4.4.6. Microsoft Defender Vulnerability Management
💡 First Principle: You can't protect what you don't know is exposed, so Defender Vulnerability Management continuously discovers software, devices, and browser extensions across the environment, assesses their known vulnerabilities and misconfigurations, and prioritizes remediation based on real exploitability and business context — not just a raw vulnerability count.
Prioritization matters because a large organization might have thousands of known vulnerabilities at any moment — Defender Vulnerability Management ranks them by factors like active exploitation in the wild and asset criticality, so remediation effort goes toward what actually reduces risk fastest, rather than being spread evenly (or randomly) across the full list.
⚠️ Exam Trap: Vulnerability management is about discovering and prioritizing weaknesses (an asset/software inventory and patch-gap problem) — it's not the same as detecting an active attack already in progress, which is Defender for Endpoint's EDR job (4.4.3).
Reflection Question: Why is prioritizing vulnerabilities by real-world exploitability and asset importance more useful to a security team than simply patching in the order vulnerabilities were discovered?
