From the All Assessments list, you view Assessment details and summary information. You can also edit or delete a user-created Assessment.
|
|
NOTE: You cannot edit or delete a built-in Assessment, so the Edit and Delete options will be disabled. |
To view an Assessment:
To edit a user-created Assessment:
-
Either
-
ln the All Assessments list, select the Assessment that you want to edit.
OR
-
Open the Assessment that you want to edit.
-
Click Edit.
-
Update the Assessment as needed.
-
Click Save.
To delete a user-created Assessment:
|
|
NOTE: Currently, you can only delete one Assessment at a time |
-
Either
-
ln the All Assessments list, select the Assessment that you want to delete.
OR
-
Open the Assessment that you want to delete.
-
Click Delete. You will be prompted to confirm the deletion.
The Assessment Summary is an AI-generated report that analyzes your organization’s assessment data to identify patterns and provide a clear, high-level overview of results. The summary reflects the assessments you’ve selected and includes all related domains and tenants.
The report includes the following sections:
-
Key Findings
-
Assessment Workload Details – including discovered objects and vulnerabilities
-
Affected Workloads
-
Violations by Vulnerability Type
-
Violations by Workload Type
-
Collection History
-
Assessment History
|
|
NOTE: The Summary Report is powered by AI and may display differently each time it is generated. |
To view Assessment Summary information:
- From the left navigation menu, choose Defend | Identify | Assessments.
- ln the All Assessments list, do one of the following:
- Select the checkbox next to Active Directory Security Assessment and/or Entra ID Security Assessment, then click Assessment Summary.
OR
- Select the desired domain or tenant, then click Assessment Summary.
- Click the Technical Summary button to generate the report.
- You can ask questions about the results or request changes to the summary format. For example, “Can you tell me more about the AD vulnerabilities?” Type your question or instruction in the provided text box and click Send.
- Use the Print or Copy options to save or share the report.
Identity Defense helps you understand how common each vulnerability in your environment is among other organizations. This comparison provides valuable context so you can better prioritize remediation efforts. For every vulnerability detected in your organization, Identity Defense reports how frequently that same vulnerability appears in other organizations.
Comparisons are based on organization size (for example, small, medium, and large), allowing you to assess your risk relative to peers with similar environments and operational scale. Your organization is assigned to a size categories based on:
- Fewer than 10,000 users (Small)
- 10,000 to 200,000 users (Medium)
- Over 200,000 users (Large)
When vulnerability prevalence is reported, the data is focused on organizations of the same size as yours to ensure you are receiving peer‑relevant insight. For each vulnerability, you will see the percentage or number of peer organizations that also have this vulnerability. See Assessment Results for details.
Why This Matters
Not all vulnerabilities carry the same urgency. A vulnerability that is rare among organizations your size may indicate a configuration gap or emerging risk that deserves immediate attention. Conversely, a widely prevalent vulnerability may suggest an industry-wide issue that can be addressed through planned remediation.
By comparing your environment with peers, Identity Defense helps you:
- Prioritize remediation based on real‑world prevalence
- Identify vulnerabilities that are unusually concentrated in your environment
- Communicate risk more effectively to stakeholders using comparative data
You can access the results of an Assessment from the All Assessments list.
|
|
NOTE: You can only view Assessment results for one Active Directory domain or Entra ID tenant at a time. If the Assessment was run on more than one, you can switch to a different domain or tenant from the drop-down in the upper right corner of the Results page for the Assessment. |
To access results for a selected Assessment:
- Click the corresponding Active Directory domain name or Entra ID tenant name in the Link to Results column.
The Results page for the Assessment provides the following information:
Summary of Assessment Vulnerabilities
From here you can access a summary of the last run of the selected Assessment, including:
- the date and time the vulnerabilities within the Assessment were Assessed on
- the date and time the data used to assess the vulnerabilities was Collected on.
NOTE: These fields display the signed-in user's local date and time.
Of the total number of Evaluated Vulnerabilities, a graph depicts color-coded results, as described below.
Summary of Assessment Prevalence
When vulnerability prevalence is reported, the data is focused on organizations of the same size as yours to ensure you are receiving peer‑relevant insight. For each vulnerability, you will see the percentage or number of peer organizations that also have this vulnerability.
You can assess vulnerability prevalence by organization size to provide meaningful benchmarks, allowing you to see not just what vulnerabilities you have, but how common they are among organizations like yours—helping you focus your security efforts where they matter most.
Summary of Last 7 Days
The summary shows the following information for the past seven days that the Assessment was run:
| n |
 |
Assessments in compliance |
| n |
 |
Assessments with vulnerable objects |
| n |
 |
Vulnerabilities found |
Assessment Summary
The summary will reflect the specific assessment and the domain and tenant results currently being viewed.
Assessment Trends
Select the Assessment Trends tab to monitor assessments results over time to understand how vulnerabilities change across recent days (7, 30, 60, or 90), weeks (26, 52, or 78), or months (12, 24, 36, or 48) and filter the view to focus on all vulnerabilities or vulnerable objects.
Interacting with the chart:
- Hover over a point to view the exact value for that date.
- Show/Hide series: Click a legend item (such as Avg. Failed Vulnerabilities) to toggle that line on or off. This helps focus on a single series without clutter.
Read common patterns
- High red line with flat gray/yellow: Many items evaluated, few failures or inconclusives—generally positive.
- Rising gray line: Failures are increasing—investigate recent configuration changes or new findings.
- Rising yellow line: Inconclusive results are increasing—review assessment prerequisites.
Assessment Drift
The Assessment Drift report is an AI‑powered tool that helps you quickly understand how vulnerabilities change over time by comparing recent assessment results.
Assessment Drift automatically compares:
- The most recent assessment
- The oldest assessment within the past 7 days
It highlights key changes so you can easily identify:
- New vulnerabilities introduced
- Closed vulnerabilities that have been resolved
- Ongoing vulnerabilities with changes in affected objects
Report Sections
Summary of Trends and Vulnerability Charts
- New Vulnerabilities: Lists vulnerabilities that appear in the latest assessment but were not present previously.
- Closed Vulnerabilities: Lists vulnerabilities that were present before but are no longer detected.
- Changes in Vulnerable Objects (Open Vulnerabilities): Shows vulnerabilities that still exist but have changed in impact, including increased and decreased number of affected objects.
Recommendations
When the Assessment Drift report identifies new or changing vulnerabilities, the Recommendations section provides guidance on how to respond.
|
|
NOTE: Before You Start
- You must have at least two assessments within the past 7 days
- First-time users must accept the AI Terms and Conditions
|
To run an assessment drift report:
- Navigate to All Assessments| Results: [Assessment Name], and click Assessment Drift.
- If prompted, accept the AI Terms and Conditions.
- On the Assessment Drift page, click Drift.
Once complete, the report displays the following:
- Assessment Name (for example, Active Directory Security Assessment)
- Domain or Tenant (for example, test.domain.com)
- Workload (Active Directory, Entra ID)
You can now select to copy or print the report, or run it again to refresh it.
How to Interpret This Result
A report with no detected changes typically indicates:
- Stable security posture across the compared time period
- No newly introduced risks
- No regressions in previously identified vulnerabilities
However, you should still regularly monitor for new activity and ensure assessments are running correctly and fully covering your environment.
A report with new or changing vulnerabilities, indicates that you should:
- Review the type of change
- Prioritize your response: Focus on the most critical risks first.
- Address new vulnerabilities immediately, especially high‑severity ones.
- Investigate vulnerabilities with rapid growth in affected objects.
- Reassess any vulnerabilities that were expected to be closed but remain open.
- Take action based on the recommendations
- Validate the fix
- Monitor for ongoing drift
Evaluated Vulnerabilities
A list of evaluated vulnerabilities, which provides the following information:
icon indicates that an error occurred while the vulnerability was being evaluated.