Microsoft has significantly expanded Threat & Vulnerability Management capabilities in Defender for Business. Here's what's new and how MSPs should be incorporating it into monthly client reviews.
Key takeaways
- 1Network device assessment — Defender can now discover and assess the security posture of network devices (routers, switches, firewalls) on the same network as enrolled endpoints, g
- 2Expanded software library — the vulnerability database now covers more than 400,000 known vulnerabilities across a broader range of applications, including many NZ-common business
- 3Browser extension inventory — browser extensions are now inventoried and assessed for risk, identifying extensions with excessive permissions or known malicious behaviour
- 4Certificate assessment — TVM now identifies SSL/TLS certificates approaching expiry on managed endpoints, preventing certificate-related outages
Microsoft's Threat & Vulnerability Management (TVM) capabilities have continued to expand in Defender for Business. The 2025 updates include improved network device discovery, expanded software coverage, and better integration with Intune for one-click remediation deployment.
What's new in TVM
- Network device assessment — Defender can now discover and assess the security posture of network devices (routers, switches, firewalls) on the same network as enrolled endpoints, giving visibility beyond managed workstations
- Expanded software library — the vulnerability database now covers more than 400,000 known vulnerabilities across a broader range of applications, including many NZ-common business applications
- Browser extension inventory — browser extensions are now inventoried and assessed for risk, identifying extensions with excessive permissions or known malicious behaviour
- Certificate assessment — TVM now identifies SSL/TLS certificates approaching expiry on managed endpoints, preventing certificate-related outages
One-click remediation via Intune
The integration between TVM and Intune has improved significantly. For many software vulnerability recommendations, TVM now provides a direct "Remediate" button that creates an Intune deployment to update the affected software across all enrolled devices — without leaving the Defender portal. Optimyze uses this workflow for common vulnerabilities (browser updates, Office patches, Java, Adobe Reader) as part of monthly vulnerability management.
Exposure score trend
TVM's exposure score now includes a 90-day trend with contextual comparison to similar organisations. This provides useful benchmarking context for monthly client reports — showing not just current exposure but improvement trajectory and how the client compares to similar businesses in their sector.
