Latest news and updates about Security.
Microsoft warned that malicious Axios npm versions 1.14.1 and 0.30.4 were used in a supply chain attack attributed to Sapphire Sleet. Organizations using the affected packages should immediately rotate secrets, downgrade to safe versions, and review developer endpoints and CI/CD systems for compromise.
Microsoft says the threat model for critical infrastructure has shifted from opportunistic attacks to persistent, identity-driven access designed for future disruption. For IT and security leaders, the message is clear: reduce exposure, harden identity, and validate operational readiness now as regulations and nation-state activity intensify.
Microsoft is advising CISOs to secure AI systems using the same core controls they already apply to software, identities, and data access. The guidance highlights least privilege, prompt injection defenses, and using AI itself to uncover permissioning issues before attackers or users do.
Microsoft Defender Experts uncovered a late-February 2026 campaign that uses WhatsApp messages to deliver malicious VBS files, then installs unsigned MSI packages for persistence and remote access. The attack blends social engineering, renamed Windows utilities, and trusted cloud services to evade detection, making endpoint controls and user awareness critical.
Microsoft outlines how Copilot Studio and the upcoming general availability of Agent 365 can help organizations address the OWASP Top 10 for Agentic Applications. The guidance matters because agentic AI systems can use real identities, data, and tools, creating security risks that go far beyond inaccurate outputs.
Microsoft detailed how Microsoft Defender uses high-value asset awareness to detect and stop attacks targeting domain controllers, web servers, and identity infrastructure. By combining Security Exposure Management context with differentiated detections and automated disruption, Defender can raise protection levels on Tier-0 assets and reduce the blast radius of sophisticated intrusions.
Microsoft is positioning identity security as a unified control plane that combines identity infrastructure, access decisions, and threat protection in real time. At RSAC 2026, the company announced new Microsoft Entra and Defender capabilities, including an identity security dashboard, unified identity risk scoring, and adaptive risk remediation to help organizations reduce fragmentation and respond faster to identity-based attacks.
Microsoft has published detection, investigation, and mitigation guidance for the March 2026 Trivy supply chain compromise that affected the Trivy binary and related GitHub Actions. The incident matters because it weaponized trusted CI/CD security tooling to steal credentials from build pipelines, cloud environments, and developer systems while appearing to run normally.
Microsoft outlines a governance model for AI agents that aligns user, developer, role-based, and organizational intent. The framework helps enterprises keep agents useful, secure, and compliant by defining behavioral boundaries and a clear order of precedence when conflicts arise.
Microsoft detailed a real-world ransomware case in which Defender’s predictive shielding detected malicious Group Policy Object abuse before encryption began. By hardening GPO propagation and disrupting compromised accounts, Defender blocked about 97% of attempted encryption activity and prevented any devices from being encrypted through the GPO delivery path.
At RSAC 2026, Microsoft introduced a broader security strategy for enterprise AI, led by Agent 365, a new control plane for governing and protecting AI agents that will reach general availability on May 1. The company also announced expanded AI risk visibility and identity protections across Defender, Entra, Purview, Intune, and new shadow AI detection tools, signaling that securing AI usage is becoming a core part of enterprise security operations as adoption accelerates.
Microsoft has introduced CTI-REALM, an open-source benchmark designed to test whether AI agents can actually perform detection engineering tasks end to end, from interpreting threat intelligence reports to generating and refining KQL and Sigma detection rules. This matters because it gives security teams a more realistic way to evaluate AI for SOC operations, focusing on measurable operational outcomes across real environments instead of simple cybersecurity question answering.