1 00:00:00,000 --> 00:00:03,760 Welcome to another episode of Microsoft Knowledge Nuggets here on M365. 2 00:00:03,760 --> 00:00:05,640 FM, I'm your host, Mirko Peters. 3 00:00:05,640 --> 00:00:08,160 Today's topic is vulnerability management. 4 00:00:08,160 --> 00:00:10,120 And it's one of those terms almost everyone has heard, 5 00:00:10,120 --> 00:00:11,720 but most people don't really understand. 6 00:00:11,720 --> 00:00:14,000 Most people hear vulnerability management and think, 7 00:00:14,000 --> 00:00:16,800 "That's the monthly scan, then we install updates." 8 00:00:16,800 --> 00:00:19,120 That's not wrong, but it misses the hard part. 9 00:00:19,120 --> 00:00:21,240 A scan can give you a list of CVEs, 10 00:00:21,240 --> 00:00:24,080 those public labels for known software weaknesses. 11 00:00:24,080 --> 00:00:25,960 But when you have hundreds or thousands of results, 12 00:00:25,960 --> 00:00:28,160 the real question isn't, "What can we patch?" 13 00:00:28,160 --> 00:00:30,040 It's, "What should we fix first?" 14 00:00:30,040 --> 00:00:31,800 Think of your company like an office building. 15 00:00:31,800 --> 00:00:34,320 You've got front doors, side doors, windows, locks, 16 00:00:34,320 --> 00:00:36,480 and maybe an old storage room, nobody remembers. 17 00:00:36,480 --> 00:00:38,920 Microsoft Defender vulnerability management 18 00:00:38,920 --> 00:00:41,360 is like a security guard walking through that building. 19 00:00:41,360 --> 00:00:44,720 It spots weak locks, tells you which entrance creates the most risk, 20 00:00:44,720 --> 00:00:46,520 sends the repair job to the right team, 21 00:00:46,520 --> 00:00:48,840 and then checks that the lock actually got fixed. 22 00:00:48,840 --> 00:00:50,480 By the end of this knowledge nugget, 23 00:00:50,480 --> 00:00:54,360 you'll understand discovery, priority, remediation, and proof, 24 00:00:54,360 --> 00:00:55,520 all in plain English. 25 00:00:55,520 --> 00:00:58,120 Because one unmanaged laptop or one old browser 26 00:00:58,120 --> 00:01:00,040 can still leave a route into the building. 27 00:01:00,040 --> 00:01:03,440 So let's start with why a patch list on its own often fails. 28 00:01:03,440 --> 00:01:04,920 Here's the thing about a patch list. 29 00:01:04,920 --> 00:01:05,760 It's just a list. 30 00:01:05,760 --> 00:01:07,640 It doesn't tell you what to do. 31 00:01:07,640 --> 00:01:08,560 The problem. 32 00:01:08,560 --> 00:01:10,800 Too many warnings, too little direction. 33 00:01:10,800 --> 00:01:13,760 For a long time, vulnerability work followed a familiar pattern. 34 00:01:13,760 --> 00:01:16,040 A team ran a scan every month or every quarter. 35 00:01:16,040 --> 00:01:18,120 Someone exported the results into a spreadsheet, 36 00:01:18,120 --> 00:01:20,400 another person compared that sheet with a patch report, 37 00:01:20,400 --> 00:01:22,960 and then emails started flying between security, 38 00:01:22,960 --> 00:01:26,760 desktop support, server teams, and application owners. 39 00:01:26,760 --> 00:01:29,520 The list got longer, the work became harder to track, 40 00:01:29,520 --> 00:01:31,640 and the business still needed one answer. 41 00:01:31,640 --> 00:01:33,600 What creates the most risk right now? 42 00:01:33,600 --> 00:01:34,840 And that's a real problem. 43 00:01:34,840 --> 00:01:37,240 That's the difference between patch management and vulnerability 44 00:01:37,240 --> 00:01:37,920 management. 45 00:01:37,920 --> 00:01:39,920 Patch management is about applying repairs. 46 00:01:39,920 --> 00:01:43,040 You update Windows, you update Chrome, you remove old software. 47 00:01:43,040 --> 00:01:46,360 Vulnerability management decides which repair should happen first, 48 00:01:46,360 --> 00:01:48,480 who needs to do it, how urgent it is, 49 00:01:48,480 --> 00:01:50,880 and whether the repair actually worked when it was done. 50 00:01:50,880 --> 00:01:53,240 That decision matters because not every warning 51 00:01:53,240 --> 00:01:54,600 deserves the same response. 52 00:01:54,600 --> 00:01:57,520 A CVE is a public reference number for a known weakness. 53 00:01:57,520 --> 00:01:59,240 Think of it like a product recall number. 54 00:01:59,240 --> 00:02:02,440 It tells you a problem exists in a certain version of software, 55 00:02:02,440 --> 00:02:04,920 but it doesn't automatically tell you whether that problem 56 00:02:04,920 --> 00:02:07,080 puts your company in immediate danger. 57 00:02:07,080 --> 00:02:09,480 You might see a very high severity CVE on software 58 00:02:09,480 --> 00:02:12,560 that sits on an isolated test device, isn't in use, 59 00:02:12,560 --> 00:02:14,200 and can't reach anything important. 60 00:02:14,200 --> 00:02:16,600 At the same time, you might find a lower rated weakness 61 00:02:16,600 --> 00:02:19,560 on a finance laptop that connects to sensitive files every day. 62 00:02:19,560 --> 00:02:21,800 If attackers are actively using that weakness, 63 00:02:21,800 --> 00:02:24,000 the finance laptop becomes the bigger problem. 64 00:02:24,000 --> 00:02:26,360 Severity is useful, but it isn't the full picture. 65 00:02:26,360 --> 00:02:28,560 You need to know the context around each weakness. 66 00:02:28,560 --> 00:02:31,960 Imagine your company has 500 laptops with Google Chrome installed. 67 00:02:31,960 --> 00:02:34,880 A new Chrome update comes out and defender shows a known weakness 68 00:02:34,880 --> 00:02:36,280 in an older version. 69 00:02:36,280 --> 00:02:39,240 At first glance, you might think every one of those 500 devices 70 00:02:39,240 --> 00:02:41,000 needs the same urgent treatment. 71 00:02:41,000 --> 00:02:42,200 But then you look closer. 72 00:02:42,200 --> 00:02:44,240 Most of the laptops belong to office staff 73 00:02:44,240 --> 00:02:46,960 sit behind normal protections and will receive the update 74 00:02:46,960 --> 00:02:48,560 during the next managed window. 75 00:02:48,560 --> 00:02:51,680 One laptop belongs to someone who handles finance records, 76 00:02:51,680 --> 00:02:54,280 travels often, connects from public networks, 77 00:02:54,280 --> 00:02:57,400 and has an active alert linked to suspicious activity. 78 00:02:57,400 --> 00:02:59,440 Same browser issue, very different situation. 79 00:02:59,440 --> 00:03:02,560 That is why vulnerability management needs business context. 80 00:03:02,560 --> 00:03:04,320 Is the device exposed to the internet? 81 00:03:04,320 --> 00:03:06,000 Is there a public exploit available? 82 00:03:06,000 --> 00:03:07,920 Has Microsoft seen related threat activity? 83 00:03:07,920 --> 00:03:09,400 How many devices have the issue? 84 00:03:09,400 --> 00:03:11,120 Does the device hold sensitive data? 85 00:03:11,120 --> 00:03:13,320 Is it a normal workstation, a server, or a system 86 00:03:13,320 --> 00:03:15,160 people rely on to run the business? 87 00:03:15,160 --> 00:03:18,160 Without those answers, teams often patch by panic. 88 00:03:18,160 --> 00:03:20,240 They started the top of a severity list, 89 00:03:20,240 --> 00:03:23,160 rush changes into production, and sometimes interrupt 90 00:03:23,160 --> 00:03:26,640 a business system that had little real exposure. 91 00:03:26,640 --> 00:03:29,760 Meanwhile, the weakness and attacker can actually use stays open. 92 00:03:29,760 --> 00:03:31,600 Microsoft Defender Vulnerability Management 93 00:03:31,600 --> 00:03:34,480 helps turn that noisy list into a clearer order of work. 94 00:03:34,480 --> 00:03:36,520 But before Defender can rank a weakness, 95 00:03:36,520 --> 00:03:38,440 it needs to answer a more basic question. 96 00:03:38,440 --> 00:03:40,800 What devices and software do you actually have? 97 00:03:40,800 --> 00:03:42,560 That sounds simple, but you'd be surprised 98 00:03:42,560 --> 00:03:44,560 how many organizations don't know. 99 00:03:44,560 --> 00:03:47,360 Discovery, finding what you don't know you have. 100 00:03:47,360 --> 00:03:49,400 Microsoft Defender Vulnerability Management 101 00:03:49,400 --> 00:03:51,440 is the part of Defender that tracks weaknesses 102 00:03:51,440 --> 00:03:53,160 across your devices over time. 103 00:03:53,160 --> 00:03:55,640 It watches for outdated software, missing updates, 104 00:03:55,640 --> 00:03:58,480 unsafe settings, and other gaps that could let an attacker in. 105 00:03:58,480 --> 00:04:00,640 This isn't like running one scan, saving a report, 106 00:04:00,640 --> 00:04:02,760 and hoping nothing changes before the next check. 107 00:04:02,760 --> 00:04:04,480 Defender for endpoint collects signals 108 00:04:04,480 --> 00:04:06,240 from devices you've unborted. 109 00:04:06,240 --> 00:04:08,480 Those signals tell Defender what operating system 110 00:04:08,480 --> 00:04:10,040 is running, what software is installed, 111 00:04:10,040 --> 00:04:13,160 which versions are there, and where known weaknesses might live. 112 00:04:13,160 --> 00:04:14,400 The picture changes constantly 113 00:04:14,400 --> 00:04:16,200 because your environment changes constantly. 114 00:04:16,200 --> 00:04:19,400 Someone installs a browser extension, a device misses an update, 115 00:04:19,400 --> 00:04:21,320 a certificate gets close to expiry, 116 00:04:21,320 --> 00:04:23,240 a new software weakness becomes public. 117 00:04:23,240 --> 00:04:25,160 Instead of waiting for a spreadsheet review, 118 00:04:25,160 --> 00:04:28,280 Defender keeps that information connected to the devices it sees. 119 00:04:28,280 --> 00:04:30,000 That ongoing view starts with a question 120 00:04:30,000 --> 00:04:31,280 you might not want to ask. 121 00:04:31,280 --> 00:04:34,000 Do you actually know every device connected to your company network? 122 00:04:34,000 --> 00:04:36,200 Most companies think they do until they look. 123 00:04:36,200 --> 00:04:39,560 Defender device discovery uses the devices you already managed 124 00:04:39,560 --> 00:04:42,920 with Defender for endpoint to notice other devices nearby. 125 00:04:42,920 --> 00:04:45,200 A managed laptop sees network activity around it 126 00:04:45,200 --> 00:04:47,960 and reports that an unknown endpoint or network device exists 127 00:04:47,960 --> 00:04:49,240 that might be another computer. 128 00:04:49,240 --> 00:04:51,440 It might be a printer, a router, or a device 129 00:04:51,440 --> 00:04:53,880 somebody connected without going through normal setup. 130 00:04:53,880 --> 00:04:55,600 Picture a small company office. 131 00:04:55,600 --> 00:04:57,800 The IT team has a list of company laptops 132 00:04:57,800 --> 00:05:00,120 and all of them appear in intune and Defender. 133 00:05:00,120 --> 00:05:02,360 Then device discovery notices an old test server 134 00:05:02,360 --> 00:05:03,560 in a corner of the network. 135 00:05:03,560 --> 00:05:05,400 Nobody owns it now, but it still runs. 136 00:05:05,400 --> 00:05:07,040 It also notices the reception PC 137 00:05:07,040 --> 00:05:08,760 that never moved to the new management system, 138 00:05:08,760 --> 00:05:10,000 a printer with old firmware 139 00:05:10,000 --> 00:05:12,400 and a personal laptop connected to the office Wi-Fi. 140 00:05:12,400 --> 00:05:14,920 None of those devices showed up in the normal reports. 141 00:05:14,920 --> 00:05:15,920 But they were still there. 142 00:05:15,920 --> 00:05:17,720 That difference is worth slowing down for. 143 00:05:17,720 --> 00:05:20,640 Device inventory shows the devices Defender knows and manages. 144 00:05:20,640 --> 00:05:23,040 You can look at details like the operating system, 145 00:05:23,040 --> 00:05:26,680 security state, installed software, and related findings. 146 00:05:26,680 --> 00:05:30,000 Device discovery helps you find the gaps outside that known list. 147 00:05:30,000 --> 00:05:31,600 It gives you a starting point for asking, 148 00:05:31,600 --> 00:05:33,880 should this device be onboarded, managed another way, 149 00:05:33,880 --> 00:05:36,760 restricted, or removed from the network? 150 00:05:36,760 --> 00:05:39,160 You can't protect a device you don't know exists. 151 00:05:39,160 --> 00:05:40,920 The same idea applies to software. 152 00:05:40,920 --> 00:05:43,280 Defender software inventory builds a list of applications 153 00:05:43,280 --> 00:05:45,440 found across your onboarded devices. 154 00:05:45,440 --> 00:05:47,480 You see the software name, publisher version, 155 00:05:47,480 --> 00:05:49,120 and which devices have it installed. 156 00:05:49,120 --> 00:05:50,720 From there, Defender connects that software 157 00:05:50,720 --> 00:05:53,360 to known weaknesses and shows which devices are exposed. 158 00:05:53,360 --> 00:05:55,400 This becomes useful when one outdated app 159 00:05:55,400 --> 00:05:57,320 appears across dozens of machines 160 00:05:57,320 --> 00:06:00,200 or when an old component sits inside an application, 161 00:06:00,200 --> 00:06:01,480 nobody thought to check. 162 00:06:01,480 --> 00:06:03,000 You're not searching device by device, 163 00:06:03,000 --> 00:06:04,280 and you can start with the software, 164 00:06:04,280 --> 00:06:05,840 then move to the affected devices 165 00:06:05,840 --> 00:06:08,400 or start with a device and see what software needs attention. 166 00:06:08,400 --> 00:06:10,520 The view goes beyond normal desktop apps too. 167 00:06:10,520 --> 00:06:12,960 Depending on your setup and what features you've enabled, 168 00:06:12,960 --> 00:06:15,120 Defender vulnerability management can assess things 169 00:06:15,120 --> 00:06:17,200 like digital certificates, browser extensions, 170 00:06:17,200 --> 00:06:19,080 firmware, hardware security settings, 171 00:06:19,080 --> 00:06:21,680 network shares, and configuration gaps. 172 00:06:21,680 --> 00:06:24,760 A browser extension might ask for broad access to websites. 173 00:06:24,760 --> 00:06:27,840 A certificate might use an old method or be close to expiring. 174 00:06:27,840 --> 00:06:30,920 A shared folder might give far too many people access. 175 00:06:30,920 --> 00:06:33,640 Firmware can be old even when Windows is fully updated. 176 00:06:33,640 --> 00:06:35,080 These aren't always patch problems. 177 00:06:35,080 --> 00:06:37,080 Sometimes the right fix is a setting change 178 00:06:37,080 --> 00:06:38,720 removing software tightening access 179 00:06:38,720 --> 00:06:40,560 or replacing an old device. 180 00:06:40,560 --> 00:06:42,240 Here's one boundary to keep in mind. 181 00:06:42,240 --> 00:06:44,320 What Defender can see depends on your licensing, 182 00:06:44,320 --> 00:06:46,920 the platforms you use, where the devices are on-boarded 183 00:06:46,920 --> 00:06:48,720 and which features you've turned on. 184 00:06:48,720 --> 00:06:50,680 Discovery is strong, but it isn't magic. 185 00:06:50,680 --> 00:06:52,480 A device outside the supported setup 186 00:06:52,480 --> 00:06:54,760 or completely disconnected from your environment 187 00:06:54,760 --> 00:06:56,480 won't suddenly give you a full report. 188 00:06:56,480 --> 00:06:58,560 Still, once you have a clearer list of devices, 189 00:06:58,560 --> 00:07:01,200 software, and weak spots, a bigger problem appears. 190 00:07:01,200 --> 00:07:02,440 Where do you begin? 191 00:07:02,440 --> 00:07:03,480 Prioritization. 192 00:07:03,480 --> 00:07:05,920 Choosing the door and attacker can actually use. 193 00:07:05,920 --> 00:07:08,720 A long-von-von-rability list doesn't tell you what to do first. 194 00:07:08,720 --> 00:07:12,200 Many teams rely on CVSS, the common-von-rability scoring system, 195 00:07:12,200 --> 00:07:14,160 it gives a weakness, a severity rating, 196 00:07:14,160 --> 00:07:15,680 often from low to critical. 197 00:07:15,680 --> 00:07:16,640 That rating helps. 198 00:07:16,640 --> 00:07:19,320 But a severity score describes the weakness in general. 199 00:07:19,320 --> 00:07:21,360 It doesn't know your company, your devices, 200 00:07:21,360 --> 00:07:22,920 or what an attacker can reach. 201 00:07:22,920 --> 00:07:24,840 Microsoft Defender vulnerability management 202 00:07:24,840 --> 00:07:26,400 adds that missing context. 203 00:07:26,400 --> 00:07:28,880 It looks at the weakness, but also at signals around it. 204 00:07:28,880 --> 00:07:30,120 Is there a public exploit? 205 00:07:30,120 --> 00:07:32,800 Has Microsoft seen threat activity connected to it? 206 00:07:32,800 --> 00:07:35,080 Does the issue link to an active alert in your environment 207 00:07:35,080 --> 00:07:36,480 how many devices are affected? 208 00:07:36,480 --> 00:07:38,480 Are those devices ordinary workstations 209 00:07:38,480 --> 00:07:41,120 or systems that handle sensitive files and business work? 210 00:07:41,120 --> 00:07:44,680 This changes the question from which CVE has the highest number? 211 00:07:44,680 --> 00:07:48,120 To which issue creates the most exposure for us? 212 00:07:48,120 --> 00:07:49,760 Think about the office building again. 213 00:07:49,760 --> 00:07:51,680 A loose lock on a garden shed is worth fixing, 214 00:07:51,680 --> 00:07:53,840 but an unlocked front door beside the finance records 215 00:07:53,840 --> 00:07:55,000 is a different problem. 216 00:07:55,000 --> 00:07:56,600 Both are security issues. 217 00:07:56,600 --> 00:07:58,440 Only one gives somebody a direct root 218 00:07:58,440 --> 00:08:00,000 to something far more sensitive. 219 00:08:00,000 --> 00:08:01,520 Defender uses that kind of thinking 220 00:08:01,520 --> 00:08:03,720 when it ranks security recommendations. 221 00:08:03,720 --> 00:08:05,520 You'll see an exposure score, which gives you 222 00:08:05,520 --> 00:08:08,040 a broad view of how exposed your organization is. 223 00:08:08,040 --> 00:08:08,880 Lower is better. 224 00:08:08,880 --> 00:08:11,840 It isn't a grade for whether your company is safe or unsafe. 225 00:08:11,840 --> 00:08:13,680 It's more like a warning light that helps you see 226 00:08:13,680 --> 00:08:16,080 whether the number of open roots into your environment 227 00:08:16,080 --> 00:08:17,480 is moving in the right direction. 228 00:08:17,480 --> 00:08:19,360 You may also see secure score for devices. 229 00:08:19,360 --> 00:08:21,200 This looks at device security settings 230 00:08:21,200 --> 00:08:22,640 and shows where you can improve them. 231 00:08:22,640 --> 00:08:25,040 Maybe devices need a stronger security setting, 232 00:08:25,040 --> 00:08:28,040 a safer configuration, or a control turned on. 233 00:08:28,040 --> 00:08:30,440 A higher score usually means more recommended protections 234 00:08:30,440 --> 00:08:31,200 are in place. 235 00:08:31,200 --> 00:08:33,280 Still, don't treat either score like a guarantee. 236 00:08:33,280 --> 00:08:35,080 A good score doesn't mean an attacker can't get in. 237 00:08:35,080 --> 00:08:38,120 A lower score doesn't tell you exactly where an attack will happen. 238 00:08:38,120 --> 00:08:40,040 The scores help you decide where to look 239 00:08:40,040 --> 00:08:43,080 and measure whether your work reduces exposure over time. 240 00:08:43,080 --> 00:08:45,120 The practical work happens in the recommendations. 241 00:08:45,120 --> 00:08:47,160 Open a recommendation and Defender can lead you 242 00:08:47,160 --> 00:08:49,560 from the weakness to the affected software 243 00:08:49,560 --> 00:08:51,680 to the exposed devices and then to the action 244 00:08:51,680 --> 00:08:53,200 that can reduce the issue. 245 00:08:53,200 --> 00:08:55,240 That path matters because it prevents guesswork. 246 00:08:55,240 --> 00:08:57,320 You might start with a vulnerable software component. 247 00:08:57,320 --> 00:08:59,840 From there, you see which version caused the issue, 248 00:08:59,840 --> 00:09:01,600 which devices still carry it, 249 00:09:01,600 --> 00:09:04,240 and whether a software update, setting change, 250 00:09:04,240 --> 00:09:06,800 or other action addresses the weakness. 251 00:09:06,800 --> 00:09:09,160 Sometimes the detail changes the order completely. 252 00:09:09,160 --> 00:09:11,120 A vulnerable file may appear on many devices, 253 00:09:11,120 --> 00:09:13,840 but that doesn't always mean each device carries the same risk. 254 00:09:13,840 --> 00:09:17,360 One file might simply sit inside an old archive and never run. 255 00:09:17,360 --> 00:09:19,120 Another could be loaded by an active process 256 00:09:19,120 --> 00:09:21,200 and listening for traffic on a network port. 257 00:09:21,200 --> 00:09:22,920 Those are very different conditions. 258 00:09:22,920 --> 00:09:25,760 The second device gives an attacker a more realistic route in, 259 00:09:25,760 --> 00:09:27,840 so it deserves attention sooner. 260 00:09:27,840 --> 00:09:30,760 Defender can also connect this work with threat analytics. 261 00:09:30,760 --> 00:09:32,880 These are Microsoft reports about emerging threats 262 00:09:32,880 --> 00:09:34,480 and active attack campaigns. 263 00:09:34,480 --> 00:09:36,240 They help answer useful questions. 264 00:09:36,240 --> 00:09:37,800 Are we affected by this threat? 265 00:09:37,800 --> 00:09:39,600 Do we have devices exposed to it? 266 00:09:39,600 --> 00:09:42,320 Are there alerts showing it already touched our environment? 267 00:09:42,320 --> 00:09:43,840 What mitigations reduce the risk 268 00:09:43,840 --> 00:09:45,640 while teams prepare a full fix? 269 00:09:45,640 --> 00:09:47,720 You can see why patching everything as fast as possible 270 00:09:47,720 --> 00:09:49,160 isn't always the best plan. 271 00:09:49,160 --> 00:09:51,200 A rushed update can interrupt a business app, 272 00:09:51,200 --> 00:09:53,680 break a workflow, or take down a service people need. 273 00:09:53,680 --> 00:09:55,160 That doesn't mean you ignore updates. 274 00:09:55,160 --> 00:09:57,120 It means you use the context defender provides 275 00:09:57,120 --> 00:09:59,800 to focus effort where it reduces the most risk 276 00:09:59,800 --> 00:10:01,880 while planning changes safely for the rest. 277 00:10:01,880 --> 00:10:04,080 So Defender gives you a clearer first fix, 278 00:10:04,080 --> 00:10:05,360 but knowing what needs attention 279 00:10:05,360 --> 00:10:07,920 and actually changing a device are two separate jobs. 280 00:10:07,920 --> 00:10:10,520 Defender now needs to hand that work to the people 281 00:10:10,520 --> 00:10:12,360 and tools that can apply the repair. 282 00:10:12,360 --> 00:10:16,280 Remediation from security finding to real work. 283 00:10:16,280 --> 00:10:19,800 So here's a common misunderstanding, defender vulnerability. 284 00:10:19,800 --> 00:10:22,240 Management doesn't turn into a universal patching engine 285 00:10:22,240 --> 00:10:23,800 the moment it finds a problem. 286 00:10:23,800 --> 00:10:26,360 Its real job is to identify the issue, rank it, 287 00:10:26,360 --> 00:10:28,840 assign work, track progress, and check the result. 288 00:10:28,840 --> 00:10:30,440 The actual change might happen through 289 00:10:30,440 --> 00:10:32,920 in-tune service now, another ticket system, 290 00:10:32,920 --> 00:10:36,400 a software deployment tool, or even a hands-on change by an IT team. 291 00:10:36,400 --> 00:10:38,400 Think of Defender as the place where security work 292 00:10:38,400 --> 00:10:39,520 gets clear ownership. 293 00:10:39,520 --> 00:10:42,400 A security recommendation gives you more than just a warning. 294 00:10:42,400 --> 00:10:45,120 It links the action you should take to the affected software, 295 00:10:45,120 --> 00:10:47,480 the related weakness, and the devices in scope. 296 00:10:47,480 --> 00:10:50,040 It can also show you the expected reduction in exposure 297 00:10:50,040 --> 00:10:50,920 if you address it. 298 00:10:50,920 --> 00:10:53,240 So instead of sending someone a vague message saying, 299 00:10:53,240 --> 00:10:56,240 "We have a browser problem, you can point to the exact version, 300 00:10:56,240 --> 00:10:59,000 the affected devices, and the action required." 301 00:10:59,000 --> 00:11:01,040 From that recommendation, a security team 302 00:11:01,040 --> 00:11:02,880 can create a remediation request. 303 00:11:02,880 --> 00:11:06,440 They select the device scope, set the priority, add a due date, 304 00:11:06,440 --> 00:11:08,480 and include notes for the team that will do the work. 305 00:11:08,480 --> 00:11:10,440 Maybe the update needs testing first, 306 00:11:10,440 --> 00:11:12,440 or a certain business app might be affected, 307 00:11:12,440 --> 00:11:15,040 or the request can't wait for the normal update cycle. 308 00:11:15,040 --> 00:11:17,120 That turns the security finding into a piece of work 309 00:11:17,120 --> 00:11:18,720 with a named owner and a deadline. 310 00:11:18,720 --> 00:11:21,120 The hand-off matters because security and device management 311 00:11:21,120 --> 00:11:23,080 teams often have different jobs. 312 00:11:23,080 --> 00:11:26,320 Security teams watch for risks and decide what needs attention. 313 00:11:26,320 --> 00:11:29,200 Device teams know how updates reach laptops, servers, 314 00:11:29,200 --> 00:11:31,720 and apps without interrupting the people who need them. 315 00:11:31,720 --> 00:11:33,240 With the Intune connection in place, 316 00:11:33,240 --> 00:11:36,960 Defender can send that request into Intune as a security task. 317 00:11:36,960 --> 00:11:38,680 The Intune team can review it, accept it, 318 00:11:38,680 --> 00:11:40,720 apply the update or configuration change, 319 00:11:40,720 --> 00:11:42,800 and report progress back through the shared workflow. 320 00:11:42,800 --> 00:11:44,920 Nobody needs to copy device names from one portal 321 00:11:44,920 --> 00:11:45,680 into a spreadsheet. 322 00:11:45,680 --> 00:11:48,560 Nobody needs to attach screenshots to a long email chain. 323 00:11:48,560 --> 00:11:51,120 If your company uses service now or another ticket system, 324 00:11:51,120 --> 00:11:52,880 the same idea applies. 325 00:11:52,880 --> 00:11:54,960 Defender provides the finding and context, 326 00:11:54,960 --> 00:11:57,760 while the ticket system manages the work in the process, 327 00:11:57,760 --> 00:11:59,280 your IT teams already use. 328 00:11:59,280 --> 00:12:00,640 That gives everyone the same record. 329 00:12:00,640 --> 00:12:02,160 Security can see what they asked for. 330 00:12:02,160 --> 00:12:03,840 It can see why the work matters. 331 00:12:03,840 --> 00:12:06,960 Managers can see whether the issue is open, in progress, 332 00:12:06,960 --> 00:12:08,680 over-du, or completed. 333 00:12:08,680 --> 00:12:11,200 Now imagine Defender identifies a serious browser weakness 334 00:12:11,200 --> 00:12:12,480 on a group of devices. 335 00:12:12,480 --> 00:12:15,120 The security team opens a remediation request 336 00:12:15,120 --> 00:12:17,480 and scopes it to the affected browser version. 337 00:12:17,480 --> 00:12:20,280 They market as high priority, set a due date, 338 00:12:20,280 --> 00:12:22,240 and add a note that the update should begin 339 00:12:22,240 --> 00:12:23,320 with a pilot group. 340 00:12:23,320 --> 00:12:25,960 The device team receives the Intune security task. 341 00:12:25,960 --> 00:12:27,640 They update a small group first. 342 00:12:27,640 --> 00:12:30,280 Maybe the IT team and a few volunteers. 343 00:12:30,280 --> 00:12:32,120 They check that the browser works with the company's 344 00:12:32,120 --> 00:12:33,800 sites and line of business apps. 345 00:12:33,800 --> 00:12:35,760 Once that looks good, they roll the update out 346 00:12:35,760 --> 00:12:37,480 and stages to the remaining devices. 347 00:12:37,480 --> 00:12:39,320 Progress appears in the task and Defender 348 00:12:39,320 --> 00:12:41,880 then checks the devices again as they report in. 349 00:12:41,880 --> 00:12:44,520 That staged approach might feel slower than clicking update 350 00:12:44,520 --> 00:12:46,560 all, but it prevents one bad update 351 00:12:46,560 --> 00:12:48,520 from becoming a company-wide problem. 352 00:12:48,520 --> 00:12:50,840 A pilot group gives you a small, controlled place 353 00:12:50,840 --> 00:12:52,960 to find trouble before everybody feels it. 354 00:12:52,960 --> 00:12:54,840 Sometimes a full fix can't happen right away. 355 00:12:54,840 --> 00:12:57,160 Maybe a server runs an old application that only works 356 00:12:57,160 --> 00:12:58,920 with a specific browser version. 357 00:12:58,920 --> 00:13:00,960 Maybe a vendor needs time to confirm a patch. 358 00:13:00,960 --> 00:13:02,880 Maybe the business has a fixed maintenance window. 359 00:13:02,880 --> 00:13:04,600 That doesn't mean the issue disappears. 360 00:13:04,600 --> 00:13:07,760 Create an exception, document why the system can't change yet, 361 00:13:07,760 --> 00:13:09,000 and set an end date. 362 00:13:09,000 --> 00:13:10,960 An exception should be a temporary decision 363 00:13:10,960 --> 00:13:13,240 with a visible review date, not a quiet way 364 00:13:13,240 --> 00:13:14,600 to forget about a risk. 365 00:13:14,600 --> 00:13:16,600 While you wait, you may be able to reduce the danger 366 00:13:16,600 --> 00:13:17,400 in another way. 367 00:13:17,400 --> 00:13:19,840 You might block a vulnerable application from running. 368 00:13:19,840 --> 00:13:21,880 You might apply a temporary mitigation recommended 369 00:13:21,880 --> 00:13:23,160 by the software vendor. 370 00:13:23,160 --> 00:13:25,000 You might limit where the device can connect 371 00:13:25,000 --> 00:13:27,080 until the permanent update is ready. 372 00:13:27,080 --> 00:13:28,720 The point is to reduce the open route 373 00:13:28,720 --> 00:13:30,840 while the full repair is still being planned. 374 00:13:30,840 --> 00:13:33,120 And this leads to a mistake that catches many teams. 375 00:13:33,120 --> 00:13:34,840 A completed ticket doesn't automatically 376 00:13:34,840 --> 00:13:36,880 mean the security gap is closed. 377 00:13:36,880 --> 00:13:40,000 Verification and the connected Microsoft 365 building, 378 00:13:40,000 --> 00:13:42,360 the update may show as deployed in Intune, 379 00:13:42,360 --> 00:13:43,480 the ticket may say complete. 380 00:13:43,480 --> 00:13:45,240 Neither one proves the vulnerable version 381 00:13:45,240 --> 00:13:48,200 has disappeared from every affected device. 382 00:13:48,200 --> 00:13:49,680 Defender vulnerability management 383 00:13:49,680 --> 00:13:52,520 keeps checking the signals coming back from those devices. 384 00:13:52,520 --> 00:13:54,680 If a laptop state offline during the update, 385 00:13:54,680 --> 00:13:57,680 failed the install or still reports the old software version, 386 00:13:57,680 --> 00:13:59,080 the finding can remain open. 387 00:13:59,080 --> 00:14:01,400 That matters because it stops the team from closing work 388 00:14:01,400 --> 00:14:03,680 based only on a deployment report. 389 00:14:03,680 --> 00:14:05,960 When the affected device is no longer show the weakness, 390 00:14:05,960 --> 00:14:08,840 Defender can mark the remediation activity as completed. 391 00:14:08,840 --> 00:14:09,800 That is the proof you want. 392 00:14:09,800 --> 00:14:11,480 The device itself reports a change state 393 00:14:11,480 --> 00:14:12,760 and the exposure has cleared. 394 00:14:12,760 --> 00:14:14,320 You can also use the event timeline 395 00:14:14,320 --> 00:14:16,560 to see how the story changed over time. 396 00:14:16,560 --> 00:14:19,200 A new weakness appears, a recommendation is created, 397 00:14:19,200 --> 00:14:21,600 a remediation request is sent, devices update, 398 00:14:21,600 --> 00:14:23,880 the remaining exposed devices become easier to spot. 399 00:14:23,880 --> 00:14:26,320 It gives security teams, IT teams and auditors 400 00:14:26,320 --> 00:14:29,720 one shared record instead of several disconnected reports. 401 00:14:29,720 --> 00:14:32,200 The wider Microsoft 365 connection matters too. 402 00:14:32,200 --> 00:14:34,560 Intune manages device settings and compliance. 403 00:14:34,560 --> 00:14:36,160 Defender for endpoint detects threats 404 00:14:36,160 --> 00:14:37,640 and calculates device risk. 405 00:14:37,640 --> 00:14:39,760 EntraID uses those signals when somebody tries 406 00:14:39,760 --> 00:14:41,520 to access company services. 407 00:14:41,520 --> 00:14:44,320 Imagine a laptop that has a serious security problem 408 00:14:44,320 --> 00:14:46,640 and no longer meets your company's compliance rules. 409 00:14:46,640 --> 00:14:49,080 Intune can mark that device as non-compliant, 410 00:14:49,080 --> 00:14:51,160 then EntraID conditional access can stop it 411 00:14:51,160 --> 00:14:53,640 from opening SharePoint Teams or Exchange Online 412 00:14:53,640 --> 00:14:55,800 until the device returns to an acceptable state. 413 00:14:55,800 --> 00:14:57,320 The person still has an identity 414 00:14:57,320 --> 00:14:59,040 but the device does not get trusted access 415 00:14:59,040 --> 00:15:00,400 while it carries too much risk. 416 00:15:00,400 --> 00:15:02,120 That is a practical security control. 417 00:15:02,120 --> 00:15:04,040 It limits what a risky device can reach 418 00:15:04,040 --> 00:15:06,680 even while the IT team works on the full repair. 419 00:15:06,680 --> 00:15:08,360 Per view adds another piece of context. 420 00:15:08,360 --> 00:15:10,800 Per view helps identify and protect sensitive information 421 00:15:10,800 --> 00:15:13,080 such as finance records, customer data, 422 00:15:13,080 --> 00:15:14,440 or confidential files. 423 00:15:14,440 --> 00:15:17,000 In exposure management, a device that regularly handles 424 00:15:17,000 --> 00:15:20,040 highly sensitive data can receive higher criticality. 425 00:15:20,040 --> 00:15:21,520 That changes the order of work, 426 00:15:21,520 --> 00:15:23,600 the same weakness on a general meeting room PC 427 00:15:23,600 --> 00:15:25,920 and on a laptop used for sensitive finance documents 428 00:15:25,920 --> 00:15:28,280 should not automatically receive the same response. 429 00:15:28,280 --> 00:15:31,400 Think of Microsoft 365 as a connected office building. 430 00:15:31,400 --> 00:15:33,280 EntraID is the reception desk. 431 00:15:33,280 --> 00:15:34,520 It checks who is signing in 432 00:15:34,520 --> 00:15:35,960 and whether they should get through. 433 00:15:35,960 --> 00:15:37,480 Intune is the device manager. 434 00:15:37,480 --> 00:15:40,080 It keeps track of company laptops and applies their rules. 435 00:15:40,080 --> 00:15:42,200 Defender for endpoint is the security guard. 436 00:15:42,200 --> 00:15:44,720 It watches for threats and suspicious activity. 437 00:15:44,720 --> 00:15:46,280 Defender vulnerability management 438 00:15:46,280 --> 00:15:48,080 looks for the openings attackers might use 439 00:15:48,080 --> 00:15:49,560 before an attack begins. 440 00:15:49,560 --> 00:15:50,920 Per view is the records room. 441 00:15:50,920 --> 00:15:53,040 It knows which files need the most care. 442 00:15:53,040 --> 00:15:54,600 Each service has its own job, 443 00:15:54,600 --> 00:15:56,240 but they share useful signals. 444 00:15:56,240 --> 00:15:57,520 That means fewer blind spots 445 00:15:57,520 --> 00:16:00,280 and less time lost passing information between teams. 446 00:16:00,280 --> 00:16:03,120 You can see what remains open, who owns the work 447 00:16:03,120 --> 00:16:05,760 and whether the change actually reduced exposure. 448 00:16:05,760 --> 00:16:08,400 So how do you turn all of this into a simple routine? 449 00:16:08,400 --> 00:16:10,360 Your first vulnerability management routine. 450 00:16:10,360 --> 00:16:12,240 So here's the thing about vulnerability management. 451 00:16:12,240 --> 00:16:14,600 It's not about guessing which patches to apply 452 00:16:14,600 --> 00:16:16,240 or hoping you covered everything. 453 00:16:16,240 --> 00:16:18,800 Defender vulnerability management gives you a live view 454 00:16:18,800 --> 00:16:21,200 of what's actually exposed, what matters most 455 00:16:21,200 --> 00:16:22,880 and what still needs to be fixed. 456 00:16:22,880 --> 00:16:24,960 Let's break it down into a few simple steps. 457 00:16:24,960 --> 00:16:27,200 First, make sure your devices are onboarded 458 00:16:27,200 --> 00:16:28,400 to Defender for endpoint. 459 00:16:28,400 --> 00:16:29,720 Then check the discovery results 460 00:16:29,720 --> 00:16:32,200 for any devices that are sitting outside your managed list. 461 00:16:32,200 --> 00:16:33,760 Those are the ones you need to bring in. 462 00:16:33,760 --> 00:16:35,640 Next, review the top recommendations. 463 00:16:35,640 --> 00:16:37,280 But don't just look at severity ratings. 464 00:16:37,280 --> 00:16:39,480 Check exploit activity, device exposure 465 00:16:39,480 --> 00:16:41,760 and what role that device plays in the business. 466 00:16:41,760 --> 00:16:43,160 That tells you what to prioritize. 467 00:16:43,160 --> 00:16:45,720 Then create one tightly-scoped remediation request 468 00:16:45,720 --> 00:16:47,880 through Intune or your ticketing system. 469 00:16:47,880 --> 00:16:50,120 Finally, verify that the affected device 470 00:16:50,120 --> 00:16:53,200 is actually clear the finding and document any exceptions 471 00:16:53,200 --> 00:16:54,840 with a reason and an end date. 472 00:16:54,840 --> 00:16:56,520 That way nothing slips through the cracks. 473 00:16:56,520 --> 00:16:58,520 For the next knowledge nugget, we'll connect Defender 474 00:16:58,520 --> 00:17:01,640 for endpoint and Intune and show how device risk can control 475 00:17:01,640 --> 00:17:04,120 access to company data.