Vulnerability engine
A daily scan matches everything installed on every device against current vulnerability intelligence, so findings reflect what is on each machine today, not what a quarterly scan happened to see.
What the daily scan does
The engine takes the freshest inventory available for each device, from the Patch Console agent and from Intune, and matches every installed product and version against the vulnerability feeds below. The Windows OS itself is matched separately: the device's patch level is compared against Microsoft's KB and MSRC data, rolled up per missing KB rather than per CVE.
The feeds
| Feed | What it contributes |
|---|---|
| NVD / CVE5 | The CVE records themselves, with affected-version ranges used to decide whether an installed version is in the vulnerable window. |
| CISA KEV | The Known Exploited Vulnerabilities catalog. KEV findings are flagged distinctly and cap the Remediation Grade while open. |
| EPSS | Exploit Prediction Scoring System: the probability a CVE will be exploited, shown alongside severity to help you order work. |
| OSV | Vulnerabilities in developer packages: npm, PyPI, and NuGet packages found on devices. |
| Extension IOCs | Indicators for known-malicious browser extensions, matched against the extensions the agent inventories. |
| Windows KB / MSRC | OS-level vulnerabilities, matched against each device's actual Windows build and patch level. |
How findings resolve
A finding resolves only when a later inventory proves the fix: the installed version reached the fixed version, or the software is gone from the device. Installer exit codes never resolve a finding. Installers routinely return success while the old binaries are still on disk (staged updates, pending reboots, self-updaters that defer), so Patch Console treats exit codes as "the install ran" and nothing more.
Finding statuses
| Status | Meaning | |
|---|---|---|
| open | Open | The device is running a vulnerable version and no deployment covers it yet. |
| patch_available | Patch available | A fixed version exists for the product; the finding is actionable. |
| remediation_scheduled | Scheduled | A deployment targeting this device and product has been approved and is queued. |
| remediation_attempted | Attempted | The install ran, but inventory has not yet proven the version healed. |
| reboot_required | Reboot required | The update landed but needs a restart before the new version is in effect. |
| remediation_failed | Failed | The deployment ran and the device is still on a vulnerable version. |
| resolved | Resolved | A later inventory proved the fixed version is installed, or the software was removed. |
Manual dispositions
Three statuses are set by an administrator, never by the engine, and each one is written to the audit log:
| Status | Meaning |
|---|---|
| mitigated | The risk is addressed by something other than patching (a compensating control). |
| accepted_risk | You have decided to live with the finding, deliberately and on record. |
| false_positive | The match is wrong for this device and should not count against you. |