress, and verify the result. The actual change might be performed through Microsoft Intune, ServiceNow, another ticketing platform, software deployment tools, or directly by an IT team. Security recommendations provide the context needed to turn a vulnerability into an actionable task with scope, priority, ownership, and a deadline.
ㅤ
DEFENDER AND INTUNE WORKING TOGETHER
With an Intune connection, Defender can turn remediation requirements into security tasks. Security teams identify and prioritize the risk. Device management teams determine how the necessary changes should be deployed without unnecessarily disrupting users or business applications. For example, a browser vulnerability might first be remediated across a small pilot group. Once compatibility is confirmed, the update can be deployed progressively to the remaining devices. This creates a controlled remediation workflow rather than immediately pushing every change to every endpoint.
ㅤ
EXCEPTIONS AND MITIGATIONS
Sometimes a vulnerability can't be fixed immediately. A legacy application may require an older browser version. A vendor may need additional time to release or validate an update. A production server might only be changed during an approved maintenance window. In these situations, exceptions should be documented with a clear reason and an end date. Temporary mitigations can also reduce exposure while teams prepare the permanent fix, such as restricting connectivity, blocking vulnerable applications, or implementing vendor-recommended controls.
ㅤ
VERIFICATION: DID THE FIX ACTUALLY WORK?
A closed ticket doesn't automatically mean a vulnerability has disappeared. An update might have been deployed through Intune while individual devices remained offline, failed the installation, or continued running the vulnerable version. Defender Vulnerability Management continues evaluating device signals. When affected devices stop reporting the weakness, the remediation can be considered completed. This provides evidence based on the actual state of the devices rather than relying only on a deployment report.
ㅤ
THE CONNECTED MICROSOFT SECURITY ECOSYSTEM
Vulnerability management becomes more powerful when combined with the wider Microsoft security ecosystem. Intune manages device configuration and compliance. Defender for Endpoint detects threats and calculates device risk. Entra ID can use those signals through Conditional Access. For example, a device with serious security problems could become noncompliant in Intune. Conditional Access could then restrict that device from accessing SharePoint, Teams, or Exchange Online until it returns to an acceptable state. This limits what a risky endpoint can access while remediation is still underway.
ㅤ
ADDING DATA SENSITIVITY TO THE RISK PICTURE
Microsoft Purview can add another layer of business context by helping identify sensitive information. A device regularly handling confidential finance or customer information may deserve higher priority than a general-purpose device carrying the same vulnerability. This is where vulnerability management becomes more than technical severity. Security teams can consider what a vulnerable device actually represents to the organization.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.
🚀 Want to be part of m365.fm?
Then stop just listening… and start showing up.
👉 Connect with me on LinkedIn and let’s make something happen:
- 🎙️ Be a podcast guest and share your story
- 🎧 Host your own episode (yes, seriously)
- 💡 Pitch topics the community actually wants to hear
- 🌍 Build your personal brand in the Microsoft 365 space
This isn’t just a podcast — it’s a platform for people who take action.
🔥 Most people wait. The best ones don’t.
👉 Connect with me on LinkedIn and send me a message:
"I want in"
Let’s build something awesome 👊
00:00:00,000 --> 00:00:03,760
Welcome to another episode of Microsoft Knowledge Nuggets here on M365.
2
00:00:03,760 --> 00:00:05,640
FM, I'm your host, Mirko Peters.
3
00:00:05,640 --> 00:00:08,160
Today's topic is vulnerability management.
4
00:00:08,160 --> 00:00:10,120
And it's one of those terms almost everyone has heard,
5
00:00:10,120 --> 00:00:11,720
but most people don't really understand.
6
00:00:11,720 --> 00:00:14,000
Most people hear vulnerability management and think,
7
00:00:14,000 --> 00:00:16,800
"That's the monthly scan, then we install updates."
8
00:00:16,800 --> 00:00:19,120
That's not wrong, but it misses the hard part.
9
00:00:19,120 --> 00:00:21,240
A scan can give you a list of CVEs,
10
00:00:21,240 --> 00:00:24,080
those public labels for known software weaknesses.
11
00:00:24,080 --> 00:00:25,960
But when you have hundreds or thousands of results,
12
00:00:25,960 --> 00:00:28,160
the real question isn't, "What can we patch?"
13
00:00:28,160 --> 00:00:30,040
It's, "What should we fix first?"
14
00:00:30,040 --> 00:00:31,800
Think of your company like an office building.
15
00:00:31,800 --> 00:00:34,320
You've got front doors, side doors, windows, locks,
16
00:00:34,320 --> 00:00:36,480
and maybe an old storage room, nobody remembers.
17
00:00:36,480 --> 00:00:38,920
Microsoft Defender vulnerability management
18
00:00:38,920 --> 00:00:41,360
is like a security guard walking through that building.
19
00:00:41,360 --> 00:00:44,720
It spots weak locks, tells you which entrance creates the most risk,
20
00:00:44,720 --> 00:00:46,520
sends the repair job to the right team,
21
00:00:46,520 --> 00:00:48,840
and then checks that the lock actually got fixed.
22
00:00:48,840 --> 00:00:50,480
By the end of this knowledge nugget,
23
00:00:50,480 --> 00:00:54,360
you'll understand discovery, priority, remediation, and proof,
24
00:00:54,360 --> 00:00:55,520
all in plain English.
25
00:00:55,520 --> 00:00:58,120
Because one unmanaged laptop or one old browser
26
00:00:58,120 --> 00:01:00,040
can still leave a route into the building.
27
00:01:00,040 --> 00:01:03,440
So let's start with why a patch list on its own often fails.
28
00:01:03,440 --> 00:01:04,920
Here's the thing about a patch list.
29
00:01:04,920 --> 00:01:05,760
It's just a list.
30
00:01:05,760 --> 00:01:07,640
It doesn't tell you what to do.
31
00:01:07,640 --> 00:01:08,560
The problem.
32
00:01:08,560 --> 00:01:10,800
Too many warnings, too little direction.
33
00:01:10,800 --> 00:01:13,760
For a long time, vulnerability work followed a familiar pattern.
34
00:01:13,760 --> 00:01:16,040
A team ran a scan every month or every quarter.
35
00:01:16,040 --> 00:01:18,120
Someone exported the results into a spreadsheet,
36
00:01:18,120 --> 00:01:20,400
another person compared that sheet with a patch report,
37
00:01:20,400 --> 00:01:22,960
and then emails started flying between security,
38
00:01:22,960 --> 00:01:26,760
desktop support, server teams, and application owners.
39
00:01:26,760 --> 00:01:29,520
The list got longer, the work became harder to track,
40
00:01:29,520 --> 00:01:31,640
and the business still needed one answer.
41
00:01:31,640 --> 00:01:33,600
What creates the most risk right now?
42
00:01:33,600 --> 00:01:34,840
And that's a real problem.
43
00:01:34,840 --> 00:01:37,240
That's the difference between patch management and vulnerability
44
00:01:37,240 --> 00:01:37,920
management.
45
00:01:37,920 --> 00:01:39,920
Patch management is about applying repairs.
46
00:01:39,920 --> 00:01:43,040
You update Windows, you update Chrome, you remove old software.
47
00:01:43,040 --> 00:01:46,360
Vulnerability management decides which repair should happen first,
48
00:01:46,360 --> 00:01:48,480
who needs to do it, how urgent it is,
49
00:01:48,480 --> 00:01:50,880
and whether the repair actually worked when it was done.
50
00:01:50,880 --> 00:01:53,240
That decision matters because not every warning
51
00:01:53,240 --> 00:01:54,600
deserves the same response.
52
00:01:54,600 --> 00:01:57,520
A CVE is a public reference number for a known weakness.
53
00:01:57,520 --> 00:01:59,240
Think of it like a product recall number.
54
00:01:59,240 --> 00:02:02,440
It tells you a problem exists in a certain version of software,
55
00:02:02,440 --> 00:02:04,920
but it doesn't automatically tell you whether that problem
56
00:02:04,920 --> 00:02:07,080
puts your company in immediate danger.
57
00:02:07,080 --> 00:02:09,480
You might see a very high severity CVE on software
58
00:02:09,480 --> 00:02:12,560
that sits on an isolated test device, isn't in use,
59
00:02:12,560 --> 00:02:14,200
and can't reach anything important.
60
00:02:14,200 --> 00:02:16,600
At the same time, you might find a lower rated weakness
61
00:02:16,600 --> 00:02:19,560
on a finance laptop that connects to sensitive files every day.
62
00:02:19,560 --> 00:02:21,800
If attackers are actively using that weakness,
63
00:02:21,800 --> 00:02:24,000
the finance laptop becomes the bigger problem.
64
00:02:24,000 --> 00:02:26,360
Severity is useful, but it isn't the full picture.
65
00:02:26,360 --> 00:02:28,560
You need to know the context around each weakness.
66
00:02:28,560 --> 00:02:31,960
Imagine your company has 500 laptops with Google Chrome installed.
67
00:02:31,960 --> 00:02:34,880
A new Chrome update comes out and defender shows a known weakness
68
00:02:34,880 --> 00:02:36,280
in an older version.
69
00:02:36,280 --> 00:02:39,240
At first glance, you might think every one of those 500 devices
70
00:02:39,240 --> 00:02:41,000
needs the same urgent treatment.
71
00:02:41,000 --> 00:02:42,200
But then you look closer.
72
00:02:42,200 --> 00:02:44,240
Most of the laptops belong to office staff
73
00:02:44,240 --> 00:02:46,960
sit behind normal protections and will receive the update
74
00:02:46,960 --> 00:02:48,560
during the next managed window.
75
00:02:48,560 --> 00:02:51,680
One laptop belongs to someone who handles finance records,
76
00:02:51,680 --> 00:02:54,280
travels often, connects from public networks,
77
00:02:54,280 --> 00:02:57,400
and has an active alert linked to suspicious activity.
78
00:02:57,400 --> 00:02:59,440
Same browser issue, very different situation.
79
00:02:59,440 --> 00:03:02,560
That is why vulnerability management needs business context.
80
00:03:02,560 --> 00:03:04,320
Is the device exposed to the internet?
81
00:03:04,320 --> 00:03:06,000
Is there a public exploit available?
82
00:03:06,000 --> 00:03:07,920
Has Microsoft seen related threat activity?
83
00:03:07,920 --> 00:03:09,400
How many devices have the issue?
84
00:03:09,400 --> 00:03:11,120
Does the device hold sensitive data?
85
00:03:11,120 --> 00:03:13,320
Is it a normal workstation, a server, or a system
86
00:03:13,320 --> 00:03:15,160
people rely on to run the business?
87
00:03:15,160 --> 00:03:18,160
Without those answers, teams often patch by panic.
88
00:03:18,160 --> 00:03:20,240
They started the top of a severity list,
89
00:03:20,240 --> 00:03:23,160
rush changes into production, and sometimes interrupt
90
00:03:23,160 --> 00:03:26,640
a business system that had little real exposure.
91
00:03:26,640 --> 00:03:29,760
Meanwhile, the weakness and attacker can actually use stays open.
92
00:03:29,760 --> 00:03:31,600
Microsoft Defender Vulnerability Management
93
00:03:31,600 --> 00:03:34,480
helps turn that noisy list into a clearer order of work.
94
00:03:34,480 --> 00:03:36,520
But before Defender can rank a weakness,
95
00:03:36,520 --> 00:03:38,440
it needs to answer a more basic question.
96
00:03:38,440 --> 00:03:40,800
What devices and software do you actually have?
97
00:03:40,800 --> 00:03:42,560
That sounds simple, but you'd be surprised
98
00:03:42,560 --> 00:03:44,560
how many organizations don't know.
99
00:03:44,560 --> 00:03:47,360
Discovery, finding what you don't know you have.
100
00:03:47,360 --> 00:03:49,400
Microsoft Defender Vulnerability Management
101
00:03:49,400 --> 00:03:51,440
is the part of Defender that tracks weaknesses
102
00:03:51,440 --> 00:03:53,160
across your devices over time.
103
00:03:53,160 --> 00:03:55,640
It watches for outdated software, missing updates,
104
00:03:55,640 --> 00:03:58,480
unsafe settings, and other gaps that could let an attacker in.
105
00:03:58,480 --> 00:04:00,640
This isn't like running one scan, saving a report,
106
00:04:00,640 --> 00:04:02,760
and hoping nothing changes before the next check.
107
00:04:02,760 --> 00:04:04,480
Defender for endpoint collects signals
108
00:04:04,480 --> 00:04:06,240
from devices you've unborted.
109
00:04:06,240 --> 00:04:08,480
Those signals tell Defender what operating system
110
00:04:08,480 --> 00:04:10,040
is running, what software is installed,
111
00:04:10,040 --> 00:04:13,160
which versions are there, and where known weaknesses might live.
112
00:04:13,160 --> 00:04:14,400
The picture changes constantly
113
00:04:14,400 --> 00:04:16,200
because your environment changes constantly.
114
00:04:16,200 --> 00:04:19,400
Someone installs a browser extension, a device misses an update,
115
00:04:19,400 --> 00:04:21,320
a certificate gets close to expiry,
116
00:04:21,320 --> 00:04:23,240
a new software weakness becomes public.
117
00:04:23,240 --> 00:04:25,160
Instead of waiting for a spreadsheet review,
118
00:04:25,160 --> 00:04:28,280
Defender keeps that information connected to the devices it sees.
119
00:04:28,280 --> 00:04:30,000
That ongoing view starts with a question
120
00:04:30,000 --> 00:04:31,280
you might not want to ask.
121
00:04:31,280 --> 00:04:34,000
Do you actually know every device connected to your company network?
122
00:04:34,000 --> 00:04:36,200
Most companies think they do until they look.
123
00:04:36,200 --> 00:04:39,560
Defender device discovery uses the devices you already managed
124
00:04:39,560 --> 00:04:42,920
with Defender for endpoint to notice other devices nearby.
125
00:04:42,920 --> 00:04:45,200
A managed laptop sees network activity around it
126
00:04:45,200 --> 00:04:47,960
and reports that an unknown endpoint or network device exists
127
00:04:47,960 --> 00:04:49,240
that might be another computer.
128
00:04:49,240 --> 00:04:51,440
It might be a printer, a router, or a device
129
00:04:51,440 --> 00:04:53,880
somebody connected without going through normal setup.
130
00:04:53,880 --> 00:04:55,600
Picture a small company office.
131
00:04:55,600 --> 00:04:57,800
The IT team has a list of company laptops
132
00:04:57,800 --> 00:05:00,120
and all of them appear in intune and Defender.
133
00:05:00,120 --> 00:05:02,360
Then device discovery notices an old test server
134
00:05:02,360 --> 00:05:03,560
in a corner of the network.
135
00:05:03,560 --> 00:05:05,400
Nobody owns it now, but it still runs.
136
00:05:05,400 --> 00:05:07,040
It also notices the reception PC
137
00:05:07,040 --> 00:05:08,760
that never moved to the new management system,
138
00:05:08,760 --> 00:05:10,000
a printer with old firmware
139
00:05:10,000 --> 00:05:12,400
and a personal laptop connected to the office Wi-Fi.
140
00:05:12,400 --> 00:05:14,920
None of those devices showed up in the normal reports.
141
00:05:14,920 --> 00:05:15,920
But they were still there.
142
00:05:15,920 --> 00:05:17,720
That difference is worth slowing down for.
143
00:05:17,720 --> 00:05:20,640
Device inventory shows the devices Defender knows and manages.
144
00:05:20,640 --> 00:05:23,040
You can look at details like the operating system,
145
00:05:23,040 --> 00:05:26,680
security state, installed software, and related findings.
146
00:05:26,680 --> 00:05:30,000
Device discovery helps you find the gaps outside that known list.
147
00:05:30,000 --> 00:05:31,600
It gives you a starting point for asking,
148
00:05:31,600 --> 00:05:33,880
should this device be onboarded, managed another way,
149
00:05:33,880 --> 00:05:36,760
restricted, or removed from the network?
150
00:05:36,760 --> 00:05:39,160
You can't protect a device you don't know exists.
151
00:05:39,160 --> 00:05:40,920
The same idea applies to software.
152
00:05:40,920 --> 00:05:43,280
Defender software inventory builds a list of applications
153
00:05:43,280 --> 00:05:45,440
found across your onboarded devices.
154
00:05:45,440 --> 00:05:47,480
You see the software name, publisher version,
155
00:05:47,480 --> 00:05:49,120
and which devices have it installed.
156
00:05:49,120 --> 00:05:50,720
From there, Defender connects that software
157
00:05:50,720 --> 00:05:53,360
to known weaknesses and shows which devices are exposed.
158
00:05:53,360 --> 00:05:55,400
This becomes useful when one outdated app
159
00:05:55,400 --> 00:05:57,320
appears across dozens of machines
160
00:05:57,320 --> 00:06:00,200
or when an old component sits inside an application,
161
00:06:00,200 --> 00:06:01,480
nobody thought to check.
162
00:06:01,480 --> 00:06:03,000
You're not searching device by device,
163
00:06:03,000 --> 00:06:04,280
and you can start with the software,
164
00:06:04,280 --> 00:06:05,840
then move to the affected devices
165
00:06:05,840 --> 00:06:08,400
or start with a device and see what software needs attention.
166
00:06:08,400 --> 00:06:10,520
The view goes beyond normal desktop apps too.
167
00:06:10,520 --> 00:06:12,960
Depending on your setup and what features you've enabled,
168
00:06:12,960 --> 00:06:15,120
Defender vulnerability management can assess things
169
00:06:15,120 --> 00:06:17,200
like digital certificates, browser extensions,
170
00:06:17,200 --> 00:06:19,080
firmware, hardware security settings,
171
00:06:19,080 --> 00:06:21,680
network shares, and configuration gaps.
172
00:06:21,680 --> 00:06:24,760
A browser extension might ask for broad access to websites.
173
00:06:24,760 --> 00:06:27,840
A certificate might use an old method or be close to expiring.
174
00:06:27,840 --> 00:06:30,920
A shared folder might give far too many people access.
175
00:06:30,920 --> 00:06:33,640
Firmware can be old even when Windows is fully updated.
176
00:06:33,640 --> 00:06:35,080
These aren't always patch problems.
177
00:06:35,080 --> 00:06:37,080
Sometimes the right fix is a setting change
178
00:06:37,080 --> 00:06:38,720
removing software tightening access
179
00:06:38,720 --> 00:06:40,560
or replacing an old device.
180
00:06:40,560 --> 00:06:42,240
Here's one boundary to keep in mind.
181
00:06:42,240 --> 00:06:44,320
What Defender can see depends on your licensing,
182
00:06:44,320 --> 00:06:46,920
the platforms you use, where the devices are on-boarded
183
00:06:46,920 --> 00:06:48,720
and which features you've turned on.
184
00:06:48,720 --> 00:06:50,680
Discovery is strong, but it isn't magic.
185
00:06:50,680 --> 00:06:52,480
A device outside the supported setup
186
00:06:52,480 --> 00:06:54,760
or completely disconnected from your environment
187
00:06:54,760 --> 00:06:56,480
won't suddenly give you a full report.
188
00:06:56,480 --> 00:06:58,560
Still, once you have a clearer list of devices,
189
00:06:58,560 --> 00:07:01,200
software, and weak spots, a bigger problem appears.
190
00:07:01,200 --> 00:07:02,440
Where do you begin?
191
00:07:02,440 --> 00:07:03,480
Prioritization.
192
00:07:03,480 --> 00:07:05,920
Choosing the door and attacker can actually use.
193
00:07:05,920 --> 00:07:08,720
A long-von-von-rability list doesn't tell you what to do first.
194
00:07:08,720 --> 00:07:12,200
Many teams rely on CVSS, the common-von-rability scoring system,
195
00:07:12,200 --> 00:07:14,160
it gives a weakness, a severity rating,
196
00:07:14,160 --> 00:07:15,680
often from low to critical.
197
00:07:15,680 --> 00:07:16,640
That rating helps.
198
00:07:16,640 --> 00:07:19,320
But a severity score describes the weakness in general.
199
00:07:19,320 --> 00:07:21,360
It doesn't know your company, your devices,
200
00:07:21,360 --> 00:07:22,920
or what an attacker can reach.
201
00:07:22,920 --> 00:07:24,840
Microsoft Defender vulnerability management
202
00:07:24,840 --> 00:07:26,400
adds that missing context.
203
00:07:26,400 --> 00:07:28,880
It looks at the weakness, but also at signals around it.
204
00:07:28,880 --> 00:07:30,120
Is there a public exploit?
205
00:07:30,120 --> 00:07:32,800
Has Microsoft seen threat activity connected to it?
206
00:07:32,800 --> 00:07:35,080
Does the issue link to an active alert in your environment
207
00:07:35,080 --> 00:07:36,480
how many devices are affected?
208
00:07:36,480 --> 00:07:38,480
Are those devices ordinary workstations
209
00:07:38,480 --> 00:07:41,120
or systems that handle sensitive files and business work?
210
00:07:41,120 --> 00:07:44,680
This changes the question from which CVE has the highest number?
211
00:07:44,680 --> 00:07:48,120
To which issue creates the most exposure for us?
212
00:07:48,120 --> 00:07:49,760
Think about the office building again.
213
00:07:49,760 --> 00:07:51,680
A loose lock on a garden shed is worth fixing,
214
00:07:51,680 --> 00:07:53,840
but an unlocked front door beside the finance records
215
00:07:53,840 --> 00:07:55,000
is a different problem.
216
00:07:55,000 --> 00:07:56,600
Both are security issues.
217
00:07:56,600 --> 00:07:58,440
Only one gives somebody a direct root
218
00:07:58,440 --> 00:08:00,000
to something far more sensitive.
219
00:08:00,000 --> 00:08:01,520
Defender uses that kind of thinking
220
00:08:01,520 --> 00:08:03,720
when it ranks security recommendations.
221
00:08:03,720 --> 00:08:05,520
You'll see an exposure score, which gives you
222
00:08:05,520 --> 00:08:08,040
a broad view of how exposed your organization is.
223
00:08:08,040 --> 00:08:08,880
Lower is better.
224
00:08:08,880 --> 00:08:11,840
It isn't a grade for whether your company is safe or unsafe.
225
00:08:11,840 --> 00:08:13,680
It's more like a warning light that helps you see
226
00:08:13,680 --> 00:08:16,080
whether the number of open roots into your environment
227
00:08:16,080 --> 00:08:17,480
is moving in the right direction.
228
00:08:17,480 --> 00:08:19,360
You may also see secure score for devices.
229
00:08:19,360 --> 00:08:21,200
This looks at device security settings
230
00:08:21,200 --> 00:08:22,640
and shows where you can improve them.
231
00:08:22,640 --> 00:08:25,040
Maybe devices need a stronger security setting,
232
00:08:25,040 --> 00:08:28,040
a safer configuration, or a control turned on.
233
00:08:28,040 --> 00:08:30,440
A higher score usually means more recommended protections
234
00:08:30,440 --> 00:08:31,200
are in place.
235
00:08:31,200 --> 00:08:33,280
Still, don't treat either score like a guarantee.
236
00:08:33,280 --> 00:08:35,080
A good score doesn't mean an attacker can't get in.
237
00:08:35,080 --> 00:08:38,120
A lower score doesn't tell you exactly where an attack will happen.
238
00:08:38,120 --> 00:08:40,040
The scores help you decide where to look
239
00:08:40,040 --> 00:08:43,080
and measure whether your work reduces exposure over time.
240
00:08:43,080 --> 00:08:45,120
The practical work happens in the recommendations.
241
00:08:45,120 --> 00:08:47,160
Open a recommendation and Defender can lead you
242
00:08:47,160 --> 00:08:49,560
from the weakness to the affected software
243
00:08:49,560 --> 00:08:51,680
to the exposed devices and then to the action
244
00:08:51,680 --> 00:08:53,200
that can reduce the issue.
245
00:08:53,200 --> 00:08:55,240
That path matters because it prevents guesswork.
246
00:08:55,240 --> 00:08:57,320
You might start with a vulnerable software component.
247
00:08:57,320 --> 00:08:59,840
From there, you see which version caused the issue,
248
00:08:59,840 --> 00:09:01,600
which devices still carry it,
249
00:09:01,600 --> 00:09:04,240
and whether a software update, setting change,
250
00:09:04,240 --> 00:09:06,800
or other action addresses the weakness.
251
00:09:06,800 --> 00:09:09,160
Sometimes the detail changes the order completely.
252
00:09:09,160 --> 00:09:11,120
A vulnerable file may appear on many devices,
253
00:09:11,120 --> 00:09:13,840
but that doesn't always mean each device carries the same risk.
254
00:09:13,840 --> 00:09:17,360
One file might simply sit inside an old archive and never run.
255
00:09:17,360 --> 00:09:19,120
Another could be loaded by an active process
256
00:09:19,120 --> 00:09:21,200
and listening for traffic on a network port.
257
00:09:21,200 --> 00:09:22,920
Those are very different conditions.
258
00:09:22,920 --> 00:09:25,760
The second device gives an attacker a more realistic route in,
259
00:09:25,760 --> 00:09:27,840
so it deserves attention sooner.
260
00:09:27,840 --> 00:09:30,760
Defender can also connect this work with threat analytics.
261
00:09:30,760 --> 00:09:32,880
These are Microsoft reports about emerging threats
262
00:09:32,880 --> 00:09:34,480
and active attack campaigns.
263
00:09:34,480 --> 00:09:36,240
They help answer useful questions.
264
00:09:36,240 --> 00:09:37,800
Are we affected by this threat?
265
00:09:37,800 --> 00:09:39,600
Do we have devices exposed to it?
266
00:09:39,600 --> 00:09:42,320
Are there alerts showing it already touched our environment?
267
00:09:42,320 --> 00:09:43,840
What mitigations reduce the risk
268
00:09:43,840 --> 00:09:45,640
while teams prepare a full fix?
269
00:09:45,640 --> 00:09:47,720
You can see why patching everything as fast as possible
270
00:09:47,720 --> 00:09:49,160
isn't always the best plan.
271
00:09:49,160 --> 00:09:51,200
A rushed update can interrupt a business app,
272
00:09:51,200 --> 00:09:53,680
break a workflow, or take down a service people need.
273
00:09:53,680 --> 00:09:55,160
That doesn't mean you ignore updates.
274
00:09:55,160 --> 00:09:57,120
It means you use the context defender provides
275
00:09:57,120 --> 00:09:59,800
to focus effort where it reduces the most risk
276
00:09:59,800 --> 00:10:01,880
while planning changes safely for the rest.
277
00:10:01,880 --> 00:10:04,080
So Defender gives you a clearer first fix,
278
00:10:04,080 --> 00:10:05,360
but knowing what needs attention
279
00:10:05,360 --> 00:10:07,920
and actually changing a device are two separate jobs.
280
00:10:07,920 --> 00:10:10,520
Defender now needs to hand that work to the people
281
00:10:10,520 --> 00:10:12,360
and tools that can apply the repair.
282
00:10:12,360 --> 00:10:16,280
Remediation from security finding to real work.
283
00:10:16,280 --> 00:10:19,800
So here's a common misunderstanding, defender vulnerability.
284
00:10:19,800 --> 00:10:22,240
Management doesn't turn into a universal patching engine
285
00:10:22,240 --> 00:10:23,800
the moment it finds a problem.
286
00:10:23,800 --> 00:10:26,360
Its real job is to identify the issue, rank it,
287
00:10:26,360 --> 00:10:28,840
assign work, track progress, and check the result.
288
00:10:28,840 --> 00:10:30,440
The actual change might happen through
289
00:10:30,440 --> 00:10:32,920
in-tune service now, another ticket system,
290
00:10:32,920 --> 00:10:36,400
a software deployment tool, or even a hands-on change by an IT team.
291
00:10:36,400 --> 00:10:38,400
Think of Defender as the place where security work
292
00:10:38,400 --> 00:10:39,520
gets clear ownership.
293
00:10:39,520 --> 00:10:42,400
A security recommendation gives you more than just a warning.
294
00:10:42,400 --> 00:10:45,120
It links the action you should take to the affected software,
295
00:10:45,120 --> 00:10:47,480
the related weakness, and the devices in scope.
296
00:10:47,480 --> 00:10:50,040
It can also show you the expected reduction in exposure
297
00:10:50,040 --> 00:10:50,920
if you address it.
298
00:10:50,920 --> 00:10:53,240
So instead of sending someone a vague message saying,
299
00:10:53,240 --> 00:10:56,240
"We have a browser problem, you can point to the exact version,
300
00:10:56,240 --> 00:10:59,000
the affected devices, and the action required."
301
00:10:59,000 --> 00:11:01,040
From that recommendation, a security team
302
00:11:01,040 --> 00:11:02,880
can create a remediation request.
303
00:11:02,880 --> 00:11:06,440
They select the device scope, set the priority, add a due date,
304
00:11:06,440 --> 00:11:08,480
and include notes for the team that will do the work.
305
00:11:08,480 --> 00:11:10,440
Maybe the update needs testing first,
306
00:11:10,440 --> 00:11:12,440
or a certain business app might be affected,
307
00:11:12,440 --> 00:11:15,040
or the request can't wait for the normal update cycle.
308
00:11:15,040 --> 00:11:17,120
That turns the security finding into a piece of work
309
00:11:17,120 --> 00:11:18,720
with a named owner and a deadline.
310
00:11:18,720 --> 00:11:21,120
The hand-off matters because security and device management
311
00:11:21,120 --> 00:11:23,080
teams often have different jobs.
312
00:11:23,080 --> 00:11:26,320
Security teams watch for risks and decide what needs attention.
313
00:11:26,320 --> 00:11:29,200
Device teams know how updates reach laptops, servers,
314
00:11:29,200 --> 00:11:31,720
and apps without interrupting the people who need them.
315
00:11:31,720 --> 00:11:33,240
With the Intune connection in place,
316
00:11:33,240 --> 00:11:36,960
Defender can send that request into Intune as a security task.
317
00:11:36,960 --> 00:11:38,680
The Intune team can review it, accept it,
318
00:11:38,680 --> 00:11:40,720
apply the update or configuration change,
319
00:11:40,720 --> 00:11:42,800
and report progress back through the shared workflow.
320
00:11:42,800 --> 00:11:44,920
Nobody needs to copy device names from one portal
321
00:11:44,920 --> 00:11:45,680
into a spreadsheet.
322
00:11:45,680 --> 00:11:48,560
Nobody needs to attach screenshots to a long email chain.
323
00:11:48,560 --> 00:11:51,120
If your company uses service now or another ticket system,
324
00:11:51,120 --> 00:11:52,880
the same idea applies.
325
00:11:52,880 --> 00:11:54,960
Defender provides the finding and context,
326
00:11:54,960 --> 00:11:57,760
while the ticket system manages the work in the process,
327
00:11:57,760 --> 00:11:59,280
your IT teams already use.
328
00:11:59,280 --> 00:12:00,640
That gives everyone the same record.
329
00:12:00,640 --> 00:12:02,160
Security can see what they asked for.
330
00:12:02,160 --> 00:12:03,840
It can see why the work matters.
331
00:12:03,840 --> 00:12:06,960
Managers can see whether the issue is open, in progress,
332
00:12:06,960 --> 00:12:08,680
over-du, or completed.
333
00:12:08,680 --> 00:12:11,200
Now imagine Defender identifies a serious browser weakness
334
00:12:11,200 --> 00:12:12,480
on a group of devices.
335
00:12:12,480 --> 00:12:15,120
The security team opens a remediation request
336
00:12:15,120 --> 00:12:17,480
and scopes it to the affected browser version.
337
00:12:17,480 --> 00:12:20,280
They market as high priority, set a due date,
338
00:12:20,280 --> 00:12:22,240
and add a note that the update should begin
339
00:12:22,240 --> 00:12:23,320
with a pilot group.
340
00:12:23,320 --> 00:12:25,960
The device team receives the Intune security task.
341
00:12:25,960 --> 00:12:27,640
They update a small group first.
342
00:12:27,640 --> 00:12:30,280
Maybe the IT team and a few volunteers.
343
00:12:30,280 --> 00:12:32,120
They check that the browser works with the company's
344
00:12:32,120 --> 00:12:33,800
sites and line of business apps.
345
00:12:33,800 --> 00:12:35,760
Once that looks good, they roll the update out
346
00:12:35,760 --> 00:12:37,480
and stages to the remaining devices.
347
00:12:37,480 --> 00:12:39,320
Progress appears in the task and Defender
348
00:12:39,320 --> 00:12:41,880
then checks the devices again as they report in.
349
00:12:41,880 --> 00:12:44,520
That staged approach might feel slower than clicking update
350
00:12:44,520 --> 00:12:46,560
all, but it prevents one bad update
351
00:12:46,560 --> 00:12:48,520
from becoming a company-wide problem.
352
00:12:48,520 --> 00:12:50,840
A pilot group gives you a small, controlled place
353
00:12:50,840 --> 00:12:52,960
to find trouble before everybody feels it.
354
00:12:52,960 --> 00:12:54,840
Sometimes a full fix can't happen right away.
355
00:12:54,840 --> 00:12:57,160
Maybe a server runs an old application that only works
356
00:12:57,160 --> 00:12:58,920
with a specific browser version.
357
00:12:58,920 --> 00:13:00,960
Maybe a vendor needs time to confirm a patch.
358
00:13:00,960 --> 00:13:02,880
Maybe the business has a fixed maintenance window.
359
00:13:02,880 --> 00:13:04,600
That doesn't mean the issue disappears.
360
00:13:04,600 --> 00:13:07,760
Create an exception, document why the system can't change yet,
361
00:13:07,760 --> 00:13:09,000
and set an end date.
362
00:13:09,000 --> 00:13:10,960
An exception should be a temporary decision
363
00:13:10,960 --> 00:13:13,240
with a visible review date, not a quiet way
364
00:13:13,240 --> 00:13:14,600
to forget about a risk.
365
00:13:14,600 --> 00:13:16,600
While you wait, you may be able to reduce the danger
366
00:13:16,600 --> 00:13:17,400
in another way.
367
00:13:17,400 --> 00:13:19,840
You might block a vulnerable application from running.
368
00:13:19,840 --> 00:13:21,880
You might apply a temporary mitigation recommended
369
00:13:21,880 --> 00:13:23,160
by the software vendor.
370
00:13:23,160 --> 00:13:25,000
You might limit where the device can connect
371
00:13:25,000 --> 00:13:27,080
until the permanent update is ready.
372
00:13:27,080 --> 00:13:28,720
The point is to reduce the open route
373
00:13:28,720 --> 00:13:30,840
while the full repair is still being planned.
374
00:13:30,840 --> 00:13:33,120
And this leads to a mistake that catches many teams.
375
00:13:33,120 --> 00:13:34,840
A completed ticket doesn't automatically
376
00:13:34,840 --> 00:13:36,880
mean the security gap is closed.
377
00:13:36,880 --> 00:13:40,000
Verification and the connected Microsoft 365 building,
378
00:13:40,000 --> 00:13:42,360
the update may show as deployed in Intune,
379
00:13:42,360 --> 00:13:43,480
the ticket may say complete.
380
00:13:43,480 --> 00:13:45,240
Neither one proves the vulnerable version
381
00:13:45,240 --> 00:13:48,200
has disappeared from every affected device.
382
00:13:48,200 --> 00:13:49,680
Defender vulnerability management
383
00:13:49,680 --> 00:13:52,520
keeps checking the signals coming back from those devices.
384
00:13:52,520 --> 00:13:54,680
If a laptop state offline during the update,
385
00:13:54,680 --> 00:13:57,680
failed the install or still reports the old software version,
386
00:13:57,680 --> 00:13:59,080
the finding can remain open.
387
00:13:59,080 --> 00:14:01,400
That matters because it stops the team from closing work
388
00:14:01,400 --> 00:14:03,680
based only on a deployment report.
389
00:14:03,680 --> 00:14:05,960
When the affected device is no longer show the weakness,
390
00:14:05,960 --> 00:14:08,840
Defender can mark the remediation activity as completed.
391
00:14:08,840 --> 00:14:09,800
That is the proof you want.
392
00:14:09,800 --> 00:14:11,480
The device itself reports a change state
393
00:14:11,480 --> 00:14:12,760
and the exposure has cleared.
394
00:14:12,760 --> 00:14:14,320
You can also use the event timeline
395
00:14:14,320 --> 00:14:16,560
to see how the story changed over time.
396
00:14:16,560 --> 00:14:19,200
A new weakness appears, a recommendation is created,
397
00:14:19,200 --> 00:14:21,600
a remediation request is sent, devices update,
398
00:14:21,600 --> 00:14:23,880
the remaining exposed devices become easier to spot.
399
00:14:23,880 --> 00:14:26,320
It gives security teams, IT teams and auditors
400
00:14:26,320 --> 00:14:29,720
one shared record instead of several disconnected reports.
401
00:14:29,720 --> 00:14:32,200
The wider Microsoft 365 connection matters too.
402
00:14:32,200 --> 00:14:34,560
Intune manages device settings and compliance.
403
00:14:34,560 --> 00:14:36,160
Defender for endpoint detects threats
404
00:14:36,160 --> 00:14:37,640
and calculates device risk.
405
00:14:37,640 --> 00:14:39,760
EntraID uses those signals when somebody tries
406
00:14:39,760 --> 00:14:41,520
to access company services.
407
00:14:41,520 --> 00:14:44,320
Imagine a laptop that has a serious security problem
408
00:14:44,320 --> 00:14:46,640
and no longer meets your company's compliance rules.
409
00:14:46,640 --> 00:14:49,080
Intune can mark that device as non-compliant,
410
00:14:49,080 --> 00:14:51,160
then EntraID conditional access can stop it
411
00:14:51,160 --> 00:14:53,640
from opening SharePoint Teams or Exchange Online
412
00:14:53,640 --> 00:14:55,800
until the device returns to an acceptable state.
413
00:14:55,800 --> 00:14:57,320
The person still has an identity
414
00:14:57,320 --> 00:14:59,040
but the device does not get trusted access
415
00:14:59,040 --> 00:15:00,400
while it carries too much risk.
416
00:15:00,400 --> 00:15:02,120
That is a practical security control.
417
00:15:02,120 --> 00:15:04,040
It limits what a risky device can reach
418
00:15:04,040 --> 00:15:06,680
even while the IT team works on the full repair.
419
00:15:06,680 --> 00:15:08,360
Per view adds another piece of context.
420
00:15:08,360 --> 00:15:10,800
Per view helps identify and protect sensitive information
421
00:15:10,800 --> 00:15:13,080
such as finance records, customer data,
422
00:15:13,080 --> 00:15:14,440
or confidential files.
423
00:15:14,440 --> 00:15:17,000
In exposure management, a device that regularly handles
424
00:15:17,000 --> 00:15:20,040
highly sensitive data can receive higher criticality.
425
00:15:20,040 --> 00:15:21,520
That changes the order of work,
426
00:15:21,520 --> 00:15:23,600
the same weakness on a general meeting room PC
427
00:15:23,600 --> 00:15:25,920
and on a laptop used for sensitive finance documents
428
00:15:25,920 --> 00:15:28,280
should not automatically receive the same response.
429
00:15:28,280 --> 00:15:31,400
Think of Microsoft 365 as a connected office building.
430
00:15:31,400 --> 00:15:33,280
EntraID is the reception desk.
431
00:15:33,280 --> 00:15:34,520
It checks who is signing in
432
00:15:34,520 --> 00:15:35,960
and whether they should get through.
433
00:15:35,960 --> 00:15:37,480
Intune is the device manager.
434
00:15:37,480 --> 00:15:40,080
It keeps track of company laptops and applies their rules.
435
00:15:40,080 --> 00:15:42,200
Defender for endpoint is the security guard.
436
00:15:42,200 --> 00:15:44,720
It watches for threats and suspicious activity.
437
00:15:44,720 --> 00:15:46,280
Defender vulnerability management
438
00:15:46,280 --> 00:15:48,080
looks for the openings attackers might use
439
00:15:48,080 --> 00:15:49,560
before an attack begins.
440
00:15:49,560 --> 00:15:50,920
Per view is the records room.
441
00:15:50,920 --> 00:15:53,040
It knows which files need the most care.
442
00:15:53,040 --> 00:15:54,600
Each service has its own job,
443
00:15:54,600 --> 00:15:56,240
but they share useful signals.
444
00:15:56,240 --> 00:15:57,520
That means fewer blind spots
445
00:15:57,520 --> 00:16:00,280
and less time lost passing information between teams.
446
00:16:00,280 --> 00:16:03,120
You can see what remains open, who owns the work
447
00:16:03,120 --> 00:16:05,760
and whether the change actually reduced exposure.
448
00:16:05,760 --> 00:16:08,400
So how do you turn all of this into a simple routine?
449
00:16:08,400 --> 00:16:10,360
Your first vulnerability management routine.
450
00:16:10,360 --> 00:16:12,240
So here's the thing about vulnerability management.
451
00:16:12,240 --> 00:16:14,600
It's not about guessing which patches to apply
452
00:16:14,600 --> 00:16:16,240
or hoping you covered everything.
453
00:16:16,240 --> 00:16:18,800
Defender vulnerability management gives you a live view
454
00:16:18,800 --> 00:16:21,200
of what's actually exposed, what matters most
455
00:16:21,200 --> 00:16:22,880
and what still needs to be fixed.
456
00:16:22,880 --> 00:16:24,960
Let's break it down into a few simple steps.
457
00:16:24,960 --> 00:16:27,200
First, make sure your devices are onboarded
458
00:16:27,200 --> 00:16:28,400
to Defender for endpoint.
459
00:16:28,400 --> 00:16:29,720
Then check the discovery results
460
00:16:29,720 --> 00:16:32,200
for any devices that are sitting outside your managed list.
461
00:16:32,200 --> 00:16:33,760
Those are the ones you need to bring in.
462
00:16:33,760 --> 00:16:35,640
Next, review the top recommendations.
463
00:16:35,640 --> 00:16:37,280
But don't just look at severity ratings.
464
00:16:37,280 --> 00:16:39,480
Check exploit activity, device exposure
465
00:16:39,480 --> 00:16:41,760
and what role that device plays in the business.
466
00:16:41,760 --> 00:16:43,160
That tells you what to prioritize.
467
00:16:43,160 --> 00:16:45,720
Then create one tightly-scoped remediation request
468
00:16:45,720 --> 00:16:47,880
through Intune or your ticketing system.
469
00:16:47,880 --> 00:16:50,120
Finally, verify that the affected device
470
00:16:50,120 --> 00:16:53,200
is actually clear the finding and document any exceptions
471
00:16:53,200 --> 00:16:54,840
with a reason and an end date.
472
00:16:54,840 --> 00:16:56,520
That way nothing slips through the cracks.
473
00:16:56,520 --> 00:16:58,520
For the next knowledge nugget, we'll connect Defender
474
00:16:58,520 --> 00:17:01,640
for endpoint and Intune and show how device risk can control
475
00:17:01,640 --> 00:17:04,120
access to company data.
