Microsoft Security Exposure Management: initiatives, scores and attack paths explained

Defender already reports plenty of weaknesses: missing patches, risky settings, over-privileged accounts, internet-facing servers. Microsoft Security Exposure Management links them in one graph so you can see which ones lead somewhere that matters. In this post I'll cover licensing and permissions, critical assets, how initiative scores differ from Secure Score and the vulnerability management exposure score, and how to read attack paths.

How it works#

Exposure Management collects posture data from the Defender workloads (Endpoint, Vulnerability Management, Identity, Cloud Apps, Office 365, IoT, Cloud and External Attack Surface Management), Microsoft Entra ID and Secure Score. It models assets and their relationships in the enterprise exposure graph and builds three things on top:

• Initiatives (Exposure insights): scored areas such as endpoint or identity posture, made up of metrics and recommendations.
• Critical asset management: the devices, identities and cloud resources you can't afford to lose.
• Attack paths and the attack surface map: how an attacker could get from an entry point to those assets.

Prerequisites: licences and permissions#

• Licences. Nothing to install; access comes with qualifying licences such as Microsoft 365 E5, Microsoft 365 E3 with certain security add-ons, or Microsoft Defender suite licences (see Microsoft's integration and licensing page). Microsoft 365 E3, A3 and Defender for Office 365 Plan 1 alone only unlock Secure Score. Data appears per licensed workload; for the full dashboard Microsoft calls out Defender for Cloud with CSPM and Defender Vulnerability Management (standalone or within Defender for Endpoint Plan 2).
• Third-party data. External data connectors are in preview; Microsoft has said they'll be billed by number of connected assets, with pricing announced first.
• Permissions. In unified RBAC, Exposure Management (read) opens every experience; Exposure Management (manage) adds setting initiative target scores and editing metric values; Core security settings (manage) covers the External Attack Surface Management connection. Full access needs all Defender for Endpoint device groups: scoped users see only their devices, and managing critical assets requires every group.

Step-by-step#

1. Start at the Overview#

Open Exposure management › Overview. Resolve Now sorts prioritised work into Patch (known vulnerabilities, ranked by internet exposure and business criticality), Mitigate (mainly zero-days, with compensating controls) and Fix (misconfigurations, especially on internet-exposed cloud assets). Monitor Exposure shows internet-exposed resources (cloud assets, devices and shadow resources) and domain initiative scores for Code, Endpoint, Cloud, Identity and SaaS against their targets.

2. Tell it what's critical#

Prioritisation and attack paths depend on knowing what matters. Open System › Settings › Microsoft Defender XDR › Critical asset management:

• Review the predefined classifications, such as domain controllers, and approve or reject low-confidence automatic classifications.
• Create custom classifications for what only you know is critical: payroll servers, build infrastructure, break-glass accounts. If a predefined rule doesn't fit, turn it off and replace it.
• Add assets manually and adjust criticality levels where needed.

Criticality then flows into the device inventory, advanced hunting and attack paths; on the attack surface map, critical assets get a coloured halo and a crown icon.

3. Work your initiatives#

Go to Exposure management › Exposure insights › Initiatives. Each initiative shows its score, a 14-day trend and the workloads that feed it; Filter by device groups recalculates endpoint data for your part of the estate. Open an initiative and:

1. Select Set target score, enter a realistic percentage and select Apply. Report against the target, not 100%.
2. Review its metrics and recommendations (only those active in Secure Score or Defender for Cloud are listed). Select one and choose Manage to fix it in the originating workload, such as Defender Vulnerability Management.
3. Open History: each point shows the percentage effect, the reason and up to 100 assets whose exposure was added or removed.
4. Watch Exposure insights › Events for initiative and metric score drops.

4. Read attack paths and choke points#

Open Exposure management › Attack surface › Attack paths. An attack path chains assets and techniques from an entry point, such as an internet-facing machine with an exploitable vulnerability, to a critical asset. The view covers endpoint, cloud (Azure, AWS and GCP through Defender for Cloud) and hybrid paths, and highlights:

• Choke points: nodes where several paths converge on the way to a critical asset. Fixing one can break many paths, so start there.
• Blast radius: a visual of what a choke point's compromise could reach.

Break each path at its cheapest link, such as an unnecessary permission, an unpatched entry device or an exposed port, instead of hardening every hop.

5. Query the exposure graph#

Advanced hunting exposes the graph as ExposureGraphNodes and ExposureGraphEdges. First, what does the graph contain?

ExposureGraphNodes
| summarize Nodes = count() by NodeLabel
| top 15 by Nodes

Then, what connects to a server you care about, and how?

ExposureGraphEdges
| where TargetNodeName =~ "srv-payroll01"
| summarize Relationships = count() by SourceNodeLabel, EdgeLabel

Results are limited to the device groups you can access. For KQL basics, see Advanced hunting for Intune admins.

How the scores relate#

Secure Score stays the broad configuration benchmark, and its recommendations fall under the same Exposure Management permissions. Initiatives narrow posture to one domain with its own metrics and target. The vulnerability management exposure score remains device-focused; its recommendations surface in initiatives with a Manage link back to the source (see from security recommendation to Intune security task).

Verify#

• Critical assets: your classifications show the expected assets, nothing awaits approval, and key servers show a criticality level in the device inventory.
• Initiatives: the ones you report on have targets; History and Events explain every recent drop.
• Attack paths: a short, owned list, or an empty page. Microsoft notes it can be empty because it focuses on imminent threats, but first rule out undefined critical assets or unlicensed workloads.
• Graph: the first query returns the device, identity and cloud node types you expect.

Tips and gotchas#

• Scope changes the numbers. Endpoint-related scores and history follow the viewer's device-group scope, so two people can see different scores. Give the owner of targets and critical assets all device groups.
• Preview initiatives are labelled and may change; don't build KPIs on them yet.
• Two attack path views. Defender for Cloud in the Azure portal keeps its own cloud-only attack path analysis; the Defender portal view is cross-workload. Pick one reporting source.
• Don't compare unlike scores. An initiative at 70% and a Secure Score of 70% measure different things; trend each against its own target.

References#

• Prerequisites and support in Microsoft Security Exposure Management
• Review security initiatives in Microsoft Security Exposure Management
• Work with attack paths in Microsoft Security Exposure Management