MDVM vulnerability identification on system

Question

Hey,

I would like to understand how Microsoft defender vulnerability management (MDVM) , through Microsoft Defender for Endpoint agent installed on a system , identifies vulnerabilities on that system?

From what I've read , it doesn't work like a traditional vulnerability scanner that runs scans for identification.

My question is how does it actually detect the software installed on a system and identify vulnerabilities in it? And what's the process behind?

Answer 1

MDVM identifies vulnerabilities primarily through the same endpoint sensors and agent used by Microsoft Defender for Endpoint, not by relying only on traditional scheduled network-style scans.

How it works:

1. Uses Defender for Endpoint signals Defender Vulnerability Management uses the same agent as Microsoft Defender for Endpoint. Its discovery capability uses the same set of signals responsible for Defender for Endpoint detection and response.
2. Discovers installed software from endpoint telemetry MDVM builds software visibility from endpoint sensor data and shows it in inventory views such as:
   • Device inventory for devices seen in the environment
   • Software inventory for known software in the organization
   The software inventory includes vendor, weaknesses, threats, and exposed devices for software with a recognized CPE. If software has no CPE, it can still appear in inventory, but vulnerability-specific data such as weaknesses and exposed devices isn't available for that software.
3. Maps software evidence to known vulnerabilities MDVM uses CPEs to identify software and associated vulnerabilities. It then correlates discovered software and device state with known CVEs so vulnerabilities can be shown on the Vulnerabilities or Weaknesses page.
4. Works in near real time The discovery engine is described as real time, so vulnerability information can appear within minutes as it is discovered. It also pulls information from multiple security feeds.
5. Applies device-level detection logic For a given CVE on a device, MDVM can show the detection logic used to determine that the device is vulnerable. In the device’s Discovered vulnerabilities view, the vulnerability flyout includes a Detection logic section that shows the logic and source.
6. Considers OS features when relevant MDVM does not just match software names. In relevant cases it also checks whether a vulnerable OS component is actually enabled. For example, a CVE affecting a Windows Server DNS component is attached only to devices where that DNS capability is enabled.

In short, the process is:

• Defender for Endpoint sensor collects endpoint signals
• MDVM discovers software and device configuration/state from those signals
• Software is normalized using CPE where available
• MDVM correlates that evidence with CVEs and other vulnerability intelligence
• Device-specific detection logic determines whether the CVE applies to that device
• Results appear in inventories and vulnerability views

This is why MDVM behaves differently from a traditional active scanner: it is sensor-driven and evidence-based on the endpoint, with vulnerability applicability determined from discovered software, OS components, and detection logic rather than only from periodic probe-based scans.

---

• Common questions about machine vulnerability scanning with Microsoft Defender Vulnerability Management
• Vulnerabilities in my organization
• Software inventory
• Essential Eight patch operating systems