Microsoft Defender Vulnerability Management: Prioritizing What Actually Gets Exploited
Exposure score over CVSS panic: use exploit availability, exposure value and remediation requests to patch the tiny fraction of CVEs that get exploited.
C
CloudEngineerHub Team
Published: September 25, 2026· Last Updated: September 28, 2026·9 min read
Defender Vulnerability Management: Prioritize What Actually Gets Exploited
Every estate has thousands of CVEs at any moment and the capacity to remediate a few dozen per week. Defender Vulnerability Management (TVM) exists to make that triage rational: it inventories software and configurations agentlessly from the Defender for Endpoint sensor, scores exposure, and — more importantly — tells you which findings have public exploits, active exploitation, or sit on your highest-value machines. The teams that get value from TVM are not the ones that patch the most CVEs; they're the ones that patch the right ones first and can prove the decision trail.
Visual Walkthrough
C
CloudEngineerHub Team
Author
The CloudEngineerHub editorial team — Microsoft endpoint management and cloud engineers writing hands-on guides on Intune, Azure, Entra ID, Autopilot, Defender and PowerShell. Every article is reviewed against current Microsoft documentation.
TVM ranks by exploitability, not just CVSS — follow the queue.
Interactive FlowVulnerability Management — Exposure to Patch6/6
1
Exposure collected
Sensors report CVEs, misconfigs, weak ciphers.
score
2
Exposure score computed
Device-level exposure ranks the fleet.
prioritize
3
Exploitability weighed
In-the-wild exploits + assets-criticality reorder the list.
recommend
4
Security recommendation
Actionable fixes with affected-device counts.
remediate
5
Patch + verify
KB deployment via WUfB/Intune; rescoring confirms.
6
Trend tracked
Exposure score trend proves the program works.
Vulnerability Management — Exposure to Patch. 1. Exposure collected: Sensors report CVEs, misconfigs, weak ciphers. — 2. Exposure score computed: Device-level exposure ranks the fleet. — 3. Exploitability weighed: In-the-wild exploits + assets-criticality reorder the list. — 4. Security recommendation: Actionable fixes with affected-device counts. — 5. Patch + verify: KB deployment via WUfB/Intune; rescoring confirms. — 6. Trend tracked: Exposure score trend proves the program works.
Prerequisites
Licensing: Core TVM is included with Microsoft Defender for Endpoint Plan 2 (e.g., Microsoft 365 E5). Premium MDVM capabilities — security baselines assessment, block vulnerable software, browser extension management — require the MDVM add-on or MDVM standalone licensing. Confirm current scope on Microsoft Learn before budgeting.
Onboarding: Devices reporting to Defender for Endpoint via Intune, GPO, or script; the sensor does the discovery, so an un-onboarded device is invisible to TVM.
Permissions: Security Administrator or the TVM-specific roles in the Defender portal; Security Reader for read-only dashboards.
For the Intune integration: the Defender Vulnerability Management connector configured in the Intune admin center, with Intune admin roles mapped to the vulnerabilities data.
Advanced hunting access (Defender portal) for the queries below.
Two scores, two jobs
TVM's dashboard leads with numbers that are easy to misread:
Metric
Range
What it measures
Use it for
Exposure score
0–900
Dynamic vulnerability exposure across devices, weighted by severity and exploitability
Trending risk over time; the number for leadership
Microsoft Secure Score for Devices
0–100
Compliance with security controls (antivirus state, configuration hygiene)
Engineering checklist for hardening gaps
Device value / exposure value
High / Normal / Low (plus computed)
Importance of the asset to the business
Deciding which of two equal CVEs gets patched first
Exposure score is a relative, rolling measure — it moves when you patch, when new CVEs drop, and when exploit intelligence changes. Do not promise the board an absolute target; promise a trend and the actions behind it. Secure Score for Devices, by contrast, is a checklist score: if it's flat while exposure moves, your problem is vulnerabilities, not configuration.
Field note: Device value tags are the cheapest prioritization lever in the whole product. An hour of tagging domain controllers, CA servers, and finance-critical workstations as High value reshapes every later recommendation — and it's the first thing an auditor asks you to demonstrate.
Prioritization signals that beat CVSS
Exploit availability is the signal
A CVE rated 9.8 with no public exploit is usually less urgent than a 7.5 with a working exploit chain. TVM annotates every vulnerability with exploitation intelligence:
Publicly disclosed — details exist; PoC likely within days.
Exploit kit / verified exploit — weaponized; patch this cycle.
Actively exploited (aligned with sources like CISA's Known Exploited Vulnerabilities catalog) — drop everything else; these are the entries that show up in incident reports.
Filter the vulnerability list by exploitation status first, severity second. A weekly query for "newly actively exploited CVEs present in our estate" is the highest-value ten minutes in patch operations.
Exposure value and the shape of your estate
TVM computes exposure per device but also rolls exposure up by device group, OS platform, and RBAC group. Use the "top exposed devices" and "weakest link" views to find concentrations: twenty developer laptops running the same vulnerable package matter more than one server in a locked VLAN, because the exploit economics favor the twenty. Conversely, one exposed internet-facing appliance with a verified exploit outranks all twenty — that's what device value plus exploit signals is for.
From finding to fix: remediation requests
TVM's remediation requests turn findings into tracked work instead of screenshots in a chat:
On a vulnerable software or CVE page, create a remediation request with a due date and justification.
Assign it to the owning admin group (Windows server team, endpoint team, app owners).
Track state — pending, in progress, completed, deferred — on the remediation tab; the request keeps the paper trail for audits.
The Intune handoff
With the Defender Vulnerability Management–Intune integration, vulnerability data appears in the Intune admin center and remediation requests can be routed to the team that actually owns update deployment. The practical pattern: TVM decides what and by when; Intune executes how — security updates through Windows Update for Business rings, third-party software through Win32 app supersession or your patching tool. Keep the authority split explicit in your runbook: security admins raise and prioritize, endpoint admins schedule and report back.
Exceptions without lying to yourself
Not everything gets patched, and pretending otherwise corrupts the data. Use TVM's exception workflow: request an exception with a reason (no vendor fix yet, mitigation in place, system decommission pending), get approval from the risk owner, and set an expiration date. Expired exceptions resurface automatically — that mechanism is the difference between a register and a graveyard.
Field note: The exception that says "accepted risk: business critical" with no owner and no expiry is the artifact every post-incident review finds. Exceptions are liabilities; date them like certificates.
Feeding patch rings with vulnerability data
The strongest integration is cultural: patch cadence decisions get made against TVM queries, not against vendor advisories. Two habits to institutionalize:
A weekly exploited-CVE watchlist. Anything actively exploited and present in the estate becomes this week's mandatory item, pushed through ring 0/1 immediately, with ring rollout accelerated for the rest.
Severity-to-ring mapping. Routine critical/high OS updates follow your normal WUfB deferral rings; findings tied to exploited CVEs or high-value devices bypass deferrals. Document the mapping so "why did this ship out-of-band?" has a written answer.
The advanced hunting tables make this mechanical:
KQL
1
2
3
4
5
6
7
// Devices with actively-pressing CVEs, grouped for remediation queues
DeviceTvmSoftwareVulnerabilities
| where VulnerabilitySeverityLevel in ("Critical", "High")
| summarize AffectedDevices = dcount(DeviceId),
Devices = make_set(DeviceName, 10)
by CveId, RecommendedSecurityUpdateId, OSPlatform
| order by AffectedDevices desc
Pair it with DeviceTvmSoftwareInventory to answer "which machines still run version X" in seconds — the question that consumes a full day when answered by SCCM collection folklore.
The KB-level view: who is missing what
Severity lists decide what to patch; the KB rollup decides how many rings to push. RecommendedSecurityUpdateId on each vulnerability row is the exact KB your WUfB deployment targets, so the same data drives both conversations:
KQL
1
2
3
4
5
6
// Patch gap: counts of devices missing each recommended update
DeviceTvmSoftwareVulnerabilities
| where isnotempty(RecommendedSecurityUpdateId)
| summarize MissingDevices = dcount(DeviceId)
by RecommendedSecurityUpdateId, VulnerabilitySeverityLevel
| order by MissingDevices desc
When a mandatory item ships, rerun the query daily — the falling count is your deployment's real progress bar, and the stragglers on day five are a targeted reassignment, not a mystery.
Shorten the window, don't just close it
Premium MDVM capability adds a lever between "exploited CVE published" and "patch deployed": block vulnerable software. For the exploited-in-the-wild case, blocking execution of the vulnerable version with a Defender block page buys the patch ring time it needs without exposing users — release the block as the update lands per ring. Used sparingly (it is a availability trade), it converts your worst week of the quarter into a scheduled event.
For the executive layer, export the exposure score trend and the count of actively-exploited findings over time; two lines on one chart tell the whole year's story without a slide deck.
Visual Walkthrough
Every security control on this site maps to one of these five layers.
Layered StackDefense in Depth — Five Aligned Layers6/6
Firewall rules, tunnel, private endpoints segment the path.
layer 4
5
Data
DLP, sensitivity labels, immutable storage protect the crown.
layer 5
6
Assume breach
Each layer assumes the previous one failed — detection everywhere.
posture
Each layer assumes the previous one failed — depth is the strategy.
Defense in Depth — Five Aligned Layers. 1. Identity: Phishing-resistant MFA, PIM, conditional access gate everything. — 2. Endpoint: Compliance, EDR sensors, ASR, WDAC, encryption at the device. — 3. Application: Safe Links, app control, least-privilege app consents. — 4. Network: Firewall rules, tunnel, private endpoints segment the path. — 5. Data: DLP, sensitivity labels, immutable storage protect the crown. — 6. Assume breach: Each layer assumes the previous one failed — detection everywhere.
Reporting cadence that survives contact with reality
A cadence only works if each meeting has one decision to make:
Weekly (30 min, security + endpoint teams): new actively exploited CVEs in the estate, overdue remediation requests, expired exceptions. Output: this week's mandatory patch list.
Monthly (60 min, with IT leadership): exposure score trend, ring health (did the mandatory items actually deploy?), exception approvals with expiries. Output: signed exceptions and any resourcing asks.
Quarterly: top-ten software inventory cleanup — every application nobody can name an owner for is both a patching gap and an attack surface. Output: decommission list.
Everything else is noise. The remediation request states, the advanced hunting exports, and the exposure trend are your evidence trail; screenshots of CVE lists are not.
Key takeaways
TVM ships with Defender for Endpoint Plan 2; premium features (security baselines assessment, block vulnerable software, extension management) need MDVM add-on or standalone licensing.
Exposure score (0–900) is your trend metric; Secure Score for Devices (0–100) is your configuration checklist — don't merge them in reporting.
Prioritize by exploitation status first, severity second; actively exploited findings bypass your normal ring cadence by design.
Tag high-value devices — it reorders every recommendation for an hour of work.
Remediation requests create the audit trail; the Intune integration splits authority cleanly: security decides what and when, endpoint teams execute how.
Exceptions must have owners and expiry dates, or they become the post-incident exhibit.
Weekly exploited-CVE watchlist plus severity-to-ring mapping turns TVM data into patch behavior — the only outcome that matters.
Frequently asked questions
Do we still need a vulnerability scanner like Nessus?
For network-adjacent and appliance coverage, often yes — TVM sees what the MDE sensor sees, which is primarily managed Windows, macOS, Linux, and mobile endpoints. Use TVM as the endpoint source of truth and your network scanner for devices without a sensor; reconcile the two lists quarterly.
Why does exposure score move when we didn't change anything?
New CVEs, new exploit intelligence, or a device group change recompute exposure. It's a relative, dynamic measure — schedule a monthly screenshot habit only after you've explained to leadership that a rise isn't always a regression.
Can we block a vulnerable application version until it's patched?
Yes — "block vulnerable software" is one of the premium MDVM capabilities: Defender can block execution of specific vulnerable versions with a block page, then release the block once remediation completes. Use it for the short window between "exploited in the wild" and "patch deployed," not as a permanent substitute for patching.
Comments
0No comments yet — be the first to share your thoughts.