Topic 8 of 8
Vulnerabilities, exposure, and threat intelligence
Detecting attacks isn't enough: you also need to know where you're weak before someone exploits it, and which threats target your industry. Three capabilities in the Defender portal cover that proactive side: Vulnerability Management, Security Exposure Management, and threat intelligence. The exam asks you to tell their scopes apart.
Contents
Defender Vulnerability Management
It provides asset visibility, intelligent assessments, and built-in remediation tools for Windows, macOS, Linux, Android, iOS, and network devices. It uses Microsoft threat intelligence and exploit likelihood predictions to prioritize.
Discover
Continuous inventory of software, configurations, and vulnerabilities
Prioritize
Based on the real risk to your business, not just severity
Remediate
Tasks, blocking, and real-time tracking
In the portal it's under Exposure management. A core version is part of Defender for Endpoint Plan 2.
Discovery and inventories
The Defender for Endpoint sensors already in place feed the assessment continuously, and it also works agentless for unmanaged devices. There's no need to run periodic scans.
Software inventory
Which programs and versions are on each device, with their known vulnerabilities (CVEs).
Certificates
Installed certificates, to detect expired or weak ones.
Hardware and firmware
Components and firmware versions with vulnerabilities.
Browser extensions
Installed extensions and the permissions they request.
Security baselines
Configuration compared against benchmarks such as CIS and STIG.
Other assessments
Network shares and authenticated scans of Windows devices.
Prioritization and remediation
An organization can have thousands of vulnerabilities. Risk-based prioritization puts the ones that matter first:
- Emerging threats: vulnerabilities being exploited in the wild right now.
- Active breaches: tied to alerts you already have in the organization.
- High-value assets: devices critical to the business or holding sensitive data.
Remediation
Remediation requests that create tasks in Intune, blocking vulnerable apps while they're patched, alternate mitigations, and real-time remediation status.
Metrics
Exposure score: the lower, the better. Secure Score for Devices: measures device configuration; the higher, the better.
Security Exposure Management
Vulnerability Management looks at each device and each CVE. Security Exposure Management goes up a level: it unifies the view of security posture and attack surface across all workloads (devices, identities, apps, data, cloud) to see how weaknesses combine.
| Vulnerability Management | Security Exposure Management | |
|---|---|---|
| Level | CVEs and configuration of each device | The whole attack surface, across workloads |
| Question | What's wrong with this device? | How would an attacker reach what matters most to me? |
| Tools | Inventories, recommendations, remediation | Graph, attack paths, initiatives, Secure Score |
Graph, attack paths, and critical assets
Enterprise exposure graph
Represents assets and their relationships: which user signs in to which device, which identity has permissions over which resource. The attack surface map, a visual view for exploring it, is built on top of it.
Attack paths
Sequences of steps an attacker could follow, exploiting vulnerabilities and misconfigurations, to reach a critical asset. Choke points are nodes that many paths go through: fixing them cuts several at once.
Critical asset management
Identifies the most important assets with predefined classifications (for example, domain controllers) and custom ones, to prioritize their protection.
Data connectors
Bring in information from third-party tools such as ServiceNow CMDB, Tenable, Qualys, and Rapid7.
Initiatives and Microsoft Secure Score
Initiatives group metrics and recommendations around a goal, with a progress score. There are workload initiatives (devices, identities…), horizontal threat initiatives (ransomware, BEC), threat analytics-based initiatives, and Zero Trust initiatives. A central catalog gathers every metric and recommendation.
Microsoft Secure Score measures the organization's security posture: the higher, the better. Each recommendation adds points when completed, and many give partial points: if you require MFA for half your users, you get part of that action's points.
- It covers identities, devices, apps, and data, with a per-domain view.
- There's also a Cloud Secure Score for cloud posture.
- It isn't the same as the compliance score in Purview Compliance Manager (D4), which measures progress against regulations.
Threat intelligence
Threat intelligence is knowledge about attackers: who they are, which techniques they use, what infrastructure (IPs, domains), and which vulnerabilities they exploit. It helps anticipate attacks and gives context to alerts.
Recent change
The standalone Microsoft Defender Threat Intelligence portal retired on August 1, 2026. Its capabilities were built into the Threat intelligence node of the Defender portal, shared by Defender XDR and Sentinel.
Intelligence tools
Threat analytics
Reports from Microsoft researchers on current, high-impact threats and those with the highest exposure for your organization, with recommendations.
Intel profiles
Profiles of threat actors, tools, and vulnerabilities: who they are, what they do, whom they target.
Intel explorer
Search by keywords, indicators (IP, domain, hash), or CVE. Vulnerability articles include a priority score.
Projects
Group the indicators and findings of an investigation to share them with the team.
Security Copilot adds promptbooks such as vulnerability impact assessment or threat actor profile, and the Threat Intelligence Briefing agent prepares tailored summaries.
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| Find out which devices run a software version with a critical CVE | Defender Vulnerability Management | Continuous inventory and assessment. |
| Compare device configuration against CIS or STIG | Security baselines assessment | Vulnerability Management. |
| Create a remediation task in Intune for the IT team | Remediation request | Vulnerability Management integration with Intune. |
| See how an attacker would get from a laptop to a critical database | Attack paths (Exposure Management) | They use the exposure graph. |
| Find the node that many attack paths go through | Choke point | Fixing it cuts several paths at once. |
| Measure the security posture of identities, devices, and apps with a score | Microsoft Secure Score | Higher is better. |
| Read an analysis of a ransomware campaign and see whether it affects you | Threat analytics | Reports with your exposure. |
| Investigate who is behind a suspicious IP | Intel explorer | Searches indicators and articles. |
Common exam traps
❓ Is a high exposure score good?
No. For the exposure score, lower is better. For Secure Score, higher is better.
❓ Are Microsoft Secure Score and the compliance score the same?
No. Secure Score measures security posture (Defender); the compliance score measures progress against regulations (Purview Compliance Manager).
❓ Do you need to run periodic scans for Vulnerability Management?
No. It uses Defender for Endpoint sensors and assesses continuously.
❓ What is a choke point?
A node that many attack paths go through. Fixing it cuts several paths at once.
❓ Does Secure Score only award points if you complete an action 100%?
No. Many actions give partial points based on the percentage completed.
❓ Where is Defender Threat Intelligence today?
Built into the Threat intelligence node of the Defender portal; the standalone portal retired in August 2026.
❓ Do Vulnerability Management and Exposure Management do the same thing?
No. The first works at the CVE and device level; the second, across the whole attack surface with paths between workloads.
Did you get this topic?
Test what you just learned
An organization wants to know through which sequence of devices and identities an attacker could reach its domain controller, so it can cut off that route. What does it use?
Ready to test "Vulnerabilities, exposure, and threat intelligence"?
Original questions, each with a full explanation.
Start a mock exam