Distinguish hardware inventory from firmware vulnerability coverage

Source facts

Defender Vulnerability Management maintains separate model, processor and BIOS inventories. Its documented weakness and exposed-device information uses HP, Dell and Lenovo advisories and covers processors and BIOS; weaknesses from other vendors are not reported. Inventory and weakness collection spans supported Windows, Linux and macOS platforms, but processor and BIOS information is absent for Macs with M1 or M2 processors. Microsoft Learn.

A BIOS entry’s missing-security-updates view links to the vendor advisory, exposed devices and CVEs. Firmware recommendations have an additional prevalence condition: the BIOS version must occur on at least five percent of devices across all organizations. Microsoft Learn.

Applicability

Review Microsoft Defender Vulnerability Management hardware and firmware assessment inventories where the feature is available. Check the current supported-platform list before interpreting a missing component or an empty weakness result.

DSE recommendation

DSE recommends separating discovered hardware, supported assessment coverage and available recommendations in the inventory review. Identify devices outside the documented vendor or platform coverage and assign a separate vendor-advisory review for them. Do not mark a hardware family remediated solely because the inventory presents no weakness or firmware recommendation. Keep any proposed update under the existing hardware-specific change process.

Verification

Select representative devices from covered and uncovered populations. Compare model, processor and BIOS versions with the displayed assessment scope. For a reported weakness, trace the linked advisory and CVEs to the affected device list. Record uncovered populations and recommendation limitations explicitly, without presenting this inventory check as a firmware deployment or proof of universal protection.

Official references

Microsoft Learn: Hardware and firmware assessment.