Microsoft Defender Vulnerability Management enables organizations to identify vulnerabilities, manage patches, and fortify threat detection. It offers endpoint assessments, cloud incident management, and dynamic security through Microsoft's Security Scorecard integration.
| Product | Mindshare (%) |
|---|---|
| Microsoft Defender Vulnerability Management | 1.3% |
| Wiz | 4.7% |
| Qualys Exposure Management | 4.0% |
| Other | 90.0% |
| Company Size | Count |
|---|---|
| Small Business | 9 |
| Midsize Enterprise | 2 |
| Large Enterprise | 7 |
| Company Size | Count |
|---|---|
| Small Business | 203 |
| Midsize Enterprise | 113 |
| Large Enterprise | 287 |
Organizations leverage Microsoft Defender Vulnerability Management for advanced threat detection and response. It provides robust tools for vulnerability assessment and cloud incident management, integrated with Microsoft's Security Scorecard to enhance dynamic security profiling. Key features include automatic patch deployment, security configuration management, and seamless integration with Microsoft platforms, benefiting both on-prem and cloud environments. Organizations can track vulnerabilities with severity-based reports, helping manage outdated software and minimizing threat exposure.
What are the key features of Microsoft Defender Vulnerability Management?In healthcare, Microsoft Defender Vulnerability Management helps manage compliance with health regulations, while in finance, it aids in securing sensitive data from cyber threats. Manufacturing sectors benefit from its patch management, keeping operational technology systems less vulnerable to disruptions.
| Author info | Rating | Review Summary |
|---|---|---|
| Consultant at Dell Technologies | 4.0 | I value Microsoft Defender Vulnerability Management's application control, asset discovery, and real-time threat intelligence. However, its configuration needs simplification and security enhancements, like addressing WinGet bypasses, would greatly improve it. |
| Especialista En Ciberseguridad at FUNDACION UNIVERSITARIA SAN PABLO CEU | 5.0 | I’ve used Microsoft Defender Vulnerability Management personally for two years and find its security configuration features helpful, though rule setup can be confusing without clear guidance. Overall, it’s effective, but accessibility and admin navigation could improve. |
| Microsoft Solutions Manager at Self-Employed | 4.5 | I use Microsoft Defender Vulnerability Management to safeguard customer environments, leveraging its identity focus and automatic remediation features. While effective in many areas, improvements in endpoint defense and next-generation protection would enhance our security strategy on Microsoft Azure. |
| Cloud Security Engineer at a computer software company with 51-200 employees | 3.5 | I've used Microsoft Defender Vulnerability Management for three years; it effectively supports region-specific threats in healthcare, though the documentation is poor, updates are slow, and pricing is high. Overall, I’d rate it seven out of ten. |
| Solution Consultant at BIM Group of Companies | 4.0 | Microsoft Defender Vulnerability Management is essential for my clients needing cybersecurity frameworks knowledge. Its valuable features include CV information and remediation options. However, the portal refresh rate requires improvement as it can take several days to update. |
| DGM. Technical Security at a tech services company with 10,001+ employees | 4.0 | Microsoft Defender Vulnerability Management is primarily used for endpoint and identity protection and vulnerability assessment. It is valued for asset discovery and risk prioritization, though improvements are needed in risk scoring and industry-specific insights. |
| Senior Cloud Security Consultant at MetLife | 4.0 | I primarily use Microsoft Defender Vulnerability Management for endpoint security, leveraging Intune for device onboarding and conducting vulnerability assessments. The recommendations are valuable for fixing vulnerabilities, though automated remediations could be more specific. Our shift from third-party products was due to their challenges. |
| Security Specialist at Prudential Systems Japan | 3.0 | I use Microsoft Defender Vulnerability Management for seamless Office 365 integration, appreciating its quick administration and information retrieval. However, it struggles with stability issues, high resource consumption, and lacks efficient Linux management. Previously, I preferred CrossRack for better support. |
| information Security and IT Manager at Discover Dollar Technologies Pvt Ltd. | 4.0 | I use Microsoft Defender Vulnerability Management to assess and notify us of vulnerabilities on various systems constantly. It excels in vulnerability assessment with detailed CVE data, though the dashboard refresh rate and macOS support need improvement. Analyzing ROI is challenging. |
| EMEAR IT Director at Epson Europe B.v. | 4.0 | I rely on Microsoft Defender Vulnerability Management for endpoint security due to its critical threat intelligence features. Its integration with Sentinel is invaluable, though it's costly. Despite a simple migration from Carbon Black, I'm uncertain about the ROI. |
I can control the applications using Microsoft Defender Vulnerability Management, which are its best features for me personally.
I use the Asset Discovery tool in Microsoft Defender Vulnerability Management.
The Asset Discovery tool helps to prioritize risk.
I can control the applications using Microsoft Defender Vulnerability Management, which are its best features for me personally.
I use the Asset Discovery tool in Microsoft Defender Vulnerability Management.
The Asset Discovery tool helps to prioritize risk.
I have used the real-time threat intelligence feature of Microsoft Defender Vulnerability Management.
The real-time threat intelligence feature is helpful in terms of security.
Configuration of Microsoft Defender Vulnerability Management is something that needs improvement.
In future updates of Microsoft Defender Vulnerability Management, I would like to see security enhancements. For example, for certain applications, even though the product has it, if the Windows Store is blocked, there is a bypass method using the WinGet command.
The configuration part of Microsoft Defender Vulnerability Management is what should be focused on to be less complicated.
I have used Microsoft Defender Vulnerability Management as an application for five to six years.
A couple of weeks is the time one may require for deployment of Microsoft Defender Vulnerability Management. For large organizations, it takes time.
Eight to nine people are involved in the installation process from my side for Microsoft Defender Vulnerability Management.
I have not actually implemented Microsoft Defender Vulnerability Management, but I do support it in terms of the Defender application.
I only provide support and have not been involved in the implementation of Microsoft Defender Vulnerability Management.
The deployment of Microsoft Defender Vulnerability Management is moderate.
I am not sure about the integration of Microsoft security solutions with Microsoft Defender Vulnerability Management.
We are not using the APIs in Microsoft Defender Vulnerability Management for third-party security tool integration.
I would rate this product an 8 overall.
I do not use Microsoft Defender Vulnerability Management at work. However, I am currently not working, but I do use Microsoft Defender Vulnerability Management on my personal computer.
Microsoft Defender Vulnerability Management provides several valuable features that I utilize. I use it to control security configuration, for example, the apps that I use or the many connections from my router. I configured the router of my home to pass first by my computer after discovering that I could do so. With this configuration, I can filter content and malware.
When I create rules, it gave me problems and I did not know where the problem was located. A small pop-up notification indicating how a rule should be configured would be helpful, rather than the pop-up I received which simply stated that I cannot make this action. If I want to place a rule to forbid the action of an app and I do not put the correct route or if I do not have the necessary administrative permissions, it becomes difficult. This experience occurred last year, so some details may not be perfectly clear.
I have used Microsoft Defender Vulnerability Management for approximately two years. I began using it when I started to study cyber security and became interested in these topics.
The setup was very easy because it is on my personal laptop and came pre-installed. The installation process took only a few minutes and was very fast.
I am experiencing scalability issues.
I did not work with other solutions previously.
The initial setup is quite easy.
The automation helps me, and I do not find it too difficult to implement.
I currently have content filtering and a few apps that I have configured for my personal use that I cannot execute. To improve the product, I would suggest making it easier for people to access and for administrators to navigate it faster. My review rating for Microsoft Defender Vulnerability Management is ten out of ten.
Microsoft Defender Vulnerability Management is used by companies that don't want to share their data and identities outside the company.
I am using Microsoft Threat Intelligence Vulnerability Management for customers; it's only within customer environments. We also discussed attack surface reduction and managing Defender Endpoint and MDA solutions for our customers.
The solutions we utilize are capable of detecting risks even when users are not connected to the corporate network. We are using DC sync and AD hybrid projects, along with Defender for Identities and Defender Cloud App, which was previously known as Cloud App Security; we have also used Cloud Access Security Broker for shadow IT scenarios.
I can provide an example of how risk creation affects my work. Microsoft 365 E5, as well as Microsoft 365 E3 and other packages such as Defender for Endpoint Plan 1 or Plan 2, and Windows 10 or Office 365 E3, present substantial capabilities for the next generation available for our customers. We also discuss components such as Azure Security Center, which influences vulnerability and overall security strategy.
My customers utilize agent-based scans; it's primarily agent-based. Assessing scans across cloud workloads is achieved through proactive security; all capabilities are effectively utilized in agent-based scenarios.
The major priority is identity, which is crucial; we have lots of companies in manufacturing, energy, or various sectors, and it varies from one to another.
I assess Microsoft Defender Vulnerability Management as very effective in continuously assessing vulnerabilities without requiring scans. We use automatic investigation and remediation features, safe attachments, safe links, and real-time reports, which are also very effective.
For Active Directory, Defender has threat intelligence, and we are using that. The risk-based prioritization within Vulnerability Management affects my ability to manage vulnerabilities, particularly in relation to the Zero Trust Model utilized by our customers. The end-users often do as they please in their systems.
There is room for enhancement in the major areas of endpoint Defender and Defender ATP; these are the key aspects within Defender. Endpoint defense could be improved, and we could discuss next-generation protection, threat management, and Vulnerability Management as well.
I have been using Microsoft Defender Vulnerability Management since its release, from the beginning.
I faced no difficulties with Microsoft Defender Vulnerability Management; it was easy for me.
Regarding Microsoft's technical support, I would rate it a three out of ten; they could be more responsive and knowledgeable. The support we receive from Microsoft is declining, and for example, after taking advanced support, we have not received satisfactory answers. The knowledge of agents about the product is low. Microsoft outsources support, including to areas such as India and Pakistan.
Negative
The deployment time varies by the project based on what the customer wants. The differences of 365 components and the Defender also main subject usually requires nearly one work day, or more days. It takes around two days for me.
Usually, one or two people are involved; there is a network management person and end-user administrators. It is only used by two people.
Overall, I would rate Microsoft Defender Vulnerability Management a nine out of ten.
I use it mostly for threat management and threats related to the healthcare industry within the GCC and UAE regions.
Microsoft Defender Vulnerability Management has streamlined our threat management processes and provided region-specific customization for our healthcare operations.
The live threat feed is particularly valuable as I can customize it based on the sector I work in. This includes region-specific and domain-specific customization.
It performs effectively as a threat intel platform. The feature for customizing to region-specific and domain-specific requirements in healthcare is particularly beneficial.
The documentation from Microsoft needs significant improvement. The documents are disorganized, with one document linking to another, making the steps unclear and difficult to follow.
Regarding updates, it is not truly real-time as it takes between eight to twelve hours for updates to occur. It would be beneficial if updates could happen more quickly, perhaps within 10 minutes to half an hour.
Support for integration and documentation needs to be more straightforward.
The pricing is expensive, even though it is part of the E5 package.
We have not faced any downtime with this solution. We do not have any backup as it is completely cloud-based. If Microsoft experiences downtime, this solution goes down as it is a SaaS-based solution where we have no control.
The scalability is adequate and supports workloads in on-premises environments. There are no challenges in terms of scalability.
Microsoft solutions are all cloud-based. Our workloads are mostly on-premises as we are not a cloud company yet. The integration is straightforward for those who understand it, though documentation needs improvement.
We communicate with the vendor for support cases. Product training has not been provided. I only interact with Microsoft when creating support tickets.
One concern is that Microsoft often uses external consultants who are not actual Microsoft employees. They are familiar with Microsoft products but are not direct Microsoft staff, which is an area needing improvement.
Neutral
I have used another product from the UK, which is quite well-known. I am unable to share specific details as we are currently using that solution as well.
The ROI is better when a company uses all Microsoft products within the E5 suite. In our case, we use a mix of products from AWS, Google, Fortinet, and CrowdStrike. Organizations typically do not rely solely on Microsoft products to avoid putting all eggs in one basket, which presents a challenge for maximizing ROI.
We are open to discounts on the pricing.
We conducted product comparisons and feature-to-feature evaluations of multiple competitors. We evaluated solutions including ThreatConnect and Rapid7. The selection of Microsoft Defender Vulnerability Management was based on certain benchmarks and organizational requirements.
I found Microsoft Defender Vulnerability Management helpful in understanding different signatures and attack techniques. Based on my experience, I rate Microsoft Defender Vulnerability Management a seven out of ten.
The typical use case for Microsoft Defender Vulnerability Management is that my clients need to know about cybersecurity frameworks such as NIST 800-53 or SOC Type 3, Type 2, which includes Vulnerability Management. In our customer environment, they use most of their products from Microsoft, particularly the Vulnerability Management engine to find out vulnerable information.
Microsoft Defender Vulnerability Management provides us with CV information regarding which CV is currently associated with the devices, and it shows us the recommended plan, along with vulnerabilities and remediation options, which is one of my favorite parts.
My clients usually have M365 E5 subscriptions, which include Defender for Endpoint Plan 2, making it clear that they utilize Microsoft Defender Vulnerability Management.
They may need to improve the portal refresh rate for Microsoft Defender Vulnerability Management because it takes time for recommendations to disappear after mitigation; sometimes, it takes one week, when it should ideally take only one to two hours.
Overall, everything is good with Microsoft Defender Vulnerability Management, but the portal refresh rate can take up to seven days in some cases and three or four days in others to reflect changes.
I have approximately three or four years of experience working with Microsoft Defender Vulnerability Management.
Regarding the stability of Microsoft Defender Vulnerability Management, it is a stable solution, as we have used this product in our customer environment for the past three years with most things working fine, except for the portal refresh rate issue.
The scalability of Microsoft Defender Vulnerability Management should be rated an eight.
The quality of their technical support for Microsoft Defender Vulnerability Management rates as an eight.
Positive
Based on my experience, I would recommend Microsoft Defender Vulnerability Management to others, but I think the portal refresh rate could be improved.
I would recommend other people to use Microsoft Defender Vulnerability Management because it provides insightful information and valuable recommendations, including a CV list.
Microsoft Defender Vulnerability Management is a good product, and I believe it deserves a positive recommendation. I would rate Microsoft Defender Vulnerability Management an eight overall on a scale from 1 to 10.
The main use cases for Microsoft Defender Vulnerability Management among my customers are endpoint protection, identity protection, and vulnerability assessment of software.
My customers mostly use this tool in the IT and ITES industries.
The most useful feature in Microsoft Defender Vulnerability Management is asset discovery.
Regarding Threat Intelligence in Microsoft Defender Vulnerability Management, people should subscribe separately as it is an add-on. I have not applied it to Threat Intelligence but we refer to it as vulnerability exploits; CV priority will be present.
The main advantage of Microsoft Defender Vulnerability Management is that it can locate and prevent most threats even when the endpoints are not connected to the corporate network, as long as the internet is available.
Microsoft Defender Vulnerability Management is capable of continuously monitoring and assessing vulnerabilities without requiring periodic scans.
Risk prioritization in Microsoft Defender Vulnerability Management will be very useful for large organizations and large deployments because they prioritize the risk, allowing me to apply the patches in a very structured and more important way. I can keep the less important patches on hold for a time period, but for most important, critical patches, the risk is prioritized, and I will be able to address that first.
The benefits my customers have gained from Microsoft Defender Vulnerability Management include a single point of visibility of entire risk exposure, complete assessment of risk assessment from the cloud, real-time assessment, and the ability to immediately remediate the risk by applying patches.
I have not thought about improvements for Microsoft Defender Vulnerability Management as of now, but this is typically an operational maintenance process.
The operational maintenance process refers to these products being part of day-to-day operations. Threats keep coming almost daily, and we need to run it, prioritize the risk, and apply the patches. I am not able to think of many features for improvement at this point in time.
There should be risk scoring added to Microsoft Defender Vulnerability Management; specifically, they call it quantification of the risk. If they can provide peer site reviews or risk scoring, such as how my organization in the healthcare industry fares against my peers on average, it would be valuable information.
This scoring should be for specific industries as well. If I belong to the healthcare industry using Microsoft Defender Vulnerability Management, it should provide me with a risk score and show how I fare against the risk score of my industry. If there are guidelines or insights on this, it will compel customers to reduce risk levels or improve their risk scores.
The application block capabilities in Microsoft Defender Vulnerability Management are effective and up to the standards, as everybody is looking at open OSINT and open-source security packages. I think on CV scoring, they are aligned with the industry.
I have been working as an integrator with Microsoft Defender Vulnerability Management for the last two years.
The deployment of Microsoft Defender Vulnerability Management is very easy; I would say not more than three to four hours to start off the implementation. Setting the policies and pushing if the agent is already there may take some time, based on the number of hosts and the organization's size, but typically a thousand users should be able to do it in about ten to fifteen days.
I do not have inputs on the ROI for Microsoft Defender Vulnerability Management; it might be a global decision or enterprise-wide agreement they already have with Microsoft. What the cost for ROI or ROC is remains unclear to me.
I am familiar with Microsoft Defender Vulnerability Management and several security tools: Intune, Defender ATP review, and others are also in the picture.
Defender for Identity is not one I work with, but with Microsoft Defender Vulnerability Management and Intune, we support customers in malware, anti-malware, anti-spyware, and other segments.
Microsoft has made integration very easy, and Microsoft Defender Vulnerability Management has matured itself, so integration is not a big challenge as of now.
I am familiar with agent-based scans only. I would recommend agent-based scans only for continuous monitoring and for more granular insight and telemetry.
My customers usually use Microsoft Defender Vulnerability Management on the cloud.
The license usage for Microsoft Defender Vulnerability Management is available on the website; however, customers should have certain Microsoft licenses as entry points, such as the E1 plan. This solution is meant for enterprise customers only.
For Microsoft Defender Vulnerability Management, customers must subscribe to Microsoft E1 or E3 plans as a prerequisite for embracing these solutions; other dependencies are required for this product to work, as it will not work in silos.
My customers have seen value in Microsoft Defender Vulnerability Management as they made a global decision to buy it because they already have a Microsoft Enterprise Agreement, along with all the tools and SKUs. So, Intune, BitDefender, and Microsoft Defender all become their native choice.
If you are already a Microsoft shop and you are under an EA, it is better to consider Microsoft Defender Vulnerability Management.
I rate Microsoft Defender Vulnerability Management 8 out of 10.
I usually use it in Defender for endpoint side, such as within the 365 Defender umbrella, Defender for Vulnerability Management.
I onboard devices of the organization with the help of Intune or MDM Management. I take care of scanning and doing vulnerability assessments, looking for any future or upcoming vulnerabilities on the devices for the endpoint perspective.
Additionally, I use the attack surface reduction rules to take care of Defender for endpoint security.
The most valuable aspect is the kind of assessment results I get, and the recommendations provided in Microsoft products really help in taking care of the resources. I can fix vulnerabilities and see the current state of the security posture of those devices or particular resources. The recommendations, scores, and steps to remediate actions are highly useful.
The automated remediations can be more specific. However, the score and recommendation aspects are good. Currently, I do not see any significant challenges.
I have approximately four and a half years of experience with Defender products and other Microsoft security products.
For now, I would say the solution is stable. We started using it a couple of years ago. If there are any challenges in the future, we will address them.
I haven't fully explored the scalability aspect yet, but probably in the future.
My team raised multiple support tickets for the product, and we were able to get responses from Microsoft support team. So we are good in that area. I would rate them nine out of ten.
Positive
My organization was using different third-party products before I joined the team. They faced some challenges and hence moved to Microsoft, as they had Microsoft security experts with them.
It is straightforward for me at least, as well as for my team.
Earlier, it was a small team, and now we've grown, so we are quite a sizable team now.
We are aware of the pricing for some parts that we are using. Microsoft documentation helps figure out pricing and other aspects. Overall, every organization wishes for cheaper options, but we look at the security side as well, so we are good for now.
I didn't explore any other products as I started my journey with Microsoft Security products. I am aware of other products but have not deployed them.
I would rate the solution eight out of ten.
I am using Microsoft Defender Vulnerability Management for integration purposes with Office 365. I am utilizing multiple executive products, and the integration with Microsoft makes it easy to manage.
A valuable feature is the ease of management and integration with Microsoft products. I appreciate that I can click on a server in the Defender Console, notice a risk, and retrieve all necessary information. Speed is a key feature as it is very quick to administer and allows for manual configuration from the portal.
There is a good solution from Microsoft, however, there is a gap between Windows and Linux management. The product is not stable; it often uses excessive memory and CPU, which makes it slow. Some employees refrain from using it due to its resource consumption.
I have been using Microsoft Defender Vulnerability Management for three to four months. It is a very new project on my side.
The product is not stable; it is very resource-intensive, consuming a lot of memory and CPU, which makes it slow.
It is scalable; I evaluated the product and decided to use Defender on over 700 of our company servers.
Microsoft support is not so good. It is difficult to communicate with them when issues arise. They are sometimes responsive, however, often issues cannot be reproduced on their end, making it challenging.
I have experience with CrossRack, which I used when working at Dell. It is a very good solution with excellent support.
The initial setup was easy. I used BigFix to deliver the solution, and I designed and checked the script. After delivery, I needed to check the results.
I use BigFix as a tool to deliver the solution, and the script was designed by me. I was responsible for checking the installation requirements on both servers and the cloud side.
I am not aware of the specific financial benefits, however I have heard from my boss that the price is much lower than AWS.
I do not handle pricing as I focus on the technical aspects. I heard the price is cheaper than AWS, however, I cannot provide personal insight.
I recommend using CrossRack over Microsoft Defender. While working at Dell, CrossRack was a very reputable solution with excellent support focused solely on security.
I would rate Microsoft Defender Vulnerability Management a six out of ten.
I handle security, and Microsoft Defender Vulnerability Management assesses our systems, applications, virtual machines, laptops, operating systems, Linux, Unix, and network devices 24/7. It checks if packages and applications are up to date and notifies us of vulnerabilities.
Microsoft Defender Vulnerability Management is versatile and assesses vulnerabilities, providing detailed information on CVEs, their categories, and exploit statuses. It automatically notifies my teams and me about vulnerabilities via email. Additionally, it closes alerts with justifications based on historical data, thanks to integrated AI capabilities.
The worst aspect is the refresh rate of the dashboard. A vulnerability I patch within 15 minutes takes 24 additional hours for an update. Some competitors offer a four-hour refresh. I would like to see an update in the refresh rate and increased support for macOS.
I have used the solution for more than three years.
There are no significant stability problems, but there are compatibility issues occasionally arising with false positives when other security tools are not whitelisted in Microsoft Defender.
We continue to evaluate other solutions like Cortex XDR but found compatibility issues with Defender, requiring temporary disabling on test machines.
The initial setup is not complex. Administrators handle the process on the backend using Intune, and users can start using the system without hassle.
My team and I take care of maintenance and setup in-house.
The licensing of Microsoft Defender Vulnerability Management is part of a package with other services, making it difficult to isolate ROI for this solution specifically. It's vital for our operation but provides inconclusive ROI data alone.
The pricing of Microsoft Defender Vulnerability Management is tied to the premium licensing package. We cannot separate specific costs for just the vulnerability management features.
For small to medium businesses, Microsoft Security Suite offers a comprehensive solution that covers security adequately if set up correctly by administrators.
I rate the overall solution an eight out of ten.
Cybersecurity, threat intelligence, and vulnerability protection are critical to my business. I implemented this solution to ensure I have the best protection for my endpoints.
The integration with Sentinel has been one of the most valuable features for my organization. It helps streamline my operations and enhance my security posture significantly.
Probably my only criticism would be the cost. It is expensive.
I have used the solution for two years.
Everyone was affected by the CloudStrike incident. You may recall that compromise.
I rate customer service a ten out of ten.
Positive
I migrated away from Carbon Black. The migration process was very simple. I used Carbon Black previously.
The initial setup process is very simple.
It is hard to say what the ROI is. Not really seeing a return on investment.
I would advise others to consider the cost as it is significant.
Overall, I would rate the product an eight out of ten.
