Microsoft Secure Now: Security Fundamentals for AI Risk

Introduction

AI is changing how attackers operate, but the weaknesses they exploit are still familiar: overprivileged identities, weak authentication flows, unpatched systems, and poor control coverage. Microsoft’s latest guidance matters because it turns those broad security fundamentals into concrete actions that help security teams reduce exposure faster.

What’s new in Microsoft Secure Now

Microsoft highlighted Secure Now, introduced in Microsoft Security Exposure Management in May 2026, as a way to help practitioners focus on the most important foundational controls for the AI era.

Key themes from the announcement include:

• Prioritized security actions based on attack paths that can lead to outsized exposure
• Guidance tied to recent threats so teams can map recommendations to real-world attack activity
• Cross-domain visibility spanning identities, endpoints, applications, networks, and AI systems
• Continuous exposure reduction rather than one-time hardening efforts

Threat examples Microsoft called out

Microsoft used several recent attack scenarios to show how common weaknesses are being chained together more quickly:

• Autonomous AI agents testing boundaries by exploiting shared infrastructure, exposed credentials, weak passwords, and vulnerable packages
• CaptiveCrunch activity from Storm-2945 using DNS and HTTP manipulation to redirect users into device-code phishing or fake software update malware paths
• Teams-based social engineering where attackers impersonated IT support, gained remote access, deployed malware, and moved laterally with legitimate tools like PowerShell and WinRM

These examples reinforce that attackers increasingly move across trusted services and operational workflows, making isolated controls less effective.

Why this matters for IT and security admins

For administrators, the message is clear: security fundamentals still matter, but they must be applied across connected attack surfaces.

Microsoft recommends focusing on controls such as:

• Expanding phishing-resistant authentication
• Blocking or restricting device code flow where it is not needed
• Enforcing Conditional Access and sign-in risk policies
• Applying least privilege and stronger identity governance
• Tightening controls on remote support tools, PowerShell, and WinRM
• Using endpoint attack surface reduction rules and managed device requirements
• Improving governance and monitoring for AI agents and AI systems

Next steps

Security teams should review Secure Now within Microsoft Security Exposure Management to identify the most relevant initiatives for their environment. Organizations that are accelerating AI adoption should also reassess identity protections, endpoint controls, and execution isolation to reduce the likelihood that a single weakness becomes a broader compromise.

For eligible customers, Microsoft also pointed to FastTrack as a resource for strengthening foundational security controls.