Every Defender for Endpoint deployment is already sitting on a decent amount of vulnerability-relevant telemetry. Microsoft Defender Vulnerability Management (MDVM) is Microsoft’s product for actually using it, turning the existing endpoint agent into a vulnerability scanner rather than requiring a separate one.
What is Microsoft Defender Vulnerability Management?
MDVM is Microsoft’s vulnerability management add-on, built on top of the Defender for Endpoint sensor. It provides continuous, agent-based vulnerability and misconfiguration assessment, software inventory, and browser extension/certificate risk visibility, all inside the Microsoft Defender portal alongside endpoint detection and response data. A standalone edition also exists for organisations that want the vulnerability scanning without full Defender for Endpoint licensing.
Key features
- Agent-based continuous assessment – reuses the Defender for Endpoint sensor, so there’s no separate scan engine for already-managed endpoints.
- Software and browser extension inventory – tracks installed applications and browser extensions organisation-wide, including shadow IT software installs.
- Security baselines assessment – checks configuration against Microsoft’s recommended security baselines, not just missing patches.
- Certificate inventory – flags expiring or weak certificates across the estate, a gap many pure vulnerability scanners don’t cover well.
- Authenticated network scans – can also scan unmanaged Windows devices on the network via an authenticated scan from a Defender-managed device, extending coverage beyond agent-only endpoints.
Who it’s for
Organisations already running Defender for Endpoint who want vulnerability management without adding a separate agent or console. It’s a strong fit for Windows-heavy estates specifically, since coverage depth for macOS and Linux, while present, doesn’t match the Windows-specific features.
Microsoft Defender Vulnerability Management vs the alternatives
Against Tenable and Qualys, MDVM is generally lighter on cross-platform and network device coverage but has zero additional deployment friction if you’re already licensed for Defender for Endpoint Plan 2 or above (where a baseline of MDVM is included). Against CrowdStrike Falcon Spotlight, both are “reuse the EDR agent” plays from competing endpoint platforms – the choice mostly follows whichever EDR you’ve already standardised on.
Getting started
Check your current Microsoft 365 or Defender for Endpoint licensing tier before purchasing anything additional – core Defender Vulnerability Management capability is included with several existing Microsoft security bundles, with a Premium add-on available for advanced features like security baselines and browser extension risk assessment.
Leave a Reply
You must be logged in to post a comment.