Project Overview

This project demonstrates the implementation of a continuous Threat & Vulnerability Management (TVM) program using Microsoft Defender for Endpoint Plan 2.

Unlike traditional vulnerability scanners that perform scheduled assessments, Microsoft Defender continuously collects telemetry from onboarded devices and evaluates security posture in real time.

Using Microsoft's Exposure Score engine, vulnerabilities are prioritized according to exploitability, business impact, security recommendations, and attack surface exposure rather than relying solely on CVSS scores.

The project also demonstrates the complete remediation lifecycle including Windows patch management, Attack Surface Reduction (ASR) rule deployment, Potentially Unwanted Application (PUA) protection, risk exception management, and ongoing monitoring.

• ✔ Continuous vulnerability assessment
• ✔ Exposure Score monitoring
• ✔ Windows Update remediation
• ✔ Microsoft Defender TVM recommendations
• ✔ Attack Surface Reduction Rules
• ✔ PUA Protection
• ✔ Risk Exception Management

Business Problem

Modern organisations receive hundreds of new vulnerability notifications every week. Traditional vulnerability scanners only perform periodic assessments and often overwhelm security teams with large lists of findings that are difficult to prioritise.

Without continuous monitoring, security teams cannot determine which vulnerabilities represent the highest business risk, resulting in delayed remediation, patch fatigue, and increased exposure to cyber attacks.

This project demonstrates how Microsoft Defender Threat & Vulnerability Management continuously monitors device security posture, prioritises remediation using Exposure Score, and provides actionable recommendations for reducing enterprise attack surface.

Project Objectives

Lab Environment

Microsoft Technologies Used

Windows Endpoint
        │
        ▼
Microsoft Defender Sensor
        │
        ▼
Threat & Vulnerability Management
        │
        ▼
Exposure Score Calculation
        │
        ▼
Security Recommendations
        │
        ▼
Windows Update / ASR / PUA
        │
        ▼
Reduced Attack Surface

Threat & Vulnerability Dashboard

class="gi">

Threat & Vulnerability Dashboard

Microsoft Defender TVM dashboard displaying overall device exposure score, security posture, and remediation recommendations.

Top Security Recommendations

Recommendation	Impact Score
Update Microsoft Windows 11	57.29
Review OpenSSL Vulnerabilities	30.00
Enable PUA Protection	3.00
Deploy ASR Rules	3.90

class="gi">

TVM Recommendations

Microsoft Defender prioritized recommendations ranked according to business impact and exploitability.

Detected Vulnerabilities

CVE	Severity	CVSS	Software
CVE-2025-64673	High	7.8	Windows 11
CVE-2025-64661	Medium	7.8	Windows 11
CVE-2025-9230	High	7.5	OpenSSL
CVE-2025-64670	Medium	6.5	Windows
CVE-2025-9231	Medium	6.5	OpenSSL
CVE-2025-9232	Medium	5.9	OpenSSL

class="gi">

Detected Vulnerabilities

Microsoft Defender TVM vulnerability inventory showing affected software, CVEs, severity levels, and remediation priorities.

Potentially Unwanted Application (PUA) Protection

Microsoft Defender Antivirus was configured through Microsoft Intune Endpoint Security to block Potentially Unwanted Applications (PUAs). This helps prevent adware, bundled software, and unwanted applications from being installed on managed endpoints.

PUA Protection Policy

Microsoft Defender Antivirus configured in Block mode using Microsoft Intune Endpoint Security.

Recommendations After Remediation

Following Windows Update deployment, Attack Surface Reduction policy implementation, and PUA Protection, Microsoft Defender TVM generated a new set of recommendations representing the remaining security posture.

Updated TVM Recommendations

Windows vulnerabilities were remediated successfully, leaving only vendor-managed OpenSSL vulnerabilities and configuration recommendations.

Attack Surface Reduction (ASR) Policy

Attack Surface Reduction Rules were deployed using Microsoft Intune Endpoint Security to prevent executable content from email clients and webmail, significantly reducing malware delivery risks.

Attack Surface Reduction Policy

Microsoft Intune Endpoint Security policy configured to block executable content received through email clients and webmail applications.

Security Controls Implemented

Validation & Testing

• ✔ Defender for Endpoint onboarded successfully.
• ✔ Threat & Vulnerability Management dashboard populated.
• ✔ Exposure Score calculated correctly.
• ✔ Windows Update recommendation resolved.
• ✔ Remaining OpenSSL vulnerabilities documented as vendor-managed exception.
• ✔ Attack Surface Reduction policy successfully deployed.
• ✔ PUA Protection operating in Block mode.
• ✔ Defender recommendations updated after remediation.

PowerShell Automation

Project Outcomes

Lessons Learned

• Risk-based prioritisation is more effective than relying solely on CVSS scores.
• Exposure Score provides better remediation guidance than traditional vulnerability scanning.
• Third-party software vulnerabilities require formal risk exception management.
• Attack Surface Reduction rules significantly reduce endpoint attack vectors.
• Continuous monitoring enables faster response than periodic vulnerability scans.
• Microsoft Intune and Defender together provide a unified endpoint protection platform.

Future Improvements

• Configure automatic remediation tasks.
• Enable Defender Vulnerability Management Premium.
• Create Power BI dashboards for Exposure Score trends.
• Deploy additional Attack Surface Reduction Rules.
• Automate vulnerability reporting using Microsoft Graph API.
• Expand TVM coverage across additional endpoints.

Troubleshooting

Microsoft References

• Microsoft Defender Vulnerability Management
• Microsoft Defender for Endpoint
• Attack Surface Reduction Rules
• Microsoft Intune Endpoint Security
• Microsoft Defender Antivirus
• Exposure Score
• Microsoft Security Baselines
• Microsoft Graph Security API

Project Repository

The complete documentation, screenshots, implementation guides, PowerShell scripts, architecture diagrams, and project artifacts are available on GitHub.

Next Project

Continue to the next project in the Microsoft 365 Security Portfolio.