5.1.3. Vulnerability Management and Defender EASM
💡 First Principle: Vulnerability Management and External Attack Surface Management ask two different questions from two different vantage points — one looks inward at known resources for weaknesses, the other looks outward, from an attacker's perspective, for assets you might not even know you have exposed.
Microsoft Defender Vulnerability Management for Azure VMs scans known, inventoried resources for missing patches, software vulnerabilities, and misconfigurations — assuming the asset is already known and onboarded. Microsoft Defender External Attack Surface Management (EASM) takes the opposite approach: it discovers internet-facing assets by crawling and mapping your organization's external footprint the way an attacker would, surfacing unprotected or forgotten assets — a shadow-IT web server, an expired certificate on a subdomain nobody remembers — that never made it into inventory in the first place.
| Tool | Vantage Point | Finds |
|---|---|---|
| Defender Vulnerability Management | Inside-out, known inventory | Patches, vulnerabilities, misconfigurations on known assets |
| Defender EASM | Outside-in, attacker's perspective | Unknown/forgotten internet-facing assets not yet in inventory |
⚠️ Exam Trap: A vulnerability scan finding nothing wrong doesn't mean an organization has no external exposure — Vulnerability Management can only assess assets that are already known and onboarded. A scenario about "assets we didn't know we had" is an EASM question, not a Vulnerability Management gap.
Reflection Question: Why can't Defender Vulnerability Management alone ever discover a forgotten, unmanaged web server that was never added to Azure inventory in the first place?
