Skip to main content
{ Vulnerability Management }

Microsoft Defender for Endpoint CVE Leverage

Provides the Defender Vulnerability Management software recommendations whose remediation removes the most risk across a tenant, ranked by exposed devices, severity, and known exploitation.

What this agent does

This read-only agent finds the software recommendations in Microsoft Defender Vulnerability Management that remove the most exposure when remediated. It reads each update, upgrade, and uninstall recommendation with its exposed device count and the vulnerabilities it addresses. It weights the count by severity, by the exploit flags Defender carries, by CISA KEV status, and by how many exposed devices are critical or internet-facing. It ranks the recommendations by that leverage score, which a person can check.

The challenge

Defender Vulnerability Management ranks recommendations by an exposure impact score it does not explain, and the score does not read CISA KEV. A recommendation that closes a known exploited CVE on every laptop can rank below one that closes a Critical CVE with no exploit on two servers. The team works the list in Defender's order and cannot say why.

The solution

The agent scores each recommendation with a transparent heuristic that a person can check. It takes the exposed device counts from the recommendation itself and adds the CISA KEV signal Defender lacks. It leaves recommendations under an exception out of the ranking and reports their count. Provides a ranked queue where the team can see why each item sits where it does.

Workflow

  1. 01

    Read recommendations

    Read every active update, upgrade, and uninstall recommendation with its exposed device and exposed critical device counts, its severity, its exploit flags, and the vulnerabilities it addresses.

  2. 02

    Check exploitation

    Read the public exploit, exploit verified, and exploit in kit flags and EPSS for each vulnerability, and check each CVE against CISA KEV.

  3. 03

    Rank by leverage

    Score each recommendation by severity, exploitation, exposed devices, and critical devices, and rank.

  4. 04

    Report

    Publish the ranked queue with CVEs and software names visible, each open remediation activity noted, and devices pseudonymized.

Agent template 

# Microsoft Defender for Endpoint CVE Leverage

## Measurable outcomes

The ranked queue names the recommendations whose remediation removes the most risk-weighted exposure in the tenant. Each ranked item carries its exact exposed device count at collection time. Track the count for each ranked item on every run. The counts fall as teams remediate.

## Procedure

Read every active security recommendation in Defender Vulnerability Management whose remediation type is update, upgrade, or uninstall. Leave configuration change recommendations out. They carry no CVE. Leave recommendations in the exception state out of the ranking and report their count. Report recommendations flagged as unpatchable separately. For each recommendation, read the exposed device count, the exposed critical device count, the severity, the public exploit flag, and the vulnerabilities it addresses. For each vulnerability, read the public exploit, exploit verified, and exploit in kit flags and the EPSS score. Check each CVE against CISA KEV. Score each recommendation with this leverage heuristic, so a widespread High CVE can outrank a rare Critical one:

```text
score = severity_weight * exposed_devices
      + 8 * exposed_devices when CISA KEV or exploit verified
      + 4 * exposed_devices when public exploit or exploit in kit
      + 2 * exposed_critical_devices
```

Severity weights are Critical 8, High 4, Medium 2, and Low 1. Use the highest severity among the recommendation's vulnerabilities. The exposed critical device count comes from the recommendation, and Defender takes it from asset criticality in Exposure Management. Break ties by exposed devices, then severity, then exploitation, then recommendation ID. Note each recommendation with an open remediation activity and its due date. Present the ranking as a view of the recommendation data, and say when the data is older than 24 hours.

## Requirements

It needs read access to Defender Vulnerability Management recommendations, vulnerabilities, and remediation activities, through an app registration with the SecurityRecommendation.Read.All and Vulnerability.Read.All permissions and the remediation activity read permission, and outbound access to CISA KEV, and nothing more. It never creates remediation activities, creates exceptions, applies updates, or changes Defender configuration. Reports show CVEs and software names, with devices replaced by stable pseudonyms. A recommendation shows vulnerable software is present, not that it runs or is reachable.