Continuous Threat & Vulnerability Management
Risk-based CVE prioritisation with Microsoft Defender TVM, moving from point-in-time scanning to continuous, exploitability-weighted remediation.
Difficulty
Advanced
Environment
Microsoft 365 Business Premium / Intune
Deployment
Home Lab
Est. Implementation
1 day
Executive Summary
This project replaced point-in-time vulnerability scanning with a continuous, risk-based Threat & Vulnerability Management (TVM) programme using Microsoft Defender for Endpoint Plan 2 across the Patchthecloud.onmicrosoft.com tenant.
A baseline assessment recorded a 57/100 Medium exposure score across 33 detected CVEs, with Defender TVM prioritising findings by exploitability and exposure rather than CVSS severity alone, surfacing a Windows 11 OS update as the single highest-impact remediation (impact score 57.29, 30 weaknesses).
Remediation covered the full lifecycle: the Windows update was applied and resolved the top CVEs, three OpenSSL CVEs bundled inside OneDrive were formally recorded as a vendor-managed risk exception, and two additional hardening controls — an Attack Surface Reduction rule blocking executable content from email, and PUA Protection in Block mode — were deployed through Intune Endpoint Security.
Business Problem
Point-in-time vulnerability scans miss CVEs disclosed between scan cycles, severity-only prioritisation causes patch fatigue on low-risk findings while high-exploitability items stay open, and there is no formal process for CVEs embedded in vendor-managed components that cannot be patched directly.
Without continuous, risk-based vulnerability management, security teams cannot demonstrate measurable exposure reduction to leadership, third-party application CVEs go unaddressed by OS-only patching, and endpoints remain exposed to known attack techniques while patches are tested and staged.
Business Risks
- Emerging CVEs disclosed between scan cycles remain undetected
- Patch fatigue from prioritising by CVSS score rather than real-world exploitability
- Vendor-bundled third-party CVEs (e.g. OpenSSL in OneDrive) left unpatched with no formal exception process
- No measurable before/after exposure evidence for leadership reporting
- Attack surface left unhardened between patch cycles
Compliance Concerns
- Continuous vulnerability management practice for regulatory and audit expectations
- Documented risk-exception register for vendor-managed findings
Solution Overview
Onboarded the managed device to Microsoft Defender for Endpoint Plan 2 and established a continuous TVM baseline: 57/100 Medium exposure score across 33 detected vulnerabilities.
Prioritised remediation using Defender TVM's exposure and exploitability weighting rather than CVSS alone, identifying the Windows 11 OS update as the single highest-impact action.
Executed the full remediation lifecycle — patched the top finding, formally excepted the vendor-managed OpenSSL CVEs with monitoring, and deployed ASR and PUA Intune policies to harden the endpoint independent of the patch cycle.
Architecture
Architecture diagram placeholder
Technology Stack
Microsoft Defender for Endpoint Plan 2
TVM engine — continuous vulnerability detection and exposure scoring
Threat & Vulnerability Management (TVM)
Risk-based prioritisation by exploitability and exposure, not CVSS alone
Microsoft Intune Endpoint Security
ASR rule deployment and PUA protection policy management
Attack Surface Reduction (ASR) Rules
Blocks executable content delivered via email client and webmail
PUA Protection
Blocks Potentially Unwanted Applications in real time
Microsoft Defender XDR
Unified security operations visibility across the tenant
Lab Environment
- Tenant
- Patchthecloud.onmicrosoft.com
- Licence
- Microsoft Defender for Endpoint Plan 2
- Managed device
- PTC_01 — Windows 11 23H2
- Portal
- security.microsoft.com
- Lab date
- January 2026
Implementation
A phased, expandable walkthrough. Screenshots and evidence can be attached to each phase.
Establish the starting exposure score and vulnerability inventory.
- Onboard PTC_01 to Microsoft Defender for Endpoint Plan 2
- Record baseline exposure score: 57/100 (Medium) across 33 detected vulnerabilities
- Review top recommendations ranked by impact score rather than CVSS alone
Screenshots for this phase can be added here.
PowerShell
Illustrative example snippets — copy or download each script. Production values are placeholders.
Export TVM vulnerabilities, exposure scores, and deploy ASR policy
# Export all device vulnerabilities from Defender TVM via Microsoft Graph
.\Get-TVMVulnerabilityReport.ps1 -DeviceName "PTC_01"
# Deploy Attack Surface Reduction rules via Microsoft Intune (Graph)
.\New-ASRPolicy.ps1 -PolicyName "Block-Email-Executables" -Setting "BlockExecutableContentFromEmailClientAndWebmail"
# Export device exposure scores and TVM recommendations to CSV
.\Get-ExposureScoreReport.ps1 -OutputPath ".\reports\exposure-score.csv"Configuration Screenshots
Click any tile to open the lightbox. Real screenshots will replace these placeholders.
Phase 1
Phase 2
Phase 3
Phase 4
Phase 5
Phase 6
Validation
Baseline Recorded
Exposure score 57/100 (Medium) captured across 33 detected vulnerabilities, 1 exploitable, 0 critical.
Highest-Impact Finding Identified
Windows 11 OS/built-in-app recommendation ranked highest at impact score 57.29 across 30 weaknesses.
OS Remediation Confirmed
Windows Update applied to PTC_01; Windows Update recommendation resolved in TVM.
Vendor Exception Documented
3 OpenSSL CVEs bundled in OneDrive formally recorded as a partial, vendor-managed exception.
ASR Rule Deployed
'Block executable content from email client and webmail' policy assigned to PTC_01 via Intune.
PUA Protection Enabled
PUA Protection set to Block mode via Intune Defender Antivirus policy.
Post-Remediation Status Verified
ASR and PUA recommendations marked Remediated; OpenSSL exception shows 0 exposed critical devices.
Challenges
Vendor-bundled CVEs cannot be patched directly
The OpenSSL CVEs are bundled inside OneDrive rather than being an OS component, so they required a formal risk-exception process instead of a direct patch.
Exposure score lag after remediation
Defender TVM telemetry refreshes on a schedule, so exposure score movement was not immediate after applying the Windows update and required waiting for the next refresh cycle.
Lessons Learned
- TVM prioritises by exploitability, not CVSS alone — a high-CVSS finding with no known exploit can rank below a lower-CVSS finding with active exploit code.
- Third-party vulnerabilities bundled inside Microsoft components require a formal exception process rather than being left in an unacknowledged state.
- ASR rules and PUA protection reduce attack surface immediately, without waiting for a patch cycle to complete.
- Exposure score decreases are not instant — Defender TVM telemetry can take up to 24 hours to reflect a remediation.
- Partial exceptions remain visible in TVM, showing the accepted residual risk rather than silently clearing the finding.
Business Impact
57 / 100 (Medium)
Baseline Exposure Score
30
CVEs Resolved in One Update
3 (OpenSSL)
Vendor Risk Exceptions Documented
2 (ASR + PUA)
Hardening Controls Deployed
Skills Demonstrated
Related Certifications
Certifications this project maps to are highlighted.
Related Blog Articles
Placeholder cards — future TechCertGuide integration.
GitHub Repository
lokeshm-it/Continuous-Threat-Vulnerability-Management
PublicContinuous, risk-based vulnerability management using Microsoft Defender TVM — baseline exposure scoring, CVE remediation lifecycle, vendor risk exceptions, and ASR/PUA hardening.
Download Center
Project Case Study
PDF · Available soon
Architecture Diagram
PDF · Available soon
PowerShell Scripts
ZIP · Available soon
Technical Documentation
PDF · Available soon