Security

Microsoft Build 2026 Security: Code, Agents, Models

3 min read

Summary

At Microsoft Build 2026, Microsoft announced new security capabilities to protect code, AI agents, and models across the development lifecycle. Highlights include the expanded preview of MDASH for exploitability-focused vulnerability discovery and general availability of Microsoft Defender integration with GitHub Code Security to help teams prioritize and remediate real risks faster.

Need help with Security?Talk to an Expert

Introduction

Microsoft Build 2026 put a strong spotlight on securing AI-driven development. For IT and security leaders, the message is clear: as developers adopt AI tools and build agent-based apps faster, security controls must move earlier into the software lifecycle without slowing innovation.

What’s new at Build 2026

MDASH expanded preview

Microsoft announced an expanded preview of the Microsoft Security multi-model agentic scanning harness (MDASH) for eligible organizations.

Key capabilities include:

  • Orchestrates more than 100 specialized AI agents
  • Uses multiple models to discover and validate exploitable vulnerabilities
  • Focuses on real, provable risk rather than theoretical findings
  • Now integrates with Microsoft Defender

This matters because MDASH is designed to help security teams reduce noise and identify vulnerabilities that attackers could actually exploit.

Defender integration with GitHub Code Security is GA

Microsoft also announced that native integration between Microsoft Defender and GitHub Code Security is now generally available.

This integration adds:

  • Runtime context for code vulnerabilities
  • Enrichment with production signals like internet exposure and data sensitivity
  • AI-assisted remediation through GitHub Copilot Autofix and the GitHub Copilot cloud agent
  • Role-based access controls for secure vulnerability handling

The result is a more practical workflow for prioritizing and fixing issues earlier in development.

New focus on securing agents

Microsoft highlighted new capabilities for building secure, enterprise-ready agents by default, including the general availability of the Agent 365 SDK.

According to Microsoft, these capabilities help developers embed:

  • Observability
  • Access controls
  • Compliance enforcement
  • Governance across deployment environments

This reflects a broader shift as AI agents become part of the modern application stack.

Why this matters for IT admins and security teams

For administrators and security teams, these announcements point to a more integrated DevSecOps model. Instead of relying only on downstream scanning and manual triage, organizations can bring exploitability analysis, runtime context, and AI-assisted remediation directly into developer workflows.

This is especially relevant for enterprises trying to manage shadow AI, tool sprawl, and governance requirements while still supporting rapid software delivery.

Next steps

  • Review whether your organization is eligible for the MDASH expanded preview
  • Evaluate the Microsoft Defender and GitHub Code Security integration if you use GitHub-based development workflows
  • Assess how AI agents are being built and governed in your environment
  • Update internal DevSecOps processes to include AI-specific security controls and visibility

Microsoft’s Build 2026 announcements show that securing code, agents, and models is becoming a core requirement for enterprise development—not a separate afterthought.

Need help with Security?

Our experts can help you implement and optimize your Microsoft solutions.

Talk to an Expert

Stay updated on Microsoft technologies

Read the original article by Aleš Holeček
Microsoft SecurityMDASHGitHub Code SecurityMicrosoft DefenderAI security

Related Posts

Security

Microsoft Black Hat 2026: AI and Supply Chain Defense

Microsoft used Black Hat USA 2026 to spotlight how attackers are abusing trusted software, identities, cloud services, and AI systems to scale attacks. The company also highlighted ongoing npm supply chain investigations, new Microsoft Defender Experts capabilities, and research sessions that give security teams practical guidance for defending trust paths.

Security

ACR Stealer Campaigns: ClickFix Threats Rise

Microsoft reports increased ACR Stealer activity targeting enterprises through ClickFix social engineering, with two intrusion chains using WebDAV, Python loaders, MSHTA, obfuscated PowerShell, and steganography. The campaigns focus on stealing browser credentials, session tokens, and sensitive documents, making early detection and user awareness critical for defenders.

Security

AI Agent Least Privilege: Identity and RBAC Guide

Microsoft is urging organizations to treat AI agents as first-class identities with tightly scoped access, explicit role assignments, and controlled tool bindings. The guidance matters because agentic workflows can span multiple systems, increasing the blast radius of misconfigured permissions, weak audit trails, and unclear accountability.

Security

AsyncAPI npm Supply Chain Attack: Import-Time Malware

Microsoft Threat Intelligence uncovered a coordinated compromise of the AsyncAPI npm organization that republished five package versions with malicious code that runs when packages are imported, not just installed. The incident matters because common mitigations like npm install --ignore-scripts do not stop this technique, putting developer workstations, CI/CD pipelines, and production services at risk if they resolved the affected versions.

Security

Defender Experts Adds Threat Intelligence and MDR

Microsoft has launched Defender Experts Threat Intelligence and expanded Defender Experts MDR with third-party and multi-cloud coverage powered by Microsoft Sentinel. The update helps security teams turn threat intelligence into action faster by combining expert-led guidance, unified Defender portal workflows, and broader cross-platform incident response.

Security

Salesforce OAuth Abuse: Microsoft Guidance on ShinyHunters

Microsoft detailed how threat activity associated with ShinyHunters abused trusted OAuth relationships in Salesforce to gain persistent access, exfiltrate CRM data, and evade traditional sign-in detections. The company also announced improved Salesforce telemetry and near-real-time detection in Defender for Cloud Apps, giving security teams better visibility into connected apps, OAuth scopes, and suspicious SaaS activity.