Microsoft is leading the next chapter of attack surface management so organizations can proactively improve their posture and reduce their exposure, faster than attackers are able to exploit them. 

In an era of expanding interconnected attack surfaces, organizations face a growing concern about a myriad of exposures, including software vulnerabilities, control misconfigurations, overprivileged access, and evolving threats leading to sensitive data exposure.

Navigating, and, more importantly, understanding this threat landscape and where you may be exposed can be extremely difficult, costly, and complex.

Therefore, it's important for you to increase visibility across your digital estate so that you can not only identify potential threats, but also take proactive measures to prevent them. With typical organizations using on average 80 different security tools, it’s very likely that you have dozens of tools related to security posture, each managing a limited scope of your environment.

The security posture data and insights in these tools are often siloed, or at best, loosely integrated, making it difficult to reason over threats and their possible impact to critical assets.

Microsoft is leading the next chapter of attack surface management so organizations can proactively improve their posture and reduce their exposure, faster than attackers are able to exploit them.

Today, March 13, we are thrilled to announce the public preview release of Microsoft Security Exposure Management. This transformative solution unifies disparate data silos, extending end-to-end visibility to security teams across all assets. By enabling a thorough assessment of security posture and exposure, this solution equips teams to not only grasp their current security landscape but also elevate it to new heights. Microsoft Security Exposure Management serves as a cornerstone for proactive risk management, empowering organizations to adeptly navigate and mitigate threat exposure across their entire attack surface.

Microsoft Security Exposure Management empowers customers to:

\n
• Build an effective exposure management program with a continuous threat exposure management (CTEM) process.
\n
• Reduce risk with a clear view of every asset and real-time assessment of potential exposures both inside-out and outside-in.
\n
• Identify and classify critical assets, ensuring they are protected against a wide variety of threats.
\n
• Discover and visualize potential adversary intrusion paths, including lateral movement, to proactively identify and stop attacker activity.
\n
• Communicate exposure risk to business leaders and stakeholders with clear KPIs and actionable insights.
\n
• Enhance exposure analysis and remediation by integrating with third-party data sources and tools
\n

At launch, we are introducing new capabilities that are foundational to exposure management programs:

\n
• Attack Surface Management: Provides a comprehensive view of the entire attack surface, allowing the exploration of assets and their relationships.
\n
• Attack Path Analysis: Assists security teams in visualizing and prioritizing attack paths and risks across environments, enabling focused remediation efforts to reduce exposure and breach likelihood.
\n
• Unified Exposure Insights: Provides decision-makers with a consolidated, clear view of an organization's threat exposure, facilitating security teams in addressing critical questions about security posture.
\n

Visibility into the entire attack surface

Powered by our Enterprise Exposure Graph, Microsoft Security Exposure Management assists you in uncovering and overseeing your attack surface. Through seamless integration with both Microsoft and non-Microsoft security and infrastructure tools, it diligently collects and normalizes asset data, maps assets and their relationships, and delivers comprehensive visibility into the attack surface. This holistic approach enables the identification, prioritization, and remediation of critical exposures with precision and efficiency.

At present, Microsoft Security Exposure Management seamlessly integrates data across the following technologies:

\n
• Vulnerability Management (VRM) \n
  \n
  • Microsoft Defender Vulnerability Management (MDVM)
  \n
  • Qualys Vulnerability Management (Preview)
  \n
  • Rapid7 Vulnerability Management (Preview)
  \n
  \n
\n
• External Attack Surface Management (EASM)\n
  \n
  • \n

    Microsoft Defender External Attack Surface Management

    \n
  \n
  \n
\n
• Cloud Security (CSPM)\n
  \n
  • Microsoft Defender Cloud Security Posture Management (CSPM)
  \n
  \n
\n
• Endpoint Security (Device Security Posture)\n
  \n
  • Microsoft Defender for Endpoint (MDE) 
  \n
  \n
\n
• Identity Security (ISPM)\n
  \n
  • Microsoft Defender for Identity (MDI) 
  \n
  • Microsoft Entra ID (Free, P1, P2)
  \n
  \n
\n
• SaaS Security Posture (SSPM)\n
  \n
  • Microsoft Defender for Cloud Apps (MDA) including connectors to SaaS applications  
  \n
  \n
\n
• Email Security\n
  \n
  • Microsoft Defender for Office (MDO)
  \n
  \n
\n
• OT/IOT Security\n
  \n
  • Microsoft Defender for IOT
  \n
  \n
\n
• Asset & Configuration Management\n
  \n
  • ServiceNow CMDB (Preview)
  \n
  \n
\n

In our commitment to offering the most comprehensive exposure coverage, our future plans encompass extensive integration with a variety of additional Microsoft and non-Microsoft solutions, spanning diverse domains.

Exploring the attack surface

To navigate the attack surface, Exposure Management provides both an intuitive interactive graphic exploration and a robust, fully flexible data query experience. The attack surface visualization map enables security teams to understand asset relationships, identify the blast radius of threatened assets, and pinpoint weaknesses further in the sequence. For enhanced flexibility in accessing and comprehending asset exposure, Graph data is seamlessly integrated within Advanced Hunting tables. This allows users to create and execute powerful KQL queries, facilitating the integration of graph data with all other available Microsoft Defender data in Advanced Hunting.

Figure1: Attack Surface Map Visualization provides visibility into assets risk and their relationship

Mapping and identifying critical assets 

Safeguarding an organization's critical assets is of paramount importance in the realm of attack surface management. These key assets often represent the core pillars of an enterprise, encompassing sensitive data, proprietary information, and essential systems. By meticulously mapping and identifying these critical components, businesses gain a profound understanding of their attack surface, enabling strategic fortification against potential threats. Focusing protective measures on these high-priority assets ensures a targeted and efficient security approach, minimizing the risk of breaches and disruptions. Effectively protecting critical assets not only safeguards sensitive information but also fortifies the overall resilience of the organization, fostering a proactive security stance in an ever-evolving threat landscape.

To tackle this challenge, we are unveiling the Critical Asset Management capability. This new capability automatically discerns assets critically from an attacker's viewpoint and assigns them a crucial security context.

Figure 2: Critical asset management experience allows teams to discover and tag critical assets

Critical Asset Management automatically identifies and labels various critical assets throughout your organization, encompassing entities such as DCs (Domain Controllers), ADFS servers, and more. Moving forward, our commitment extends to continually enhancing this capability by expanding the list of identified critical asset types. Additionally, we provide the flexibility for you to create your own classifications based on critical asset criteria, utilizing all the context from exposure graph.

The critical asset criteria is valuable not just within Exposure Management but other Defender products like Defender for Cloud are also enhanced by incorporating level of criticality on assets in evaluating risks and providing recommendations. Learn more about the updates in Defender for Cloud.

Extending attack path analysis across the entire attack surface

To strengthen the defense of your critical assets, we're introducing an advanced Extended Attack Path Analysis component. This feature provides a comprehensive attacker perspective, outlining the potential steps adversaries may take to infiltrate your critical assets. Specifically, it identifies paths originating from possible attack entry points, such as vulnerable internet-facing devices, and traces their course toward critical assets where lateral movement becomes feasible. By mapping these potential routes, the analysis sheds light on vulnerabilities and attack vectors that attackers may exploit, enabling a focused approach to fortify these critical pathways and bolster overall security measures.

Moreover, given that Attack Path data is accessible in Advanced Hunting, customers can seamlessly correlate it with all other data points. This integration enhances the depth of analysis, allowing for a more comprehensive understanding and proactive response to potential security threats.

Figure 3: Attack paths

Empowered by this new capability, you can now:

\n
• Visualize attack paths to your critical assets across on-premises and the cloud, mirroring an actual attack scenario.
\n
• Map potential routes that threat actors might pursue to exploit vulnerabilities.
\n
• Unlock a range of new use-cases, including enhanced vulnerability prioritization, guided penetration testing, as well as improved threat modeling and incident response.
\n

Communicating and optimizing your security posture

With Microsoft Security Exposure Management, organizations can seamlessly transform technical data into business insights and actionable intelligence crucial for both business decision-makers and practitioners. This real-time translation of cyber risk addresses stakeholders' pivotal cybersecurity inquiries, such as \"How secure are we?\", \"What are the risks?\", \"How are we progressing over time?\", and \"What do we need to remediate first to reduce exposure from a given threat?\" This is achieved by providing clear metrics to measure, compare, and easily communicate cyber risk.

Figure 4: Exposure management overview

To steer you and your security teams toward adopting a continuous threat exposure management mindset, we introduce \"Security Initiatives.\" Through these initiatives, you can strategically define your attack surface and focus teams on aspects crucial to the business. This involves the discovery, prioritization, and validation of security findings, empowering teams to recognize and effectively communicate with all stakeholders for remediation and measurement purposes.

Within the initiative catalog, you'll find an expanding list of security programs critical for teams to govern, enhance, and report on. These initiatives are divided into two types - Domain Initiatives, addressing areas like improving cloud security, maturing zero-trust practices, external attack surface and securing SaaS applications; and Threat Initiatives, concentrating on specific attack actors like Octo Tempest and vectors such as Ransomware and Business Email Compromise.

Figure 5: Initiative catalog

Within each initiative, you'll discover real-time security metrics meticulously curated by our experts. Additionally, there are specific security recommendations aimed at guiding efforts to enhance the maturity of the program, along with insights into security events that impact the score. This functionality empowers you to closely monitor the program's progress over time.

Figure 6: Ransomware protection overview

Security drift is an unavoidable consequence within the ever-changing realm of business technology. Rapid advancements in threat activity demand regular tuning and adjustments to controls to adequately address emerging risks.

To proactively monitor shifts in security posture, Exposure Management provides an event timeline section in the dashboard, and a history tab on each security initiative. This empowers you to identify and address significant exposures that have developed over time, ensuring a vigilant approach to prioritizing and enhancing overall cybersecurity measures.

Figure 7: Ransomware protection score history

Learn More

Achieving robust attack surface visibility and understanding posture are imperative in effectively managing threat exposure. Microsoft Security Exposure Management provides the essential tools and insights needed for proactive cybersecurity measures. It is not just a choice; it's a strategic move towards fortifying your organization's defenses in the face of evolving threats. Dive into a new era of cybersecurity resilience by getting started today.

-- Update to original post --

Since the public preview launch we have released additional blogs and guidance into key areas of Exposure Management that we encourage you to explore. 

In an era of expanding interconnected attack surfaces, organizations face a growing concern about a myriad of exposures, including software vulnerabilities, control misconfigurations, overprivileged access, and evolving threats leading to sensitive data exposure.

Navigating, and, more importantly, understanding this threat landscape and where you may be exposed can be extremely difficult, costly, and complex.

Therefore, it's important for you to increase visibility across your digital estate so that you can not only identify potential threats, but also take proactive measures to prevent them. With typical organizations using on average 80 different security tools, it’s very likely that you have dozens of tools related to security posture, each managing a limited scope of your environment.

The security posture data and insights in these tools are often siloed, or at best, loosely integrated, making it difficult to reason over threats and their possible impact to critical assets.

Microsoft is leading the next chapter of attack surface management so organizations can proactively improve their posture and reduce their exposure, faster than attackers are able to exploit them.

Today, March 13, we are thrilled to announce the public preview release of Microsoft Security Exposure Management. This transformative solution unifies disparate data silos, extending end-to-end visibility to security teams across all assets. By enabling a thorough assessment of security posture and exposure, this solution equips teams to not only grasp their current security landscape but also elevate it to new heights. Microsoft Security Exposure Management serves as a cornerstone for proactive risk management, empowering organizations to adeptly navigate and mitigate threat exposure across their entire attack surface.

Microsoft Security Exposure Management empowers customers to:

\n
• Build an effective exposure management program with a continuous threat exposure management (CTEM) process.
\n
• Reduce risk with a clear view of every asset and real-time assessment of potential exposures both inside-out and outside-in.
\n
• Identify and classify critical assets, ensuring they are protected against a wide variety of threats.
\n
• Discover and visualize potential adversary intrusion paths, including lateral movement, to proactively identify and stop attacker activity.
\n
• Communicate exposure risk to business leaders and stakeholders with clear KPIs and actionable insights.
\n
• Enhance exposure analysis and remediation by integrating with third-party data sources and tools
\n

At launch, we are introducing new capabilities that are foundational to exposure management programs:

\n
• Attack Surface Management: Provides a comprehensive view of the entire attack surface, allowing the exploration of assets and their relationships.
\n
• Attack Path Analysis: Assists security teams in visualizing and prioritizing attack paths and risks across environments, enabling focused remediation efforts to reduce exposure and breach likelihood.
\n
• Unified Exposure Insights: Provides decision-makers with a consolidated, clear view of an organization's threat exposure, facilitating security teams in addressing critical questions about security posture.
\n

Visibility into the entire attack surface

Powered by our Enterprise Exposure Graph, Microsoft Security Exposure Management assists you in uncovering and overseeing your attack surface. Through seamless integration with both Microsoft and non-Microsoft security and infrastructure tools, it diligently collects and normalizes asset data, maps assets and their relationships, and delivers comprehensive visibility into the attack surface. This holistic approach enables the identification, prioritization, and remediation of critical exposures with precision and efficiency.

At present, Microsoft Security Exposure Management seamlessly integrates data across the following technologies:

\n
• Vulnerability Management (VRM) \n
  \n
  • Microsoft Defender Vulnerability Management (MDVM)
  \n
  • Qualys Vulnerability Management (Preview)
  \n
  • Rapid7 Vulnerability Management (Preview)
  \n
  \n
\n
• External Attack Surface Management (EASM)\n
  \n
  • \n

    Microsoft Defender External Attack Surface Management

    \n
  \n
  \n
\n
• Cloud Security (CSPM)\n
  \n
  • Microsoft Defender Cloud Security Posture Management (CSPM)
  \n
  \n
\n
• Endpoint Security (Device Security Posture)\n
  \n
  • Microsoft Defender for Endpoint (MDE) 
  \n
  \n
\n
• Identity Security (ISPM)\n
  \n
  • Microsoft Defender for Identity (MDI) 
  \n
  • Microsoft Entra ID (Free, P1, P2)
  \n
  \n
\n
• SaaS Security Posture (SSPM)\n
  \n
  • Microsoft Defender for Cloud Apps (MDA) including connectors to SaaS applications  
  \n
  \n
\n
• Email Security\n
  \n
  • Microsoft Defender for Office (MDO)
  \n
  \n
\n
• OT/IOT Security\n
  \n
  • Microsoft Defender for IOT
  \n
  \n
\n
• Asset & Configuration Management\n
  \n
  • ServiceNow CMDB (Preview)
  \n
  \n
\n

In our commitment to offering the most comprehensive exposure coverage, our future plans encompass extensive integration with a variety of additional Microsoft and non-Microsoft solutions, spanning diverse domains.

Exploring the attack surface

To navigate the attack surface, Exposure Management provides both an intuitive interactive graphic exploration and a robust, fully flexible data query experience. The attack surface visualization map enables security teams to understand asset relationships, identify the blast radius of threatened assets, and pinpoint weaknesses further in the sequence. For enhanced flexibility in accessing and comprehending asset exposure, Graph data is seamlessly integrated within Advanced Hunting tables. This allows users to create and execute powerful KQL queries, facilitating the integration of graph data with all other available Microsoft Defender data in Advanced Hunting.

Figure1: Attack Surface Map Visualization provides visibility into assets risk and their relationship

Mapping and identifying critical assets 

Safeguarding an organization's critical assets is of paramount importance in the realm of attack surface management. These key assets often represent the core pillars of an enterprise, encompassing sensitive data, proprietary information, and essential systems. By meticulously mapping and identifying these critical components, businesses gain a profound understanding of their attack surface, enabling strategic fortification against potential threats. Focusing protective measures on these high-priority assets ensures a targeted and efficient security approach, minimizing the risk of breaches and disruptions. Effectively protecting critical assets not only safeguards sensitive information but also fortifies the overall resilience of the organization, fostering a proactive security stance in an ever-evolving threat landscape.

To tackle this challenge, we are unveiling the Critical Asset Management capability. This new capability automatically discerns assets critically from an attacker's viewpoint and assigns them a crucial security context.

Figure 2: Critical asset management experience allows teams to discover and tag critical assets

Critical Asset Management automatically identifies and labels various critical assets throughout your organization, encompassing entities such as DCs (Domain Controllers), ADFS servers, and more. Moving forward, our commitment extends to continually enhancing this capability by expanding the list of identified critical asset types. Additionally, we provide the flexibility for you to create your own classifications based on critical asset criteria, utilizing all the context from exposure graph.

The critical asset criteria is valuable not just within Exposure Management but other Defender products like Defender for Cloud are also enhanced by incorporating level of criticality on assets in evaluating risks and providing recommendations. Learn more about the updates in Defender for Cloud.

Extending attack path analysis across the entire attack surface

To strengthen the defense of your critical assets, we're introducing an advanced Extended Attack Path Analysis component. This feature provides a comprehensive attacker perspective, outlining the potential steps adversaries may take to infiltrate your critical assets. Specifically, it identifies paths originating from possible attack entry points, such as vulnerable internet-facing devices, and traces their course toward critical assets where lateral movement becomes feasible. By mapping these potential routes, the analysis sheds light on vulnerabilities and attack vectors that attackers may exploit, enabling a focused approach to fortify these critical pathways and bolster overall security measures.

Moreover, given that Attack Path data is accessible in Advanced Hunting, customers can seamlessly correlate it with all other data points. This integration enhances the depth of analysis, allowing for a more comprehensive understanding and proactive response to potential security threats.

Figure 3: Attack paths

Empowered by this new capability, you can now:

\n
• Visualize attack paths to your critical assets across on-premises and the cloud, mirroring an actual attack scenario.
\n
• Map potential routes that threat actors might pursue to exploit vulnerabilities.
\n
• Unlock a range of new use-cases, including enhanced vulnerability prioritization, guided penetration testing, as well as improved threat modeling and incident response.
\n

Communicating and optimizing your security posture

With Microsoft Security Exposure Management, organizations can seamlessly transform technical data into business insights and actionable intelligence crucial for both business decision-makers and practitioners. This real-time translation of cyber risk addresses stakeholders' pivotal cybersecurity inquiries, such as \"How secure are we?\", \"What are the risks?\", \"How are we progressing over time?\", and \"What do we need to remediate first to reduce exposure from a given threat?\" This is achieved by providing clear metrics to measure, compare, and easily communicate cyber risk.

Figure 4: Exposure management overview

To steer you and your security teams toward adopting a continuous threat exposure management mindset, we introduce \"Security Initiatives.\" Through these initiatives, you can strategically define your attack surface and focus teams on aspects crucial to the business. This involves the discovery, prioritization, and validation of security findings, empowering teams to recognize and effectively communicate with all stakeholders for remediation and measurement purposes.

Within the initiative catalog, you'll find an expanding list of security programs critical for teams to govern, enhance, and report on. These initiatives are divided into two types - Domain Initiatives, addressing areas like improving cloud security, maturing zero-trust practices, external attack surface and securing SaaS applications; and Threat Initiatives, concentrating on specific attack actors like Octo Tempest and vectors such as Ransomware and Business Email Compromise.

Figure 5: Initiative catalog

Within each initiative, you'll discover real-time security metrics meticulously curated by our experts. Additionally, there are specific security recommendations aimed at guiding efforts to enhance the maturity of the program, along with insights into security events that impact the score. This functionality empowers you to closely monitor the program's progress over time.

Figure 6: Ransomware protection overview

Security drift is an unavoidable consequence within the ever-changing realm of business technology. Rapid advancements in threat activity demand regular tuning and adjustments to controls to adequately address emerging risks.

To proactively monitor shifts in security posture, Exposure Management provides an event timeline section in the dashboard, and a history tab on each security initiative. This empowers you to identify and address significant exposures that have developed over time, ensuring a vigilant approach to prioritizing and enhancing overall cybersecurity measures.

Figure 7: Ransomware protection score history

Learn More

Achieving robust attack surface visibility and understanding posture are imperative in effectively managing threat exposure. Microsoft Security Exposure Management provides the essential tools and insights needed for proactive cybersecurity measures. It is not just a choice; it's a strategic move towards fortifying your organization's defenses in the face of evolving threats. Dive into a new era of cybersecurity resilience by getting started today.

-- Update to original post --

Since the public preview launch we have released additional blogs and guidance into key areas of Exposure Management that we encourage you to explore. 

Microsoft is leading the next chapter of attack surface management so organizations can proactively improve their posture and reduce their exposure, faster than attackers are able to exploit them. 

If we already have the underlying requirements of the Exposure Initiatives, are there additional hidden costs not being identified in onboarding to these exposure initiatives?

Is there a way to capture the data from the Exposure management via the API? I would like to capture this data in PowerBI for reporting.

Wave2Davei use CDX to practice with new features. This is not exception.

P.S. I'm really missing the CDX tenant type of \"Microsoft 365 Enterprise Demo with Microsoft for Defender for Endpoint Licenses and Content\". It is not avalable for more then 3 years now. The only demo tenant type is \"Microsoft Defender for Business Demo Tenant\"

Will this be available for MSSP's to offer as a managed service also are there any demo's available? 

DeanRubinsteinthank you very much for the explanations. I clicked this in prod out of curiocity. But then I got afraid this is a mitigation action and will actually \"expel\" the user from the group 😉 And went to Entra ID logs to see if this is actually what happened.

In many Microsoft Azure GUI elements, Microsoft adds brief explanations to mouse-over tool tips. Perhaps you can use something similar in this case:

Sergg, Thank you for the feedback. When a node is connected directly with the same type of connection to more than one node of the same node type, we group them together for a better user experience. When this is the case, you have an indication that there are several nodes (the icon looks different) and there is a number in parentheses. The \"Extract\" action is used to expand that \"grouped\" node to view all of them on the map. You can use this by right-clicking on the \"grouped\" node and select to \"Extract\" or by clicking on the node to open the side pane where you can see all nodes and select which ones you would like to \"Extract\" and see on the map. For example, in the image you shared you can select any of the four nodes in the list and \"Extract\" them to view them on the map.

We will make sure to update documentation accordingly to include reference for this action.

Thank you!

Dean. 

When clicking on the group object in the \"Attack Surface map\" the details menu opens and there is the \"Extract\" feature. I was not able to find any information in the documentation on what it does. Please advise. Tomer Teller  any help is appreciated.

I like it, but it seems kind of broken. On 2024-03-25 all initiatives scores dropped massively without any apparent reason. For example, \"endpoint security\" dropped from 80% to 28%. When i go into the details, it tells me for example \"% of endpoints without antivirus protection enabled\" caused a drop by 13.70%, the given reason is \"System logic update\". I want to know more, click on \"open metrics side panel\", and this tells me the current value is \"0% (Ideal)\", and it's all green. OK then why the score drop?

EDIT: Seems fixed now!

Thx BrjannBrekkan 

Yes, clear documentation would be helpful to all.  Thx 

-JS

Jhonny_Smith_555  Thank you for the question and we will try to make this clearer in our documentation and messaging. You are correct that Sentinel and Exposure Management both integrate and unify information. Sentinel as part of our Defender XDR solution unifies usage and activity data while Exposure Managment brings together information about assets, their configuration and relationships.  
 Yusuf_Buhari  touched on the main difference is about use cases provided to you. Sentinel is used in Incident management to respond reactively to different threats such as breach and be able to analyze the anomalous activity to disrupt ongoing attacks and recover. Exposure Mangement is used to assess your internal and external attack surface to predict attack paths so you can proactively stay ahead of threats.
Recommend looking at Overview of attack surface management in Microsoft Security Exposure Management - Microsoft Security Exposure Management | Microsoft Learn  and Microsoft Defender XDR integration with Microsoft Sentinel | Microsoft Learn

/Brjann