Vulnerability Management
Use the Microsoft Defender Vulnerability Management dashboard to identify, prioritize, and remediate vulnerabilities across your device fleet.
Finding weaknesses before attackers do
Vulnerability Management is like a building inspector who never leaves.
Imagine hiring an inspector who walks through your office every single day — checking every window lock, every fire exit, every electrical panel. They don’t just hand you a list and leave. They rank every issue by how dangerous it is, tell you exactly what to fix first, and track whether your maintenance team actually fixed it.
That’s what Microsoft Defender Vulnerability Management does for your devices. It continuously scans every onboarded device for missing patches, risky configurations, outdated software, and known exploits — then prioritizes what matters most so your team doesn’t waste time on low-risk noise.
The TVM dashboard — your security posture at a glance
Elena opens the Vulnerability Management dashboard at MedGuard Health every morning. Here’s what she sees:
Exposure score
A numeric score from 0 to 100 representing your organization’s overall vulnerability exposure. Lower is better. The score factors in:
- Number of unpatched vulnerabilities across all devices
- Severity of those vulnerabilities (CVSS scores)
- Whether public exploits exist for those vulnerabilities
- How many devices are affected
Elena’s target: keep MedGuard Health’s exposure score below 30. Healthcare regulators expect documented evidence that vulnerabilities are tracked and remediated within defined SLAs.
Microsoft Secure Score for Devices
Separate from the organization-wide Secure Score, this measures how well your device fleet follows security best practices — enabled features, proper configurations, applied updates. Higher is better.
Key dashboard widgets
| Widget | What it shows | Why it matters |
|---|---|---|
| Top exposed devices | Devices with the highest number of critical/high vulnerabilities | Prioritize remediation on the riskiest devices first |
| Top vulnerable software | Applications with the most known CVEs across your fleet | Identifies software that creates the largest attack surface |
| Top security recommendations | Ranked actions that would most reduce your exposure score | Focus your team on high-impact remediation activities |
| Top remediation activities | Ongoing remediation tasks and their completion status | Track whether IT is actually patching what you requested |
Security recommendations — the prioritized fix list
This is where TVM translates raw vulnerability data into actionable work items. Each recommendation includes:
- Priority ranking — based on exposure impact, exploit availability, and affected device count
- Impact assessment — how many points your exposure score drops if you remediate
- Affected devices — exact count and list of devices with this vulnerability
- Related CVEs — linked vulnerability entries with severity and exploit status
- Remediation options — update software, apply configuration change, or request exception
Elena's prioritization workflow at MedGuard Health
Elena reviews security recommendations weekly with the IT operations team. Her workflow:
- Filter by “Exploit available” — vulnerabilities with known public exploits get immediate attention
- Sort by exposed devices — a critical CVE affecting 500 devices ranks higher than one affecting 5
- Check remediation type — software updates are straightforward; configuration changes may need change management
- Create remediation request — assigns the work to IT ops with a due date
- Track completion — monitors the remediation activity until all affected devices are patched
For healthcare compliance, Elena documents every remediation decision. When she grants an exception (a vulnerability she cannot patch due to medical device compatibility), she records the business justification and compensating controls.
Software inventory — what’s installed across your fleet
The software inventory page provides a complete view of every application detected on onboarded devices. For each application, you see:
- Publisher, version, and installation count
- Known vulnerabilities (CVE count by severity)
- End-of-life status (unsupported software flagged)
- Threat context (whether the software has been exploited in the wild)
This is particularly valuable for identifying shadow software — applications installed by users that IT didn’t approve. Elena regularly discovers unauthorized remote desktop tools and outdated Java runtimes on MedGuard Health workstations.
Browser extensions and certificates
MDVM also inventories:
- Browser extensions — identifies extensions with known vulnerabilities or excessive permissions
- Digital certificates — flags expiring or weak certificates across devices
These are often overlooked attack vectors. A vulnerable browser extension with access to all browsing data is a serious risk that traditional vulnerability scanners miss entirely.
Weaknesses page — the CVE library
The weaknesses page lists every CVE detected across your environment. For each CVE:
| Field | Description |
|---|---|
| CVE ID | The standard vulnerability identifier (e.g., CVE-2024-12345) |
| Severity | CVSS-based severity rating — Critical, High, Medium, Low |
| Exposed devices | Number of devices in your environment affected by this CVE |
| Exploit available | Whether a public exploit exists — massively increases real-world risk |
| Threat insights | Active exploitation campaigns, malware families using this CVE |
| Age | How long the CVE has been known — older unpatched CVEs indicate remediation gaps |
Exam tip: Exposure score vs Secure Score for Devices
Don’t confuse these two metrics:
- Exposure score (0-100) — measures vulnerability exposure. Lower is better. Driven by unpatched CVEs and risky configurations.
- Secure Score for Devices — measures security posture. Higher is better. Driven by enabled security features and applied best practices.
The exam may describe a scenario and ask which score is affected by a particular action. Patching a critical vulnerability reduces the exposure score. Enabling ASR rules improves the Secure Score for Devices.
Remediation activities — tracking the fix
When Elena creates a remediation request from a security recommendation, it becomes a remediation activity — a tracked work item with:
- Due date — the SLA for completing remediation
- Assigned to — the IT team or individual responsible
- Status — Not started, In progress, Completed
- Device progress — how many of the affected devices have been patched
- Exception option — if remediation is impossible (legacy medical device, vendor dependency), grant a time-limited exception with documented justification
Remediation vs exception
| Feature | Remediation Request | Exception |
|---|---|---|
| Purpose | Fix the vulnerability | Accept the risk temporarily |
| Effect on exposure score | Reduces score when completed | No change to score |
| Tracking | Tracks patch deployment progress per device | Tracks exception expiry date |
| When to use | Standard software updates, configuration changes | Legacy systems, vendor dependencies, pending vendor patch |
| Requires justification | false | true |
| Time-limited | Has due date but can extend | Mandatory expiry — must re-evaluate |
Knowledge check
Elena reviews the TVM dashboard at MedGuard Health and sees a critical security recommendation: 'Update Google Chrome to version 124.0.6367.91 — 2,400 devices affected — exploit available.' She creates a remediation request with a 7-day SLA. Three days later, 1,800 devices are patched but 600 clinical workstations cannot update due to a compatibility issue with a medical imaging plugin. What should Elena do for the remaining 600 devices?
Marcus is explaining the TVM dashboard to Oakwood Financial's CISO. The CISO asks: 'Our exposure score is 45 and our Secure Score for Devices is 62. Which one should I focus on improving first?' What is the correct advice?
Dev is auditing a client's TVM software inventory and discovers that 300 devices have an end-of-life version of Adobe Reader installed — the version has 47 known CVEs, including 12 critical ones with public exploits. The client says they cannot upgrade because a legacy PDF workflow depends on this specific version. What is the recommended approach?
🎬 Video coming soon
Next up: Defender for Cloud Apps: Connect and Govern — discover shadow IT and govern cloud application usage across your organization.