If you've ever spent hours scrolling through CVE lists with no idea what to patch first, you're not alone. In almost every Microsoft 365 or Azure environment I review, vulnerability management is still a constant fight against too much information. Microsoft Defender Vulnerability Management (DVM) finally brings some order to it. Rather than handing you endless lists, the Defender portal (Endpoints → Vulnerability management → Recommendations) shows actionable recommendations ranked by real business risk. The Exposure Score widget at the top has become the first filter I reach for. It doesn't just count weaknesses. It also weighs attack paths, exploit availability and how widely a vulnerability is spread across your device fleet. The result is less panic about headline CVEs and more attention on what actually matters.

Recommendations show which vulnerabilities really matter

Each recommendation in Defender Vulnerability Management maps to one or more CVEs. What I find more useful is what you see at a glance: how many devices are affected, how many have already been remediated and, most importantly, whether a known exploit exists. I always keep an eye on the “Exploit available” column, because those are the issues attackers will almost always go after first. You can filter by priority, exploit status or end-of-support software and narrow the list down to the items that are genuinely blocking your security and operations teams. Every week I sit down with IT operations, go through the top recommendations and start remediation requests straight from the portal. The Intune integration saves a lot of time here.

Pro tip: Use remediation requests consistently. Assign them from the Defender portal with deadlines. The right teams get clear tasks they can track, and progress stays visible without long email chains.

One thing I really appreciate is that exceptions (when there's a good reason you can't patch) can be recorded directly in the portal, with a justification and an expiry date. That keeps things transparent and stops risks from quietly being forgotten.

The software inventory reveals what is actually running

Apart from the recommendations, the software inventory in Defender Vulnerability Management is one of my favourite parts. It gives you a complete, current picture of what's actually installed, including software versions and lifecycle status. That makes it easy to spot things like Office 2016 or unsupported third-party tools before they turn into a compliance or audit problem. At several organisations I've worked with, this view is what finally got shadow IT under some real control. The vulnerability data doesn't come only from the NVD, either. Microsoft adds its own threat intelligence and risk prioritisation on top. This overview of TVM security recommendations has the details.

Plan 2 covers the essentials and the add-on goes deeper

I'm often asked what Defender for Endpoint Plan 2 actually includes and when the Defender Vulnerability Management add-on becomes necessary. Plan 2 gives you the basics: recommendations, software inventory, exposure score and Intune integration. The add-on is where the deeper analysis comes in, with authenticated network scanning (very handy for servers and non-Windows devices), browser extension assessments, certificate inventory and vulnerability scans for unmanaged assets. In hybrid environments, or wherever some systems don't run the Defender for Endpoint agent, you'll more or less need the add-on. For the current feature comparison, have a look at the Defender Vulnerability Management overview.

The add-on adds the following:

  • Authenticated vulnerability scans (including servers)
  • Browser extension inventory and vulnerability assessment
  • Certificate inventory
  • Scanning for unmanaged or agentless endpoints
  • Expanded device and software discovery

A weekly routine takes vulnerabilities from detection to remediation

My weekly routine is simple. In the Defender portal I go through the top recommendations by exposure score and exploit availability, filter down to critical vulnerabilities and end-of-support software, and create remediation requests directly from each recommendation. Those requests go to Intune, so the whole lifecycle is documented and auditable. Where necessary I record exceptions with a justification and expiry date, which keeps audits from turning into a search for someone to blame. Working this way with IT operations has beaten every email- or ticket-based process I've tried, because you get transparency and things actually get finished.

Advanced hunting answers specific vulnerability questions

When I need targeted reports or want to dig deeper, I use Advanced Hunting in Defender. You'll find it under Microsoft Defender portal → Endpoints → Advanced hunting (Security Reader/Operator or higher required). To see which devices carry the most unpatched critical vulnerabilities, run this KQL query:

DeviceTvmSoftwareVulnerabilities
| where Severity == "Critical"
| summarize count() by DeviceName, OSPlatform
| top 10 by count_

You get an immediate ranking of your most exposed endpoints. Keep in mind that Advanced Hunting is available with Defender for Endpoint Plan 2 and above.

A workflow diagram shows how the pieces fit together

The Mermaid diagram below shows how vulnerabilities are identified, prioritised and remediated, including the feedback loops for exceptions and status tracking:

flowchart TD
A["Devices with vulnerabilities"] --> B["Recommendations in Defender portal"]
B --> C["Prioritisation (Exposure Score, Exploit)"]
C --> D["Remediation request to Intune"]
C --> E["Exception with justification"]
D --> F["Remediation by IT"]
E --> F
F --> G["Status updates to portal"]

Figure: Vulnerability lifecycle with Defender Vulnerability Management.

Defender Vulnerability Management cuts the noise and gets things done

In my view, Defender Vulnerability Management is central to making vulnerability management workable rather than just visible. Moving from a wall of CVEs to prioritised work items you can track has noticeably improved how security and IT operations work together. The add-on is a clear step up for hybrid environments and anyone who needs deeper analysis, but even with Plan 2 alone you move from CVE chaos to real control. If your process still lives in Excel or reacts in a panic to every vulnerability alert, give the built-in workflows in the Defender portal a try. For more practical notes on unified security, see my post Getting started with Microsoft Defender XDR: Unified incidents, automation, and hunting.