Continuous Threat & Vulnerability Management (TVM)

Zero Trust Pillar: Threat Signals | Part of a 7-project Microsoft 365 Security Portfolio
← Project 3: Email Security | Project 5: Defender XDR + Sentinel →

---

Overview

This project implements a continuous Threat & Vulnerability Management (TVM) programme using Microsoft Defender for Endpoint Plan 2 across the Patchthecloud.onmicrosoft.com tenant. TVM replaces point-in-time vulnerability scanning with a continuous, risk-based model: the Defender sensor on each endpoint streams real-time vulnerability telemetry to the TVM engine, which scores and prioritises findings by exploitability, exposure, and business impact.

The implementation demonstrates the full remediation lifecycle: baseline assessment (57/100 Medium exposure score), vulnerability analysis across 33 detected CVEs, Windows OS update to resolve the highest-impact finding, vendor-managed risk exception handling for OpenSSL, and Attack Surface Reduction (ASR) rule deployment alongside PUA protection to reduce attack surface independent of patching.

---

Business Problem

Problem	Enterprise Impact
Point-in-time scanning misses emerging CVEs	Vulnerabilities discovered between scan cycles remain undetected
Severity-only prioritisation creates patch fatigue	Teams patch low-risk CVEs while high-exploitability items remain open
No visibility into third-party application CVEs	OS-only patching leaves application attack surface unaddressed
No measurable remediation outcome	Security team cannot demonstrate exposure reduction to leadership
Attack surface not hardened between patches	Endpoints remain exposed to known attack techniques while updates are tested

---

Objectives

• Establish continuous vulnerability assessment via Defender for Endpoint TVM
• Prioritise vulnerabilities by exploitability and exposure score rather than CVSS alone
• Remediate the highest-impact finding: Windows 11 OS update
• Document and formally exception vendor-managed CVEs (OpenSSL in OneDrive)
• Deploy ASR rule: Block executable content from email client and webmail
• Enable PUA Protection in Block mode via Intune Endpoint Security

---

Environment

Component	Value
Tenant	Patchthecloud.onmicrosoft.com
Licence	Microsoft Defender for Endpoint Plan 2
Managed Device	PTC_01 — Windows 11 23H2
Defender Portal	security.microsoft.com
Intune	Endpoint Security — Antivirus + Attack Surface Reduction policies
Implementation Date	January 2026

---

Architecture

flowchart TD
    A[Windows Endpoint\nPTC_01 — Windows 11 23H2] --> B[Defender for Endpoint Sensor\nContinuous telemetry stream]
    B --> C[Threat & Vulnerability Management Engine\nTVM — security.microsoft.com]

    subgraph TVM["TVM Analysis Layer"]
        C --> D[Vulnerability Detection\n33 CVEs identified]
        D --> E[Risk-Based Prioritisation\nExploitability + Exposure + CVSS]
        E --> F[Remediation Recommendations\nRanked by exposure score impact]
    end

    F --> G{Remediation Decision}

    G -->|Patchable| H[Apply Windows Update\nHighest impact — resolves 30 CVEs]
    G -->|Vendor-managed| I[Risk Exception\nOpenSSL in OneDrive — monitor only]
    G -->|Configuration-based| J[Attack Surface Reduction\nASR + PUA Policy via Intune]

    H --> K[Exposure Score\nPre: 57/100 → Post-update: reduced]
    J --> K

    subgraph Intune["Microsoft Intune — Endpoint Security"]
        J --> L[ASR Rule: Block executable content\nfrom email client and webmail → Block]
        J --> M[PUA Protection → Block mode]
    end

    K --> N[Defender XDR\nUpdated exposure metrics]
    N --> O[Security Operations\nMonitoring + trend reporting]

Loading

---

Microsoft Technologies

Technology	Role
Microsoft Defender for Endpoint Plan 2	TVM engine, vulnerability detection, exposure scoring
Threat & Vulnerability Management (TVM)	Continuous risk-based vulnerability assessment
Microsoft Intune Endpoint Security	ASR rule deployment and PUA protection policy
Attack Surface Reduction (ASR) Rules	Block email-based executable delivery
PUA Protection	Block Potentially Unwanted Applications in real time
Defender XDR	Unified security operations visibility

---

Vulnerability Assessment — Baseline

Exposure Score: 57/100 (Medium)

Metric	Value
Endpoint exposure score	57/100 — Medium
Score range	Low: 0–29 / Medium: 30–69 / High: 70–100
Total vulnerabilities	33
Exploitable vulnerabilities	1
Critical vulnerabilities	0
Zero-day vulnerabilities	0
Vulnerabilities without security update	88 items

Top Recommendations (Baseline)

Recommendation	Impact Score	Weaknesses	Exposed Critical Devices
Update Microsoft Windows 11 (OS and built-in apps)	57.29	30	0
Attention required: vulnerabilities in OpenSSL	30.00	3	0

CVE Sample — Detected Vulnerabilities

CVE	Severity	CVSS	Affected Software	Published
CVE-2025-64673	High	7.8	Microsoft Windows 10 (+4 more)	Dec 9, 2025
CVE-2025-64661	Medium	7.8	Microsoft Windows 10 (+5 more)	Dec 9, 2025
CVE-2025-9230	High	7.5	Oracle OpenSSL (+95 more)	Sep 30, 2025
CVE-2025-64670	Medium	6.5	Microsoft Windows 10 (+3 more)	Dec 9, 2025
CVE-2025-9231	Medium	6.5	Ubuntu Libssl1.0-dev (+28 more)	Sep 30, 2025
CVE-2025-9232	Medium	5.9	Ubuntu Libssl1.0-dev (+37 more)	Sep 30, 2025

---

Remediation Actions

Action 1: Windows 11 Update Applied

• Finding: 30 weaknesses associated with Windows 11 OS and built-in applications
• Impact score: 57.29 (highest)
• Action: Applied Windows Update on PTC_01
• Result: Windows Update recommendation resolved; Windows CVEs (CVE-2025-64673/70/61) remediated

Action 2: OpenSSL — Risk Exception (Vendor-Managed)

• Finding: 3 OpenSSL CVEs (CVE-2025-9230/31/32) embedded in Microsoft-managed components (OneDrive)
• Root cause: OpenSSL bundled with OneDrive — cannot be patched without vendor-released update
• Treatment: Accepted residual risk — monitor for vendor patch; track in exception register
• Outcome: Partial exception recorded in Defender TVM; exposure score impact: 30.00

Action 3: ASR Rule — Block Executable Content from Email Client

• Finding: Recommendation — Block executable content from email client and webmail
• Action: Created Intune Endpoint Security → Attack Surface Reduction Rules policy
• Setting: Block executable content from email client and webmail → Block
• Coverage: PTC_01 via Intune assignment

Action 4: PUA Protection — Block Mode

• Finding: Recommendation — Turn on PUA protection in Block mode
• Action: Edited Intune Endpoint Security → Microsoft Defender Antivirus policy
• Setting: PUA Protection → On — Detected items are blocked
• Coverage: Applies to all Intune-managed devices in assignment scope

---

Post-Remediation Recommendations

After Windows Update applied, remaining recommendations:

Recommendation	Impact	Exposed Devices	Exposed Critical Devices	Status
Attention required: vulnerabilities in OpenSSL	30.00	0	0	Exception — vendor-managed
Turn on PUA protection in block mode	3.00	1	0	✅ Remediated
Block executable content from email client	~3.9	1	0	✅ Remediated

---

Security Controls

Control	Implementation	Zero Trust Alignment
Continuous vulnerability detection	Defender for Endpoint TVM sensor	Verify Explicitly — assume every endpoint is vulnerable
Risk-based prioritisation	Exposure score + exploitability weighting	Least Privilege — focus effort where risk is highest
OS patch management	Windows Update applied for highest-impact finding	Assume Breach — reduce known exploitable surface
Vendor risk exception process	OpenSSL CVEs formally excepted with monitoring	Assume Breach — accept residual risk with visibility
ASR rule enforcement	Block executable content from email via Intune	Assume Breach — block known attack technique
PUA protection	Block mode via Intune Antivirus policy	Verify Explicitly — no application is implicitly trusted

---

PowerShell Scripts

Script	Purpose
Get-TVMVulnerabilityReport.ps1	Export all device vulnerabilities from Defender TVM via Microsoft Graph
New-ASRPolicy.ps1	Deploy Attack Surface Reduction rules via Microsoft Intune (Graph)
Get-ExposureScoreReport.ps1	Export device exposure scores and TVM recommendations to CSV

---

Lessons Learned

• TVM prioritises by exploitability, not CVSS alone. A CVSS 7.8 vulnerability with no known exploit may rank lower than a CVSS 5.9 with active exploit code. Do not use CVSS as the sole remediation priority signal.
• Third-party vulnerabilities in Microsoft components require a formal exception process. OpenSSL embedded in OneDrive cannot be independently patched. Document the risk, monitor for vendor updates, and accept the residual risk — do not leave it in an unacknowledged state.
• ASR rules and PUA protection reduce attack surface without waiting for patches. These configuration-based controls are deployable immediately and address known attack techniques that patches alone do not block.
• Exposure score decreases after remediation but not instantly. Defender TVM telemetry refreshes on a schedule — allow up to 24 hours after applying a fix before expecting score movement.
• Partial exceptions are visible in TVM. When a vulnerability is marked as a partial exception, the exposure score reflects the remaining accepted risk rather than removing it entirely.

---

Troubleshooting

Symptom	Likely Cause	Resolution
Device not appearing in TVM	Device not onboarded to Defender for Endpoint	Verify Defender sensor status in Intune → Device health
Exposure score not decreasing after patch	Defender telemetry refresh delay	Wait 24h; force device sync in Intune
OpenSSL CVEs appearing after Windows update	Vendor-bundled component, not OS component	Accept exception in TVM → Remediation → Exceptions
ASR rule blocking legitimate email attachment	Business process using executable email attachments	Create per-rule exclusion for specific application path
PUA detection blocking legitimate software	Software classified as PUA by Defender	Submit for review to Microsoft at security.microsoft.com

---

Future Improvements

• Configure TVM email notifications for new critical vulnerabilities
• Add additional ASR rules: Block Office from creating child processes, Block macro content
• Integrate TVM exposure score trends into a Power BI dashboard for leadership reporting
• Onboard additional devices to increase coverage and representativeness of the exposure score
• Configure remediation task workflow: assign findings to IT operations team via Intune

---

References

• Microsoft Defender Vulnerability Management
• Attack Surface Reduction Rules
• PUA Protection
• Exposure score
• Risk-based vulnerability management