Vulnerability Management

1 MDE TVM Assessment

Microsoft Defender Vulnerability Management (TVM) provides continuous vulnerability discovery, intelligent prioritization, and remediation tracking across your endpoint fleet. Follow this procedure to perform a comprehensive TVM assessment.

TVM Assessment Procedure

1. Navigate to Microsoft 365 Defender portal → Vulnerability Management → Dashboard
2. Review current Exposure Score (0-100, lower is better) and trending direction
3. Review Device Exposure Distribution (Critical, High, Medium, Low)
4. Check top security recommendations sorted by impact
5. Review recently discovered vulnerabilities (CVEs) in the "Weaknesses" tab
6. Identify devices with most critical vulnerabilities using "Exposed Devices"
7. Generate vulnerability assessment report for management review

2 Vulnerability Exposure KQL Queries

The following KQL queries support vulnerability assessment and exposure analysis workflows. Run these in Microsoft 365 Defender Advanced Hunting to identify, prioritize, and track vulnerabilities across your endpoint fleet.

All Critical Vulnerabilities on Exposed Devices

DeviceTvmSoftwareVulnerabilities
| where VulnerabilitySeverityLevel == "Critical"
| summarize AffectedDevices = dcount(DeviceId),
            DeviceNames = make_set(DeviceName, 10),
            AffectedSoftware = make_set(SoftwareName)
    by CveId, VulnerabilitySeverityLevel
| sort by AffectedDevices desc
| take 25

Devices with Most Vulnerabilities

DeviceTvmSoftwareVulnerabilities
| summarize CriticalCount = countif(VulnerabilitySeverityLevel == "Critical"),
            HighCount = countif(VulnerabilitySeverityLevel == "High"),
            MediumCount = countif(VulnerabilitySeverityLevel == "Medium"),
            TotalVulns = count()
    by DeviceName, DeviceId
| extend RiskScore = (CriticalCount * 10) + (HighCount * 5) + (MediumCount * 1)
| sort by RiskScore desc
| take 20

Specific CVE Exposure Check

let targetCVE = "CVE-2024-12345";
DeviceTvmSoftwareVulnerabilities
| where CveId == targetCVE
| join kind=leftouter (
    DeviceInfo
    | where Timestamp > ago(1d)
    | summarize arg_max(Timestamp, *) by DeviceId
) on DeviceId
| project DeviceName, OSPlatform, OSVersion, SoftwareName,
         SoftwareVersion, VulnerabilitySeverityLevel, MachineGroup,
         PublicIP, LoggedOnUsers
| sort by DeviceName asc

Vulnerable Software Inventory

DeviceTvmSoftwareVulnerabilities
| join kind=inner (
    DeviceTvmSoftwareInventory
    | summarize DeviceCount = dcount(DeviceId) by SoftwareName, SoftwareVersion
) on SoftwareName
| summarize VulnCount = dcount(CveId),
            CriticalVulns = dcountif(CveId, VulnerabilitySeverityLevel == "Critical"),
            DevicesAffected = dcount(DeviceId)
    by SoftwareName, SoftwareVersion
| sort by CriticalVulns desc, VulnCount desc
| take 30

End-of-Life Software Detection

DeviceTvmSoftwareInventory
| where EndOfSupportStatus != "None" and EndOfSupportStatus != ""
| summarize DeviceCount = dcount(DeviceId),
            Devices = make_set(DeviceName, 10),
            Versions = make_set(SoftwareVersion)
    by SoftwareName, EndOfSupportStatus, EndOfSupportDate
| sort by DeviceCount desc

Vulnerability Age Analysis

DeviceTvmSoftwareVulnerabilities
| where VulnerabilitySeverityLevel in ("Critical", "High")
| extend VulnAge = datetime_diff('day', now(), todatetime(CvePublishedDate))
| summarize AvgAge = avg(VulnAge),
            MaxAge = max(VulnAge),
            VulnCount = count()
    by VulnerabilitySeverityLevel
| extend AvgAgeDays = round(AvgAge, 0), MaxAgeDays = round(MaxAge, 0)
| project VulnerabilitySeverityLevel, VulnCount, AvgAgeDays, MaxAgeDays

Devices Missing Security Updates

DeviceTvmSecureConfigurationAssessment
| where ConfigurationId has "scid-91"
| where IsCompliant == 0
| where IsApplicable == 1
| summarize NonCompliantCount = count()
    by DeviceName, ConfigurationId, ConfigurationName
| sort by NonCompliantCount desc
| take 30

Browser Extension Risk Assessment

DeviceTvmBrowserExtensions
| summarize DeviceCount = dcount(DeviceId),
            BrowserTypes = make_set(BrowserName)
    by ExtensionName, ExtensionId, ExtensionVersion
| where DeviceCount > 5
| sort by DeviceCount desc
| take 30

Remediation Progress Tracking

DeviceTvmSoftwareVulnerabilities
| where VulnerabilitySeverityLevel in ("Critical", "High")
| summarize
    TotalVulns = count(),
    CriticalVulns = countif(VulnerabilitySeverityLevel == "Critical"),
    HighVulns = countif(VulnerabilitySeverityLevel == "High"),
    AffectedDevices = dcount(DeviceId),
    UniqueCVEs = dcount(CveId)
| extend Summary = strcat("Total: ", TotalVulns, " vulns (", CriticalVulns, " Critical, ", HighVulns, " High) across ", AffectedDevices, " devices")

3 Patch Prioritization

Follow this decision tree to determine the appropriate patch priority and remediation timeline for each newly identified vulnerability. This ensures consistent, risk-based prioritization across the team.

• New Vulnerability Identified — Begin Prioritization
  • Is the vulnerability actively exploited in the wild (KEV list / vendor advisory)?
    • CRITICAL priority: Patch within 24-48 hours. Activate emergency change process. Notify security leadership immediately.
    • Continue
      • Is there a public exploit available (Exploit-DB, GitHub)?
        • HIGH priority: Patch within 7 days. Schedule priority deployment in next available maintenance window.
        • Continue
          • Is the CVSS score ≥ 9.0?
            • HIGH priority: Patch within 14 days. Include in next scheduled patch cycle.
            • Continue
              • Is the affected asset internet-facing or business-critical?
                • Increase priority by one level. Internet-facing and business-critical assets have higher exposure and impact.
                • Continue to CVSS-based prioritization
                  • Apply CVSS-based remediation timeline:
                    • CVSS 7.0-8.9 — MEDIUM: Patch within 30 days via standard patch cycle.
                    • CVSS 4.0-6.9 — LOW: Patch within 90 days in regular maintenance.
                    • CVSS 0.1-3.9 — MINIMAL: Patch in next available maintenance window.

4 Risk Scoring and Classification

Use this composite risk scoring model to calculate a consistent, weighted risk score for each vulnerability. The model considers multiple factors beyond CVSS to provide a more accurate representation of actual risk to the organization.

Risk Scoring Model

Risk Classification Matrix

5 Remediation Tracking

A structured remediation workflow ensures vulnerabilities progress from identification through to verified resolution. Follow this end-to-end process for each vulnerability or batch of vulnerabilities identified.

Remediation Workflow

1. Vulnerability identified via TVM or scanning
2. Risk assessed and prioritized using scoring model
3. Remediation ticket created with SLA based on priority
4. Ticket assigned to responsible team (IT Ops, App Team, etc.)
5. Patch/fix applied per change management process
6. Verification scan performed to confirm remediation
7. Ticket closed with evidence of remediation

Dashboard Metrics

6 Exception and Risk Acceptance

When a vulnerability cannot be remediated within its SLA due to business, technical, or operational constraints, a formal risk acceptance process must be followed. All exceptions require documented justification, compensating controls, and appropriate approval authority.

Risk Acceptance Form

EXCEPTION ID:           [EXC-YYYY-NNNN]
VULNERABILITY:          [CVE ID and description]
AFFECTED ASSETS:        [Device names/count]
BUSINESS JUSTIFICATION: [Why the vulnerability cannot be remediated]
COMPENSATING CONTROLS:  [Controls mitigating the risk]
RISK LEVEL:             [Critical/High/Medium/Low]
REQUESTED DURATION:     [Days/months]
REQUESTED BY:           [Name and role]
APPROVED BY:            [Must meet authority level per table below]
REVIEW DATE:            [Mandatory review date]

Approval Authority

Exception Process Checklist

7 Software Inventory Management

Maintaining an accurate software inventory is essential for vulnerability management. TVM provides continuous discovery of software installed across the fleet, enabling identification of unauthorized, outdated, or end-of-life applications.

Software Inventory Procedure

1. Access TVM → Software Inventory in Microsoft 365 Defender
2. Review software catalog for unauthorized or unexpected applications
3. Cross-reference with approved software list (CMDB)
4. Flag unauthorized software for removal or approval review
5. Identify end-of-life software for migration planning
6. Track software version distribution to identify outdated installations
7. Generate software inventory report for compliance

Shadow IT Detection

8 Security Recommendations Review

Microsoft Defender TVM generates actionable security recommendations based on the configuration and vulnerability state of your fleet. Regularly reviewing and implementing these recommendations reduces your overall exposure score and hardens the environment.

Recommendations Review Procedure

1. Navigate to TVM → Security Recommendations
2. Sort by "Exposure Impact" to prioritize high-impact items
3. Review recommendation details: affected devices, remediation steps, expected impact
4. Categorize: Security Controls, OS Configuration, Application Configuration
5. Assign remediation owners based on recommendation type
6. Create implementation tickets with SLA aligned to priority
7. Track implementation progress weekly
8. Mark recommendations as completed in TVM after implementation

Recommendation Priority

Recommendations Review Checklist