https://securitynews.ms/products/microsoft-security-exposure-management/Microsoft Security Exposure Management news and documented product changes, each linked to Microsoft's own source.enWed, 11 Nov 2026 22:16:38 +0000https://learn.microsoft.com/en-us/security-exposure-management/whats-new#codename-mdash---mai-cyber-configuration-now-uses-mai-cyber-11-flashhttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#codename-mdash---mai-cyber-configuration-now-uses-mai-cyber-11-flashWed, 11 Nov 2026 22:16:38 +0000Exposure Management · Microsoft LearnThe MAI Cyber (Preview) scan configuration now uses MAI-Cyber-1.1-Flash instead of MAI-Cyber-1-Flash. If your Foundry already uses MAI-Cyber-1-Flash, it’s automatically upgraded in Foundry to MAI-Cyber-1.1-Flash.https://learn.microsoft.com/en-us/security-exposure-management/whats-new#posture-policies-and-recommendation-exemptions-available-for-azure-environmentshttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#posture-policies-and-recommendation-exemptions-available-for-azure-environmentsThu, 01 Oct 2026 00:00:00 +0000Exposure Management · Microsoft LearnOctober 28, 2026 Posture policies and recommendation exemptions are now available in public preview as part of Microsoft Security Exposure Management for Azure environments. With these new capabilities, you can: Gain visibility into your security posture through evaluations of Azure…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#codename-mdash---mai-cyber-configuration-now-uses-mai-cyber-11-flashhttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#codename-mdash---mai-cyber-configuration-now-uses-mai-cyber-11-flashThu, 01 Oct 2026 00:00:00 +0000Exposure Management · Microsoft LearnThe MAI Cyber (Preview) scan configuration now uses MAI-Cyber-1.1-Flash instead of MAI-Cyber-1-Flash. If your Foundry already uses MAI-Cyber-1-Flash, it’s automatically upgraded in Foundry to MAI-Cyber-1.1-Flash. MAI Cyber (Preview) is now the recommended scan configuration for MDASH.https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#october-2026--vulnerability-assessment-for-microsoft-store-applicationshttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#october-2026--vulnerability-assessment-for-microsoft-store-applicationsThu, 01 Oct 2026 00:00:00 +0000Exposure Management · Microsoft LearnVulnerability assessment for Microsoft Store applications. Vulnerability assessment for applications installed via the Microsoft Store is now generally available. Defender Vulnerability Management detects supported Microsoft Store applications, adds them to the software inventory, and assesses them for vulnerabilities. Coverage is…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#improved-onboarding-experience-for-mdashhttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#improved-onboarding-experience-for-mdashTue, 01 Sep 2026 00:00:00 +0000Exposure Management · Microsoft LearnThe MDASH onboarding experience has been improved to make setup clearer and more guided. Instead of a single panel that contains all setup steps, onboarding is now organized into clear tasks that users complete as part of the flow. This…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#codename-mdash---scan-progress-monitoringhttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#codename-mdash---scan-progress-monitoringTue, 01 Sep 2026 00:00:00 +0000Exposure Management · Microsoft LearnScan progress helps you understand whether a scan is waiting, processing code, validating findings, or publishing results. Check completed work, elapsed time, and output availability to understand what is happening during a long-running scan. For more information, see Monitor scan…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#september-2026--new-microsoft-secure-score-recommendations-for-ai-readinesshttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#september-2026--new-microsoft-secure-score-recommendations-for-ai-readinessTue, 01 Sep 2026 00:00:00 +0000Exposure Management · Microsoft LearnNew Microsoft Secure Score recommendations for AI-Readiness. Microsoft Defender now brings together six security recommendations for AI-Readiness to help organizations strengthen endpoint trust against AI-accelerated cyberattacks. Together, these recommendations provide a layered security baseline that helps reduce externally visible entry…https://techcommunity.microsoft.com/t5/microsoft-security-exposure/containment-strategies-for-ai-now-available-in-secure-now/ba-p/4539827https://techcommunity.microsoft.com/t5/microsoft-security-exposure/containment-strategies-for-ai-now-available-in-secure-now/ba-p/4539827Wed, 05 Aug 2026 15:45:47 +0000Microsoft Security Exposure Management BlogRecent public disclosures have reinforced why building foundational security matters. Security researchers and leading AI labs have highlighted scenarios where autonomous AI systems were able to exploit common security weaknesses, move across trust boundaries, and perform actions at a speed and scale…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#keyless-authentication-for-the-microsoft-foundry-connection-previewhttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#keyless-authentication-for-the-microsoft-foundry-connection-previewSat, 01 Aug 2026 00:00:00 +0000Exposure Management · Microsoft LearnYou can now connect your Microsoft Foundry resource to codename MDASH using Keyless authentication , the recommended method. Keyless relies on a managed identity instead of a stored secret - no API key is kept in Defender, and there's no…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#codename-mdash---cancel-scanhttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#codename-mdash---cancel-scanSat, 01 Aug 2026 00:00:00 +0000Exposure Management · Microsoft LearnScan cancellation, previously available only in Defender CLI, is now also available in the Microsoft Defender portal. You can cancel queued or running scans from the scan details page in the Scans tab. For more information, see Cancel scan .https://learn.microsoft.com/en-us/security-exposure-management/whats-new#codename-mdash---azure-devops-connector-previewhttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#codename-mdash---azure-devops-connector-previewSat, 01 Aug 2026 00:00:00 +0000Exposure Management · Microsoft LearnThe Azure DevOps connector is now available in preview for Codename MDASH - Agentic code scanner. Security teams can connect Azure DevOps organizations from the Microsoft Defender portal, onboard repositories, and trigger remote on-demand agentic code scans for the onboarded…https://techcommunity.microsoft.com/t5/microsoft-security-exposure/prioritize-exposure-resolution-with-a-new-dashboard-experience/ba-p/4540163https://techcommunity.microsoft.com/t5/microsoft-security-exposure/prioritize-exposure-resolution-with-a-new-dashboard-experience/ba-p/4540163Mon, 27 Jul 2026 13:30:43 +0000Microsoft Security Exposure Management BlogCut Through the Noise and Focus on What Matters Most Security teams face a constant challenge: too many findings, too many dashboards, and not enough clarity on where to act first. Organizations today are managing vulnerabilities, internet-facing assets, misconfigurations, code weaknesses, exposed…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#ot-data-connectors-in-microsoft-security-exposure-managementhttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#ot-data-connectors-in-microsoft-security-exposure-managementWed, 01 Jul 2026 00:00:00 +0000Exposure Management · Microsoft LearnMicrosoft Security Exposure Management now supports operational technology (OT) data connectors for Armis, Dragos, and Forescout. OT data connectors bring OT asset and vulnerability data from supported third-party OT platforms into the Defender portal. This helps security teams view OT…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#codename-mdash---mai-augmented-scan-profile-previewhttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#codename-mdash---mai-augmented-scan-profile-previewWed, 01 Jul 2026 00:00:00 +0000Exposure Management · Microsoft LearnThe MAI-Augmented scan profile is now available in preview as part of Codename MDASH. The MAI-Augmented profile can be used when triggering a scan through the Defender CLI. It includes MAI-Cyber-1-Flash, a new cyber-specialized model that extends the current agentic…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#codename-mdash---mai-augmented-scan-profile-now-available-for-on-demand-scans-previewhttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#codename-mdash---mai-augmented-scan-profile-now-available-for-on-demand-scans-previewWed, 01 Jul 2026 00:00:00 +0000Exposure Management · Microsoft LearnExpanding on the previously released Defender CLI support, the MAI-Augmented scan profile is now also available in preview for on-demand scans triggered from the Microsoft Defender portal. Security teams can select this profile when starting an on-demand scan from the…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#codename-mdash---agentic-code-scanner-private-previewhttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#codename-mdash---agentic-code-scanner-private-previewWed, 01 Jul 2026 00:00:00 +0000Exposure Management · Microsoft LearnCodename MDASH - Agentic code scanner is now available in private preview in Microsoft Security Exposure Management. Codename MDASH uses a multi-model agentic AI system to detect code vulnerabilities with greater depth and accuracy than traditional static analysis. Security teams…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#overview-dashboard-previewhttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#overview-dashboard-previewMon, 01 Jun 2026 00:00:00 +0000Exposure Management · Microsoft LearnThe updated Microsoft Security Exposure Management overview dashboard is now in preview. The dashboard consolidates signals from cloud resources and devices into a single, action-oriented view of exposure risk, organized around two core actions: Resolve Now and Monitor Exposure …https://learn.microsoft.com/en-us/security-exposure-management/whats-new#new-predefined-classifications-for-ai-agentshttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#new-predefined-classifications-for-ai-agentsMon, 01 Jun 2026 00:00:00 +0000Exposure Management · Microsoft LearnThe following predefined AI agent classification rules were added to the critical assets list: Classification Description Executive-Sponsored AI Agent This rule applies to AI agents that are created or owned by senior executives in the organization. As such, these agents…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#new-predefined-classifications-1https://learn.microsoft.com/en-us/security-exposure-management/whats-new#new-predefined-classifications-1Mon, 01 Jun 2026 00:00:00 +0000Exposure Management · Microsoft LearnThe following predefined SaaS application classification rules were added to the critical assets list. These classifications require onboarding to Microsoft Defender for Cloud Apps. Classification Description Microsoft Entra ID Core identity and access control plane for the tenant. Compromise can…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#new-predefined-classificationshttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#new-predefined-classificationsMon, 01 Jun 2026 00:00:00 +0000Exposure Management · Microsoft LearnThe following predefined Identity classification rules were added to the critical assets list: Classification Description Widespread Local Admin on Servers This rule applies to identities that are configured as local administrators on a high number of servers in the environment…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#june-2026--new-microsoft-secure-score-recommendationhttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#june-2026--new-microsoft-secure-score-recommendationMon, 01 Jun 2026 00:00:00 +0000Exposure Management · Microsoft LearnNew Microsoft Secure Score recommendation. Microsoft Secure Score now includes the Reduce unnecessary inbound internet exposure on internet-facing devices recommendation, which helps identify devices that are accessible from the public internet and may represent unnecessary attack surface. Internet-facing devices are…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#june-2026--enhanced-exposure-score-in-defender-vulnerability-managementhttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#june-2026--enhanced-exposure-score-in-defender-vulnerability-managementMon, 01 Jun 2026 00:00:00 +0000Exposure Management · Microsoft LearnEnhanced exposure score in Defender Vulnerability Management. The new exposure score model in Defender Vulnerability Management is now generally available. This model improves risk prioritization and recommendation impact accuracy by incorporating exploit prediction data (EPSS) and asset context factors such…https://techcommunity.microsoft.com/t5/microsoft-defender-vulnerability/introducing-the-updated-exposure-score-in-microsoft-defender/ba-p/4524217https://techcommunity.microsoft.com/t5/microsoft-defender-vulnerability/introducing-the-updated-exposure-score-in-microsoft-defender/ba-p/4524217Sun, 31 May 2026 11:47:34 +0000Microsoft Defender Vulnerability Management BlogWe are introducing an updated exposure score model in Microsoft Defender Vulnerability Management, now available in public preview. Security teams use the exposure score to understand vulnerability posture, prioritize remediation, and explain progress to leadership. The updated model helps make that score…https://techcommunity.microsoft.com/t5/microsoft-defender-vulnerability/how-to-exclude-specific-cves-with-cve-exceptions-in-microsoft/ba-p/4523507https://techcommunity.microsoft.com/t5/microsoft-defender-vulnerability/how-to-exclude-specific-cves-with-cve-exceptions-in-microsoft/ba-p/4523507Thu, 28 May 2026 08:06:04 +0000Microsoft Defender Vulnerability Management BlogNot every CVE should be handled the same way, and choosing the wrong exception type can remove more risk visibility than intended. A security recommendation can include many CVEs. If only one CVE is out of scope, excluding the full recommendation can…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#new-predefined-classificationhttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#new-predefined-classificationFri, 01 May 2026 00:00:00 +0000Exposure Management · Microsoft LearnThe following predefined Device classification rule was added to the critical assets list: Classification Description Senior Executive User Workstation Devices in frequent use by users classified as senior executives. This rule logic relies on the predefined critical identity classifications whose…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#may-2026--enhanced-exposure-score-in-defender-vulnerability-managementhttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#may-2026--enhanced-exposure-score-in-defender-vulnerability-managementFri, 01 May 2026 00:00:00 +0000Exposure Management · Microsoft LearnEnhanced exposure score in Defender Vulnerability Management. The new exposure score model in Defender Vulnerability Management is now available in preview. This model improves risk prioritization and recommendation impact accuracy by incorporating exploit prediction data (EPSS) and asset context factors…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#new-predefined-classifications-2https://learn.microsoft.com/en-us/security-exposure-management/whats-new#new-predefined-classifications-2Wed, 01 Apr 2026 00:00:00 +0000Exposure Management · Microsoft LearnThe following predefined Cloud resource classification rule was added to the critical assets list: Classification Description APIs with Sensitive Data This rule applies to APIs that contain sensitive data. This often indicates that the API is used for critical production…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#april-2026--new-microsoft-secure-score-recommendationhttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#april-2026--new-microsoft-secure-score-recommendationWed, 01 Apr 2026 00:00:00 +0000Exposure Management · Microsoft LearnNew Microsoft Secure Score recommendation. Microsoft Secure Score now includes the Ensure devices are updated to Secure Boot 2023 certificates and boot manager , which helps identify devices that haven't yet transitioned to the new Secure Boot 2023 certificates required…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#updates-to-secure-score-category-calculations-for-increased-accuracyhttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#updates-to-secure-score-category-calculations-for-increased-accuracySun, 01 Mar 2026 00:00:00 +0000Exposure Management · Microsoft LearnTo improve accuracy and better protect organizational identities, some security recommendations categorized as Cloud apps recommendations are now considered identity‑related and grouped under the Identity category. While the total Secure Score remains unchanged, individual identity and app scores may change.https://learn.microsoft.com/en-us/defender-xdr/whats-new#march-2026--cloud-appshttps://learn.microsoft.com/en-us/defender-xdr/whats-new#march-2026--cloud-appsSun, 01 Mar 2026 00:00:00 +0000Exposure Management · Microsoft LearnTo improve accuracy and better protect organizational identities, we've made updates to the Secure Score category calculations. Some security recommendations categorized as Cloud apps recommendations are now considered identity‑related and grouped under the Identity category. While the total Secure Score…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#march-2026--new-microsoft-secure-score-recommendationshttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#march-2026--new-microsoft-secure-score-recommendationsSun, 01 Mar 2026 00:00:00 +0000Exposure Management · Microsoft LearnNew Microsoft Secure Score recommendations. Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques: - Block outbound network connections from Microsoft HTML Application Host (mshta.exe): Helps mitigate attacks that leverage mshta.exe (a trusted…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#march-2026--new-microsoft-secure-score-recommendations-1https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#march-2026--new-microsoft-secure-score-recommendations-1Sun, 01 Mar 2026 00:00:00 +0000Exposure Management · Microsoft LearnNew Microsoft Secure Score recommendations. Microsoft Secure Score now includes new recommendations to help organizations reduce exposure to common attack techniques involving remote access and authentication relay attacks: - Block file transfer over RDP : Restricts file transfer capabilities in…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#february-2026--vulnerable-components-page-renamed-to-software-componentshttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#february-2026--vulnerable-components-page-renamed-to-software-componentsSun, 01 Feb 2026 00:00:00 +0000Exposure Management · Microsoft LearnVulnerable components page renamed to Software components. To reflect Defender Vulnerability Management's visibility into all software components identified in your organization, the Vulnerable components page is now named Software components .https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#february-2026--support-for-software-product-vulnerability-data-on-windows-7https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#february-2026--support-for-software-product-vulnerability-data-on-windows-7Sun, 01 Feb 2026 00:00:00 +0000Exposure Management · Microsoft LearnSupport for software product vulnerability data on Windows 7. To provide comprehensive vulnerability management capabilities across all supported Windows versions, Microsoft Defender Vulnerability Management now gathers software product vulnerability data on Windows 7 devices.https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#february-2026--improved-device-vulnerabilities-report-experiencehttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#february-2026--improved-device-vulnerabilities-report-experienceSun, 01 Feb 2026 00:00:00 +0000Exposure Management · Microsoft LearnImproved Device Vulnerabilities report experience. To simplify and streamline the Device vulnerabilities report experience, the Vulnerable devices report now includes the following changes and enhancements: - The Vulnerable devices by Windows 10/11 version over time section is now removed. -…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#new-predefined-classifications-3https://learn.microsoft.com/en-us/security-exposure-management/whats-new#new-predefined-classifications-3Thu, 01 Jan 2026 00:00:00 +0000Exposure Management · Microsoft LearnThe following predefined Device classification rule was added to the critical assets list: Classification Description WSUS Server Centralized Windows update management service used to approve and distribute Microsoft software updates and security patches to Windows devices across an organization. Compromise…https://learn.microsoft.com/en-us/security-exposure-management/whats-new#cloud-software-inventory-in-vulnerability-management-previewhttps://learn.microsoft.com/en-us/security-exposure-management/whats-new#cloud-software-inventory-in-vulnerability-management-previewThu, 01 Jan 2026 00:00:00 +0000Exposure Management · Microsoft LearnCloud software inventory is available in preview in vulnerability management in the Microsoft Defender portal. This feature shows software in your cloud environment, application versions, assets where each software is installed, and related vulnerabilities. The software inventory helps you understand…https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#january-2026--device-vulnerabilities-report-enhancementshttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#january-2026--device-vulnerabilities-report-enhancementsThu, 01 Jan 2026 00:00:00 +0000Exposure Management · Microsoft LearnDevice vulnerabilities report enhancements. To simplify and streamline the Device vulnerabilities report experience, the Vulnerable devices report now includes several changes and enhancements ( learn more ). Note : These changes are not yet visible to government cloud customers.https://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#december-2025--new-microsoft-secure-score-recommendationshttps://learn.microsoft.com/en-us/defender-endpoint/whats-new-in-microsoft-defender-endpoint#december-2025--new-microsoft-secure-score-recommendationsMon, 01 Dec 2025 00:00:00 +0000Exposure Management · Microsoft LearnNew Microsoft Secure Score recommendations. Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques: - Disable Remote Registry service on Windows : Prevents remote access to the Windows registry, reducing attack surface and…