updates

Author: DebLanger

unified-secops-platform/overview-posture.md

@@ -6,30 +6,35 @@ ms.service: unified-secops-platform
 ms.author: dlanger
 author: dlanger
 ms.localizationpriority: medium
-ms.date: 01/20/2025
+ms.date: 02/05/2025
 audience: ITPro
 ms.collection:
 - M365-security-compliance
 - tier1
 - usx-security
 ms.topic: overview
 
-# customer intent: As a security professional, I want to understand how Microsoft's unified security operations platform, including tools like Microsoft Security Exposure Management (Exposure Management) and programs like Continuous Threat Exposure Management (CTEM), can enhance my organization's security posture by providing comprehensive visibility, prioritizing remediation efforts, and continuously monitoring for threats.
+# customer intent: As a security professional, I want to understand how Microsoft's unified security operations platform, specifically tools like Microsoft Security Exposure Management can enhance my organization's security posture by providing comprehensive visibility, prioritizing remediation efforts, and continuously monitoring for threats.
 ---
 
-# What is security posture?
+# How Exposure Management helps with security posture
 
 Security posture refers to an organization’s strength of protection over its networks, data, and systems (hardware and software). It measures how vulnerable your organization is to cyber-attacks or data breaches.
 
-Microsoft Security Exposure Management (MSEM) is a proactive approach to managing and mitigating security risks. Use tools like Exposure Management to get a comprehensive view of your organization's security posture, including key metrics, critical assets, and potential vulnerabilities.
+The cyber landscape is becoming more perilous with increasing threat actors, faster phishing attacks, and more password attacks. Cyber jobs are harder due to regulatory updates, numerous security tools, and open jobs. Organizations face exposure with critical assets and open attack paths.
+
+Microsoft Security Exposure Management transforms the attack surface by providing tools to discover, assess, and reduce risk with confidence. It integrates with various Microsoft Defender products and offers a unified view of internal and external exposure, potential attack paths, and critical asset protection.
 
 Proactively protecting your organization from potential data breaches is more effective than just doing damage control once a breach occurs.
-Continuous Threat Exposure Management (CTEM) steps enhance this proactive approach by providing a structured method to identify, evaluate, and manage security risks. The CTEM steps, which include Scoping, Discovery, Prioritization, and Validation, can be integrated into your security posture management plan.
+
+Continuous Threat Exposure Management (CTEM) steps can enhance this proactive approach by providing a structured method to identify, evaluate, and manage security risks. The CTEM steps, which include Scoping, Discovery, Prioritization, and Validation, can be integrated into your security posture management plan.
 
 ## Scoping - Make a plan
 
 A well-defined plan is essential for effective exposure management. Your plan should outline the purpose and objectives of posture management for your organization, aligning with legal and regulatory requirements and the risks to your organization's goals. Identify internal stakeholders and important external parties and establish clear roles and responsibilities.
 
+Continuous Threat Exposure Management (CTEM) steps can enhance this proactive approach by providing a structured method to identify, evaluate, and manage security risks. The CTEM steps, which include Scoping, Discovery, Prioritization, and Validation, can be integrated into your security posture management plan.
+
 ## Discovery - Find vulnerabilities
 
 The **Discovery** step to identify vulnerabilities within your infrastructure. This involves scanning networks, systems, and applications for potential weaknesses. By regularly conducting vulnerability assessments, you can stay ahead of emerging threats and ensure your security posture remains strong.
@@ -42,6 +47,8 @@ Maintain an up-to-date inventory of your assets, including on-premises resources
 
 Security posture management is a complex topic that requires a wide range of technical knowledge. Continuously educate and train your operations and incident response staff on Exposure Management technologies and how your organization uses them. This ensures your team is prepared to handle security incidents effectively.
 
+The evolution of vulnerability management includes TI-Based, Risk-Based, and Exposure Management stages. Continuous Exposure Management involves attack surface management, attack path analysis, and unified exposure insights. Microsoft integrates exposure management data across Defender products to enhance security posture.
+
 ### Incident classification framework
 
 Define what constitutes a "security incident" for your organization and develop a method for classifying incidents. A classification framework helps prioritize response and preparation activities, collect useful metrics, and improve the performance of your posture management program. Categories might include denial of service, malware, or unauthorized access, with impact-based severity levels such as critical, high, medium, or low.
@@ -56,6 +63,8 @@ Learn more here, [What is Microsoft Security Exposure Management?](/security-exp
 
 Exposure Management helps you identify and map out potential attack paths, giving you visibility into critical choke points that need to be addressed. This proactive approach allows you to close down attack paths before they can be exploited.
 
+80% of organizations have at least one open attack path to a critical asset. 61% of attack paths lead to sensitive user accounts. Only 1% of total assets in organizations are critical or sensitive.
+
 Learn more here, [Overview of attack surface management](/security-exposure-management/cross-workload-attack-surfaces)
 
 ## Prioritize remediation efforts

unified-secops-platform/reduce-risk-overview.md

@@ -1,5 +1,5 @@
 ---
-title: "Overview - Improve security posture and reduce risk"
+title: "Overview - Improve Security Posture and Reduce Risk"
 description: Provides an overview of solutions that help reduce security risk in Microsoft's unified security operations platform.
 search.appverid: met150
 ms.service: unified-secops-platform
@@ -18,14 +18,14 @@ ms.topic: concept-article
 
 # Security posture management and risk reduction
 
-To battle increasingly sophisticated and well-resourced threat actors, security teams need a comprehensive strategy that reduces vulnerabilities, prevents breaches, and mitigates threats in real-time.
+Security teams need a comprehensive strategy to reduce vulnerabilities, prevent breaches, and mitigate threats in real time.
 
 Microsoft's unified SecOps platform provides a set of integrated tools and solutions that work together to help security teams proactively reduce security risk.
 
 Proactive security management allows you to manage cybersecurity as an ongoing risk, rather than series of unpredictable events. Proactive risk management helps to reduce the likelihood of breaches, minimize business disruptions when attacks do occur, and raise security awareness as an ongoing practice across the business.
 
 
-## Improving prebreach security
+## Improve prebreach security
 
 Security teams must address key activities for effective prebreach security.
 
@@ -48,7 +48,7 @@ A range of solutions within Microsoft's unified SecOps platform helps security t
 Solution | Details | Capabilities
 --- | --- | ---
 **[Microsoft Security Exposure Management](/security-exposure-management/microsoft-security-exposure-management)**<br/><br/>Reduce security risk by reducing attack surfaces. | Automatically discover assets, including devices, identities, cloud apps, and more. Extend visibility to non-Microsoft solutions.<br/><br/>Aggregate security posture data across data silos into a single location.<br/><br/>Organize data into security initiatives to monitor, track, measure, and prioritize posture in the areas that are most important to you.<br/><br/> identify, classify, and protect critical business assets to reduce the likelihood of them being attacked.<br/><br/>Discover and visualize attack surfaces and potential blast radius.<br/><br/>Understand and analyze potential attack paths to map how attackers might exploit vulnerabilities across the organization.<br/><br/> Get contextual insights to understand, prioritize, and mitigate security risk.
-**[Microsoft Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction)**<br/><br/> Detect real-time threats to cloud workloads, and proactively improve security posture. | Cloud security posture management capabilities assess the posture of resources across Azure, AWS, GCP, and on-premises. Defender for Cloud improves security posture for machines, containers, sensitive data, databases, AI workloads, storage, and DevOps.<br/><br/> Security recommendations provide information and manual/automatic actions to remediate issues and harden resource security.
-**[Microsoft Defender for Endpoint](/defender-endpoint/microsoft-defender-endpoint)**<br/><br/> Improve security posture and protect against threats. | Defender for Endpoint includes a number of security posture management features.<br/><br/>[Attack surface reduction](/defender-endpoint/overview-attack-surface-reduction) proactively blocks common activities associated with malicious actions, and provides [attack surface reduction rules](/defender-endpoint/attack-surface-reduction) to constrain risky software-based behavior.<br/><br/>Other features include [controlled folder access](/defender-endpoint/controlled-folders), [peripheral device control](/defender-endpoint/device-control-overview), [exploit protection](/defender-endpoint/exploit-protection), [network](/defender-endpoint/network-protection) and [web](/defender-endpoint/network-protection) protection.
-**[Microsoft Defender Vulnerability Management](/defender-vulnerability-management/defender-vulnerability-management)**<br/><br/> Remediate security vulnerabilities across the organization. | Defender Vulnerability Management continuously identifies vulnerabilities and misconfigurations, providing contextual insights into potential threats, and recommendations to mitigate them.
+**[Microsoft Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction)**<br/><br/>Detect real time threats to cloud workloads, and proactively improve security posture. | Cloud security posture management capabilities assess the posture of resources across Azure, AWS, GCP, and on-premises. Defender for Cloud improves security posture for machines, containers, sensitive data, databases, AI workloads, storage, and DevOps.<br/><br/>Security recommendations provide information and manual/automatic actions to remediate issues and harden resource security.
+**[Microsoft Defender for Endpoint](/defender-endpoint/microsoft-defender-endpoint)**<br/><br/>Improve security posture and protect against threats. | Defender for Endpoint includes a number of security posture management features.<br/><br/>[Attack surface reduction](/defender-endpoint/overview-attack-surface-reduction) proactively blocks common activities associated with malicious actions, and provides [attack surface reduction rules](/defender-endpoint/attack-surface-reduction) to constrain risky software-based behavior.<br/><br/>Other features include [controlled folder access](/defender-endpoint/controlled-folders), [peripheral device control](/defender-endpoint/device-control-overview), [exploit protection](/defender-endpoint/exploit-protection), [network](/defender-endpoint/network-protection) and [web](/defender-endpoint/network-protection) protection.
+**[Microsoft Defender Vulnerability Management](/defender-vulnerability-management/defender-vulnerability-management)**<br/><br/>Remediate security vulnerabilities across the organization. | Defender Vulnerability Management continuously identifies vulnerabilities and misconfigurations, providing contextual insights into potential threats and recommendations to mitigate them.
 **[Microsoft Secure Score](/defender-xdr/microsoft-secure-score)**<br/><br/>Measure organizational security posture. | Secure Score helps to monitor the security posture of Microsoft 365 workloads, including devices, identities, and apps. [Compare Security Score with security posture in Security Exposure Management](/security-exposure-management/compare-secure-score-security-exposure-management).