Latest news and updates about Security.
Microsoft has been named a Leader in The Forrester Wave for Extended Detection and Response Platforms, Q2 2026, with the highest strategy score and the only top vision score. For security teams, the news highlights Microsoft's momentum in XDR, threat intelligence, attack disruption, and Security Copilot capabilities across identity, cloud, endpoints, and SIEM workflows.
Microsoft says AI is accelerating identity-based cyberattacks and is responding with tighter integration between Entra and Defender. Key updates include a unified identity risk score, an improved Entra ID Protection experience, new least-privilege response roles, and smarter Conditional Access optimization to help security teams detect and contain threats faster.
Microsoft has shared one year of real-world email security benchmarking data showing Defender consistently leading in pre-delivery detection versus SEG vendors. The latest results also show ICES tools add the most value for promotional and bulk email, while Defender now handles the vast majority of post-delivery malicious remediation.
Microsoft has released ASSERT, an open-source framework that converts natural-language behavior requirements into executable evaluation pipelines for AI models, agents, and applications. The tool helps teams build behavior-specific tests faster, improve regression coverage, and better validate whether AI systems follow product policies and safety expectations.
Microsoft has published a new investigator playbook to help security teams reconstruct AI-related activity across Microsoft 365 Copilot and Azure AI services. The guidance brings together telemetry, KQL queries, schema references, and detection logic across Purview, Defender, and Sentinel so investigators can move from isolated signals to a clear incident timeline.
Microsoft Threat Intelligence reports a rise in phishing, malvertising, and SEO-driven attacks that abuse popular AI brands like ChatGPT, Claude, Copilot, and DeepSeek as social engineering lures. The campaigns use familiar tactics such as urgent payment notices, fake policy violations, and malicious installers to steal credentials, payment data, and deploy malware, making user awareness and layered defenses critical.
Microsoft Threat Intelligence found that Anthropic’s Claude Code GitHub Action could expose CI/CD secrets when AI agents process untrusted GitHub content such as issues, pull requests, and comments. Anthropic fixed the issue in Claude Code 2.1.128, but the research highlights broader risks for any AI-enabled workflow with access to secrets, file reads, or outbound communication.
Microsoft has updated its taxonomy of failure modes in agentic AI systems after a year of red teaming against real-world deployments. The v2.0 framework adds seven new risk categories and expanded mitigations, giving security teams a more practical model for assessing agentic AI threats such as MCP/plugin abuse, goal hijacking, and session context contamination.
Microsoft Threat Intelligence uncovered a large-scale npm supply chain attack involving trojanized packages under the @redhat-cloud-services scope. The campaign abused a compromised CI/CD publishing workflow to deliver credential-stealing malware targeting GitHub, npm, AWS, Azure, GCP, Kubernetes, and developer systems, making it especially relevant for security teams and DevOps administrators.
At Microsoft Build 2026, Microsoft announced new security capabilities to protect code, AI agents, and models across the development lifecycle. Highlights include the expanded preview of MDASH for exploitability-focused vulnerability discovery and general availability of Microsoft Defender integration with GitHub Code Security to help teams prioritize and remediate real risks faster.
Microsoft Threat Intelligence uncovered 33 malicious npm packages that abused dependency confusion to impersonate internal corporate packages and silently profile developer systems during installation. The campaign matters because it targets developer workstations and CI/CD environments, creating a foothold for potential follow-on supply chain attacks.
Microsoft says it has been named a Leader in the 2026 Gartner Magic Quadrant for Endpoint Protection for the seventh consecutive time. The announcement highlights recent Microsoft Defender for Endpoint enhancements, including attack disruption, custom telemetry, simplified onboarding, sovereign-ready deployment options, and protection for local AI agents.