MDVM vulnerability identification on system

First23 0 Reputation points
2026-08-21T12:30:59.1366667+00:00

Hey,

I would like to understand how Microsoft defender vulnerability management (MDVM) , through Microsoft Defender for Endpoint agent installed on a system , identifies vulnerabilities on that system?

From what I've read , it doesn't work like a traditional vulnerability scanner that runs scans for identification.

My question is how does it actually detect the software installed on a system and identify vulnerabilities in it? And what's the process behind?

Microsoft Security | Microsoft Defender | Other
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Bence Weiszmann 745 Reputation points
    2026-08-26T19:59:29.2566667+00:00

    Dear @First23

    Yes, you're correct that Microsoft Defender Vulnerability Management doesn't work like a traditional network vulnerability scanner.

    The main difference is that MDVM gets a lot of its information directly from the endpoint through the Microsoft Defender for Endpoint sensor.

    For example, if an application is installed, the MDE sensor can collect information about the application and its version. MDVM then uses that software inventory and compares it with Microsoft's vulnerability intelligence to determine whether that particular version is affected by a known vulnerability/CVE.

    So, conceptually, it's something like:

    Endpoint --› MDE sensor --› Software inventory --› Vulnerability intelligence --› Vulnerability assessment

    This is quite different from a traditional scanner that would connect to the host, enumerate ports/services, fingerprint applications and potentially perform specific vulnerability checks.

    There are also situations where MDVM can identify vulnerabilities without relying solely on an application being actively running. The endpoint telemetry provides Microsoft with information about the software and OS state that can be evaluated centrally.

    One important point, though: MDVM isn't simply "scanning the machine from the cloud." The MDE sensor is a key part of the visibility that makes this possible.

    If this answers your query, please click Accept Answer and Upvote if you found it helpful. If you have any further questions, feel free to let us know.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-08-21T12:31:16.72+00:00

    MDVM identifies vulnerabilities primarily through the same endpoint sensors and agent used by Microsoft Defender for Endpoint, not by relying only on traditional scheduled network-style scans.

    How it works:

    1. Uses Defender for Endpoint signals Defender Vulnerability Management uses the same agent as Microsoft Defender for Endpoint. Its discovery capability uses the same set of signals responsible for Defender for Endpoint detection and response.
    2. Discovers installed software from endpoint telemetry MDVM builds software visibility from endpoint sensor data and shows it in inventory views such as:
      • Device inventory for devices seen in the environment
      • Software inventory for known software in the organization
      The software inventory includes vendor, weaknesses, threats, and exposed devices for software with a recognized CPE. If software has no CPE, it can still appear in inventory, but vulnerability-specific data such as weaknesses and exposed devices isn't available for that software.
    3. Maps software evidence to known vulnerabilities MDVM uses CPEs to identify software and associated vulnerabilities. It then correlates discovered software and device state with known CVEs so vulnerabilities can be shown on the Vulnerabilities or Weaknesses page.
    4. Works in near real time The discovery engine is described as real time, so vulnerability information can appear within minutes as it is discovered. It also pulls information from multiple security feeds.
    5. Applies device-level detection logic For a given CVE on a device, MDVM can show the detection logic used to determine that the device is vulnerable. In the device’s Discovered vulnerabilities view, the vulnerability flyout includes a Detection logic section that shows the logic and source.
    6. Considers OS features when relevant MDVM does not just match software names. In relevant cases it also checks whether a vulnerable OS component is actually enabled. For example, a CVE affecting a Windows Server DNS component is attached only to devices where that DNS capability is enabled.

    In short, the process is:

    • Defender for Endpoint sensor collects endpoint signals
    • MDVM discovers software and device configuration/state from those signals
    • Software is normalized using CPE where available
    • MDVM correlates that evidence with CVEs and other vulnerability intelligence
    • Device-specific detection logic determines whether the CVE applies to that device
    • Results appear in inventories and vulnerability views

    This is why MDVM behaves differently from a traditional active scanner: it is sensor-driven and evidence-based on the endpoint, with vulnerability applicability determined from discovered software, OS components, and detection logic rather than only from periodic probe-based scans.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.