Microsoft Defender for Cloud Customer Newsletter
What's new in Defender for Cloud? Now in public preview, DCSPM (Defender for Cloud Security Posture Management) extends its capabilities to cover serverless workloads in both Azure and AWS, like Azure Web Apps and AWS Lambda. For more information, see our public documentation. Defender for Cloud’s integration with Endor Labs is now GA Focus on exploitable open-source vulnerabilities across the application lifecycle with Defender for Cloud and Endor Lab integration. This feature is now generally available! For more details, please refer to this documentation. Blogs of the month In December, our team published the following blog posts: Defender for AI Alerts Demystifying AI Security Posture Management Breaking down security silos: Defender for Cloud expands into the Defender portal Part 3: Unified Security Intelligence – Orchestrating Gen AI Threat Detection with Microsoft Sentinel Defender for Cloud in the field Watch the latest Defender for Cloud in the Field YouTube episode here: Malware Automated Remediation New Secure score in Defender for Cloud GitHub Community Check out Module 27 in the Defender for Cloud lab on GitHub. This module covers gating mechanisms to enforce security policies and prevent deployment of insecure container images. Click here for MDC Github lab module 27 Customer journeys Discover how other organizations successfully use Microsoft Defender for Cloud to protect their cloud workloads. This month we are featuring Ford Motor Company. Ford Motor Company, an American multinational automobile manufacturer, and its innovative and evolving technology footprint and infrastructure needed equally sophisticated security. With Defender and other Microsoft products like Purview, Sentinel and Entra, Ford was able to modernize and deploy end-to-end protection, with Zero-trust architecture, and reduce vulnerabilities across the enterprise. Additionally, Ford’s SOC continues to respond with speed and precision with the help of Defender XDR. Join our community! JANUARY 20 (8:00 AM- 9:00 AM PT) What's new in Microsoft Defender CSPM We offer several customer connection programs within our private communities. By signing up, you can help us shape our products through activities such as reviewing product roadmaps, participating in co-design, previewing features, and staying up-to-date with announcements. Sign up at aka.ms/JoinCCP. We greatly value your input on the types of content that enhance your understanding of our security products. Your insights are crucial in guiding the development of our future public content. We aim to deliver material that not only educates but also resonates with your daily security challenges. Whether it’s through in-depth live webinars, real-world case studies, comprehensive best practice guides through blogs, or the latest product updates, we want to ensure our content meets your needs. Please submit your feedback on which of these formats do you find most beneficial and are there any specific topics you’re interested in https://aka.ms/PublicContentFeedback. Note: If you want to stay current with Defender for Cloud and receive updates in your inbox, please consider subscribing to our monthly newsletter: https://aka.ms/MDCNewsSubscribe
Custom detection rules get a boost—explore what’s new in Microsoft Defender
Co-author - Jeremy Tan In today's rapidly evolving cybersecurity landscape, staying ahead of threats is crucial. Microsoft Defender's custom detection rules offer a powerful way to proactively monitor and respond to security threats. These user-defined rules can be configured to run at regular intervals to detect security threats—generating alerts and triggering response actions when threats are detected. If you are a Microsoft Sentinel user and have connected your Sentinel workspace to Microsoft Defender, you are probably more familiar with analytics rules in Microsoft Sentinel and are looking to explore the capabilities and benefits of custom detections. Understanding and leveraging custom detection rules can significantly enhance your organization's security posture. This blog will delve into the benefits of custom detections and showcase scenarios that highlight their capabilities, helping you make the most of this robust feature. We are excited to release these brand-new enhancements that are now available in public preview. What’s new in custom detections? The improvements in custom detections aim to enhance their functionality and usability, making it easier to manage and respond to security threats effectively. Unified user defined detection list: Manage all your user-defined detections from Microsoft Defender XDR and Microsoft Sentinel in one place. Filtering capabilities for every column. Search freely using rule title or rule ID. View the new workspace ID column (filterable) for multi-workspace organizations that onboarded multiple workspaces to the unified SOC platform. Manage all detections from MTO portal across all your tenants. Show details pane for every rule (whether custom detection or analytics rule). Perform the following actions on rules: Turn on/off Delete Edit Run (only for custom detections) Open rule’s page (only for custom detections) Migrate eligible scheduled custom detections to near real-time custom detections with one click using the new migration tool. Dynamic alert titles and descriptions: Dynamically craft your alert’s title and description using the results of your query to make them accurate and indicative. Advanced entity mapping: Link a wide range of entity types to your alerts. Enrich alerts with custom details: Surface details to display in the alert side panel. Support Sentinel-only data: Custom detections support Microsoft Sentinel data only without dependency on Microsoft Defender XDR data. Flexible and high frequency support for Sentinel data: Custom detections support high and flexible frequency for Microsoft Sentinel data. The benefits of custom detections Let’s examine some of the key benefits of custom detections: Query data from Defender XDR and Sentinel seamlessly: You can create custom detection rules that query data from both Microsoft Sentinel and Defender XDR tables seamlessly, without the need of sending Defender XDR data to Sentinel. Cost efficiency: Save on ingestion costs if you don’t need to retain Microsoft Defender XDR data in analytics tier for more than 30 days but have detection use cases involving both Defender XDR and Sentinel data. Detect threats immediately and remove dependency on quick ingestion: near real time (NRT) custom detections monitor events as they stream, while standard custom detections evaluate both the event ingestion time and the time the event was generated. Unlimited NRT detections: NRT custom detections are unlimited, you can create as many as you need. Since they are based on a streaming technology, they are not generating any load on the system. Native remediation actions: You can configure custom detection rule to automatically take actions on devices, files, users, or emails that are returned by the query when your detection query is correlating Defender XDR and Microsoft Sentinel data, or Defender XDR data only. Entity mapping: Entities are automatically mapped to the alert for all XDR tables. Out of the box alert de-duplication: To reduce alert fatigue when alert generated with the same impacted entities, custom details, title and description - they will merge to the same alert (keeping all raw events linked to the single alert). With this capability you don’t need to worry about duplicated alerts – we take care of it for you. Built-in functions: You can leverage built-in enrichment functions when you build your custom detection queries, such as FileProfile(), SeenBy(), DeviceFromIP() and AssignedIPAddresses(). Extended lookback period: Custom detections have a long lookback period of up to 30 days for rules that run once a day, ideal for historical trending detections. Common scenarios To truly understand the power and versatility of custom detection rules in Microsoft Defender, it's essential to see them in action. In this section, we'll explore several common use cases that demonstrate how these new capabilities can be leveraged to enhance your organization's security posture. These scenarios highlight the benefits of the capabilities, providing you with actionable insights to implement in your own environment. Use Case – detecting potential malicious activity In this use case, we aim to detect potential malicious activity by monitoring logon attempts from different IP addresses. We will implement a custom detection rule that: Monitors successful logon by a user from one IP address and a failed logon attempt from a different IP address (may indicate a malicious attempt at password guessing with a known account). Enriches alerts with user's information from Microsoft Defender for Identity’s IdentityInfo table, including Job title, Department, Manager’s name, and assigned roles. If the user has been found in the 'Terminated Employees’ watchlist, indicating that the user has been notified for termination or marked as terminated, reflect this in the alert name and description. Runs once a day with a lookback period of 30 days, avoiding duplicate alerts on subsequent intervals. Let’s walk through the creation of the custom detection rule and examine the outcome. 1. Here is the sample KQL query we will run in advanced hunting page to create the custom detection. let logonDiff = 10m; let Terminated_Watchlist = _GetWatchlist("TerminatedEmployees") | project tolower(SearchKey);// Get the TerminiatedEmploees Watchlist let aadFunc = (tableName:string) { table(tableName) | where ResultType == "0" | where AppDisplayName !in ("Office 365 Exchange Online", "Skype for Business Online") // To remove false-positives, add more Apps to this array | extend SuccessIPv6Block = strcat(split(IPAddress, ":")[0], ":", split(IPAddress, ":")[1], ":", split(IPAddress, ":")[2], ":", split(IPAddress, ":")[3]) | extend SuccessIPv4Block = strcat(split(IPAddress, ".")[0], ".", split(IPAddress, ".")[1]) | project SuccessLogonTime = TimeGenerated, UserPrincipalName, SuccessIPAddress = IPAddress, SuccessLocation = Location, AppDisplayName, SuccessIPBlock = iff(IPAddress contains ":", strcat(split(IPAddress, ":")[0], ":", split(IPAddress, ":")[1]), strcat(split(IPAddress, ".")[0], ".", split(IPAddress, ".")[1])), Type | join kind= inner ( table(tableName) | where ResultType !in ("0", "50140") | where ResultDescription !~ "Other" | where AppDisplayName !in ("Office 365 Exchange Online", "Skype for Business Online") | project FailedLogonTime = TimeGenerated, UserPrincipalName, FailedIPAddress = IPAddress, FailedLocation = Location, AppDisplayName, ResultType, ResultDescription, Type ) on UserPrincipalName, AppDisplayName | where SuccessLogonTime < FailedLogonTime and FailedLogonTime - SuccessLogonTime <= logonDiff and FailedIPAddress !startswith SuccessIPBlock // Compare the success and failed logon time | summarize FailedLogonTime = max(FailedLogonTime), SuccessLogonTime = max(SuccessLogonTime) by UserPrincipalName, SuccessIPAddress, SuccessLocation, AppDisplayName, FailedIPAddress, FailedLocation, ResultType, ResultDescription, Type | extend Timestamp = SuccessLogonTime | extend UserInTerminatedWatchlist = iif(UserPrincipalName in (Terminated_Watchlist), 'True', 'False') // Check if the impacted user is found in the Watchlist | extend AlertName = iif(UserInTerminatedWatchlist == 'True', "Successful logon by a 'Terminated Employees Watchlist' user from one IP and a failed logon attempt from a different IP","Successful logon from IP and failure from a different IP") // This is the define the dynamic alert value | extend AlertDescription = iif(UserInTerminatedWatchlist == 'True', "A Successful logon by a 'Terminated Employees Watchlist' user onto an Azure App from one IP and within 10 mins failed to logon to the same App via a different IP (may indicate a malicious attempt at password guessing with known account). ","A user account successfully logs onto an Azure App from one IP and within 10 mins failed to logon to the same App via a different IP (may indicate a malicious attempt at password guessing with known account).") // This is to define the dynamic alert description | extend UserPrincipalName = tolower(UserPrincipalName)}; let aadSignin = aadFunc("SigninLogs"); let aadNonInt = aadFunc("AADNonInteractiveUserSignInLogs"); union isfuzzy=true aadSignin, aadNonInt | extend Name = tostring(split(UserPrincipalName,'@',0)[0]), UPNSuffix = tostring(split(UserPrincipalName,'@',1)[0]) | join kind=leftouter ( IdentityInfo // Correlate with IdentityInfo table | summarize arg_max (TimeGenerated,AccountObjectId, Department, JobTitle, Manager, AssignedRoles, ReportId, IsAccountEnabled) by AccountUpn | extend UserPrincipalName=tolower(AccountUpn) ) on UserPrincipalName 2. On the top right corner of the advance hunting page, select ‘create custom detection’ under Manage rules. 3. Populate the relevant rule’s information. 4. Specify alert title and description by referencing the AlertName and AlertDescription fields defined in the query, as we will dynamically craft the alert title and description, depending on whether the impacted user is found in the 'Terminated Employees’ watchlist. 5. In the entity mapping section, you will find some entity mappings that we have pre-populated for you, which would save you some time and effort. You can update or add the mappings as you wish. 6. Let’s add some additional mappings. In this example, I will add IP entities under Related Evidence. 7. In the Custom details section, I will add the following key-value pairs to surface additional information of the impact user in the alert. 8. On the Automated actions page, because we are correlating Sentinel data with Defender XDR table (IdentityInfo), you have the option to select first-party remediation actions, which is ‘Mark user as compromised’ in our case. 9. Review the configuration of the rule and click Submit. 10. Now, let’s examine how the incident/alert would look. Below is a sample incident triggered. 11. Select the alert and you will find the custom details on the right pane, surfacing additional information such as Job title, Department, Manager’s name and Assigned roles that we configured. 12. The impacted user from the above incident was not found in the 'Terminated Employees’ watchlist. Now, let’s examine how the incident/alert would look when the impacted user is found in the watchlist. 13. In my environment, I have configured the watchlist and will be using ‘MeganB’ for simulation. 14. Notice how the alert title and description is different from the one generated earlier, to reflect user found in the watchlist. 15. The rule will run once a day with a look back period of 30 days. However, custom detection will not create duplicate alerts if the same impacted entities are found in the subsequent runs. Instead, you will find the Last activity time being updated and more events showing up in the result table of the alert page. Conclusion Custom detection rules in Microsoft Defender offer a powerful and flexible way to enhance your organization's security posture. By leveraging these user-defined rules, you can proactively monitor and respond to security threats, generating detailed and actionable alerts. The recent enhancements—such as unified detection lists, dynamic alert titles, and advanced entity mapping—further improve the functionality and usability of custom detections. Ready to enhance your threat detection capabilities? Start exploring and implementing custom detection rules in Microsoft Defender today to safeguard your digital assets and maintain a strong security posture. Useful links Overview of custom detections in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn Create and manage custom detection rules in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn
Host Microsoft Defender data locally in the United Arab Emirates
We are pleased to announce that local data residency support in the UAE is now generally available for Microsoft Defender for Endpoint and Microsoft Defender for Identity. This announcement reinforces our ongoing commitment to delivering secure, compliant services aligned with local data sovereignty requirements. Customers can now confidently onboard to Defender for Endpoint and Defender for Identity in the UAE, knowing that this Defender data will remain at rest within the UAE data boundary. This allows customers to meet their regulatory obligations and maintain control over their data. For more details on the Defender data storage and privacy policies, refer to Microsoft Defender for Endpoint data storage and privacy and Microsoft Defender for Identity data security and privacy. Note: Defender for Endpoint and Defender for Identity may potentially use other Microsoft services (i.e. Microsoft Intune for security settings management). Each Microsoft service is governed by its own data storage and privacy policies and may have varying regional availability. For more information, refer to our Online Product Terms. In addition to the UAE, Defender data residency capabilities are available in the United States, the European Union, the United Kingdom, Australia, Switzerland and India (see our recent announcement for local data hosting in India). Customers with Existing deployments for Defender for Endpoint and/or Defender for Identity Existing customers can check their deployment geo within the portal by going to Settings -> Microsoft Defender XDR-> Account; and see where the service is storing your data at rest. For example, in the image below, the service location for the Defender XDR tenant is UAE. ation information If you would like to update your service location, please reach out to Customer Service and Support for a tenant reset. Support can be accessed by clicking on the “?” icon in the top right corner of the portal when signed in as an Admin (see image below). If you are a Microsoft Unified support customer, please reach out to your Customer Success Account Manager for assistance with the migration process. More information: Ready to go local? Read our documentation for more information on how to get started. Microsoft Defender XDR data center location Not yet a customer? Take Defender XDR for a spin via a 90-day trial for Office 365 E5 or Defender for Endpoint via a 90-day trial for Defender for Endpoint Check out the Defender for Endpoint website to learn more about our industry leading Endpoint protection platform Check out the Defender for Identity website to learn how to keep your organization safe against rising identity threatsBreaking down security silos: Microsoft Defender for Cloud Expands into the Defender Portal
Picture this: You’re managing security across Azure, AWS, and GCP. Alerts are coming from every direction, dashboards are scattered and your team spends more time switching portals than mitigating threats. Sound familiar? That’s the reality for many organizations today. Now imagine a different world—where visibility, control and response converge into one unified experience, where posture management, vulnerability insights and incident response live side by side. That world is no longer a dream: Microsoft Defender for Cloud (MDC) is now integrated into Defender XDR in public preview. The expansion of MDC into the Defender portal isn’t just a facelift. It’s a strategic leap forward toward a Cloud-Native Application Protection Platform (CNAPP) that scales with your business. With Microsoft Defender for Cloud’s deep integration into the unified portal, we eliminate security silos and bring a modern, streamlined experience that is more intuitive and purpose-built for today’s security teams, while delivering a single pane of glass for hybrid and multi-cloud security. Here’s what makes this release a game-changer: Unified dashboard See everything with a single pane of glass—security posture, coverage, trends—across Azure, AWS and GCP. No more blind spots. Risk-based recommendations Prioritize by exploitability and business impact. Focus on what matters most, not just noise. Attack path analysis across all Defenders Visualize potential breach paths and cut them off before attackers can exploit them. Unified cloud assets inventory A consolidated view of assets, health data and onboarding state—so you know exactly where you stand. Cloud scopes & unified RBAC Create boundaries between teams, ensure each persona has access to the right level of data in the Defender portal. The enhanced in-portal experience includes all familiar Defender for Cloud capabilities and adds powerful new cloud-native workflows — now accessible directly within the Defender portal. Over time, additional features will be rolled out so that security teams can rely on a single pane of glass for all their pre- and post-breach operations. Unified cloud security dashboard A brand-new “Cloud Security→ Overview” page in Defender portal gives you a central place to assess your cloud posture across all connected clouds and environments (Azure, AWS, GCP, on-prem and onboarded environments such as Azure DevOps, Github, Gitlab, DockerHub, Jfrog). The unified dashboard displays the new Cloud Security Score, Threat Detection alerts and Defender coverage statistics. Amongst the high-level metrics, you can find the number of assessed resources, count of active recommendations, security alerts and more, giving you at-a-glance insight into your environment’s health. From here, you can drill into individual areas: Security posture, Exposure Management bringing visibility over Recommendations and Vulnerability Management, a unified asset inventory, workload specific insights and historical security posture data going back up to 6 months. Cloud Assets Inventory The cloud asset inventory view provides a unified, contextual inventory of all resources you have connected to Defender for Cloud — across cloud environments or on-premises. Assets are categorized by workload type, criticality, Defender coverage status, with integrated health data, risk signals, associated exposure management data, recommendations and related attack paths. Resources with unresolved security recommendations or alerts are clearly flagged — helping you quickly prioritize on risky or non-compliant assets. While you will get a complete list of cloud assets under "All assets", the rest of the tabs show you the complete view into each workload, with detailed and specific insights on each workload (VMs, Data, Containers, AI, API, DevOps, Identity and Serverless). Posture & Risk Management: From Secure Score to risk-based recommendations The traditional posture-management and CSPM capabilities of Defender for Cloud expand into the Defender portal under “Exposure Management.” A key upgrade is the new Cloud Secure Score — a risk-based model that factors in asset criticality and risk factors (e.g. internet exposure, data sensitivity) to give a more accurate, prioritized view of cloud security posture. The score ranges from 0 to 100, where 100 means perfect posture. It aggregates across all assets, weighting each asset by its criticality and the risk of its open recommendations. You can view the Cloud Secure Score overall, by subscription, cloud environment or workload type. This allows security teams to quickly understand which parts of their estate require urgent attention, and track posture improvements over time. Defender for Cloud continues to generate security recommendations based on assessments against built-in (or custom) security standards. When you have the Defender CSPM plan enabled in the Defender portal, these recommendations are surfaced with risk-based prioritization, where recommendations are tied to high-risk or critical assets show up first — helping you remediate what matters most. Each recommendation shows risk level, number of attack paths, MITRE ATT&CK tactics and techniques. For each recommendation you will see the remediation steps, attack map and the initiatives it contributes to - such as the Cloud Secure score. Continued remediation — across all subscriptions and environments — is the path toward a hardened cloud estate. Proactive Attack Surface Management: Attack path analysis A powerful addition is the "Attack paths" overview, which helps you visualize potential paths attackers could use — from external exposure zones to your most critical business assets to infiltrate your environment and access sensitive data. Defender’s algorithm models your network, resource interactions, vulnerabilities and external exposures to surface realistic, exploitable attack paths, rather than generic threat scenarios, while putting focus on the top targets, entry points and choke points involved in attack paths. The Attack Paths page organizes findings by risk level and correlates data across all Defender solutions, allowing users to rapidly detect high-impact attack paths and focus remediation on the most vulnerable assets. For some workloads, for example container-based or runtime workloads, additional prerequisites may apply (e.g. enabling agentless scanning or relevant Defender plans) to get full visualization. Governance, Visibility and Access: Cloud Scopes and Unified RBAC The expansion into the Defender portal doesn’t just bring new dashboards — it also brings unified access and governance using a single identity and RBAC model for the Defender solutions. Now you can manage cloud security permissions alongside identity, device and app permissions. Cloud Scopes ensure that teams with appropriate roles within the defined permission groups (e.g. Security operations, Security posture) can access the assets and features they need, scoped to specific subscriptions and environments. This unified scope system simplifies operations, reduces privilege sprawl and enforces consistent governance across cloud environments and across security domains. The expansion of Defender for Cloud into the Defender portal is more than a consolidation—it’s a strategic shift toward a truly integrated security ecosystem. Cloud security is no longer an isolated discipline. It is intertwined with exposure management, threat detection, identity protection and organizational governance. To conclude, this new experience empowers security teams to: Understand cloud risk in full context Prioritize remediation that reduces real-world threats Investigate attacks holistically across cloud and non-cloud systems Govern access and configurations with greater consistency Predict and prevent attack paths before they happen In this new era, cloud security becomes a continuous, intelligent and unified journey. The Defender portal is now the command center for that journey—one where insights, context and action converge to help organizations secure the present while anticipating the future. Ready to Explore? Defender for Cloud in the Defender portal Integration FAQ Enable Preview Features Azure portal vs Defender portal feature comparison What’s New in Defender for CloudIgnite 2025: What's new in Microsoft Defender?
This Ignite we are focused on giving security teams the edge they need to meet adversaries head on in the era of AI. The modern Security Operations Center (SOC) is undergoing a fundamental transformation, placing AI at the forefront of innovation - not just as an added feature, but as a driving force at every layer of the stack. While much attention is rightly focused on the development of security agents, we fundamentally believe that AI must also evolve the very foundation of our security solutions. This means building solutions that more effectively uncover novel threats, act dynamically to defend the organization during attacks, and reduce the workload for the security team. As organizations adopt AI at an unprecedented speed, we also want to make sure they can do so securely. To meet these security needs of the AI era, we are excited to announce a series of innovations that will help organizations shift to an autonomous defense and an agentic SOC. New agents to help scale and accelerate security operations Evolving Microsoft Defender’s autonomous defense capabilities for better protection Secure your low-code and pro-code AI agents with Microsoft Defender Today, we are taking the first step in shifting security operations from static controls to autonomous defense and from manual toil to agentic operations. But we have an ambitious vision to augment and evolve these AI capabilities and agents across the entire SOC lifecycle and are excited to share some of that vision, as shown in the below graphic, with you at Microsoft Ignite. The Agentic SOC: Scaling expertise and accelerating defense We are excited to introduce four new Security Copilot agents in Microsoft Defender that bring autonomous intelligence across different stages of the SOC lifecycle. These agents combine context, reasoning, and complex workflows to help defenders anticipate attacks sooner, detect smarter, and investigate faster than ever before. Phishing Triage Agent: In March 2025, we introduced the Phishing Triage Agent, built to autonomously handle user-submitted phishing reports at scale. The agent reviews and classifies incoming alerts, resolves false positives and escalates only the malicious cases that require human expertise. Early data shows that analysts working with the agent caught up to 6.5x more malicious emails compared to professional graders. Today, we’re excited to announce that the agent’s triage capabilities will soon extend beyond phishing to cover identity and cloud alerts. Secondly, we are also improving our phish admin reporting process with a new agentic email grading system. It replaces a manual review process with advanced large language models and agentic workflows to deliver rapid, transparent verdicts and clear explanations to customers for every reported email. Learn more about the agentic email grading system. Threat Hunting Agent – this agent reimagines the investigation process. Instead of requiring analysts to master complex query languages or sift through mountains of data, the Threat Hunting Agent enables natural language investigations with contextual insight. Analysts can vibe with the agent by asking questions in plain English, receive direct answers, and be guided through comprehensive hunting sessions. This levels up the current NL2KQL experience by enabling analysts to explore patterns, pivot intuitively and uncover hidden signals in real time for a fluid, context-aware experience. This not only accelerates investigations but makes advanced threat hunting accessible to every member of the SOC, regardless of experience level. Dynamic Threat Detection Agent – One of the hardest challenges in detection engineering is finding and fixing false negatives. The Dynamic Threat Detection Agent proactively hunts for false negatives and blind spots that traditional alerting might miss. When a critical incident happens, Copilot will kick off an automated hunt to uncover undetected threats—like unusual residual activity around a sensitive identity. This agent turns ‘probably fine’ into proven secure—hunting the quiet persistence that slips past alerts and closing the gap before it becomes tomorrow’s breach. Threat Intelligence (TI) Briefing Agent – Now native in the Defender portal. Generate tailored, AI‑authored threat briefings in minutes—synthesizing global intel with your environment’s context—without leaving the incident pane. Figure 1. The Threat Hunting Agent showing insights on an incident that contained a high risk binary To make the agents easily accessible and help security teams get started more quickly, we are excited to announce that Security Copilot will be available to all Microsoft 365 E5 customers. Rollout starts today for existing Security Copilot customers with Microsoft 365 E5 and will continue in the upcoming months for all Microsoft 365 E5 customers. Customers will receive 30-day advanced notification before activation. Learn more. Autonomous Defense at Platform Scale Threat actors are automating everything. Ransomware campaigns can encrypt an entire environment in under an hour. Adversaries evade detection and pivot across identities, endpoints, and cloud resources faster than human teams can triage alerts. Traditional SOC models—built on manual workflows and fragmented tools—simply can’t keep pace. Every second of delay gives attackers an advantage. Microsoft Defender now counters that speed by delivering autonomous defense at scale. Defender shifts security from reactive firefighting to proactive protection, embedding AI into the foundation of our protection solutions for instant detection, disruption, and containment—before threats escalate. In 2023, we introduced automatic attack disruption, which autonomously stops attacks in progress—like ransomware or business email compromise—with policy-bound actions that isolate endpoints, disable compromised accounts, and block malicious IPs at machine speed. Today, we’re taking the next step. New capabilities show how AI and agentic technology are transforming security to better protect customers: Unleash automatic attack disruption across your SIEM data: We are expanding the disruption capabilities of Microsoft Defender to some of the most critical data sources customer connect via Microsoft Sentinel including AWS, Proofpoint and Okta. This enables real-time detection and automatic containment of threats like phishing and identity compromise on top of your log data, fundamentally turning your SIEM into a threat protection solution. While these capabilities leverage the power of our platform, Defender is not a requirement for customers to realize this value in Microsoft Sentinel. Figure 2. Attack disruption initiated on an AWS attack Predictive shielding – This brand-new automatic attack disruption capability activates immediately after an attack is first contained. Our first of its kind capability combines graph insights, AI, and threat intelligence to predict potential attack paths for where the adversary might go next. It then applies just-in-time hardening techniques that proactively block the attacker from pivoting. Some of the hardening tactics that will automatically be applied by Microsoft Defender include disabling SafeBoot and enforcing Group Policy Objects, putting a hard stop to the attacker’s movements and ability to execute common techniques for compromise. Learn more about predictive shielding and other endpoint security news. Protect your low-code and pro-code AI agents Generative AI and agents are rapidly transforming how we work, but these powerful new tools also introduce new risks. And with the democratization of agent creation across pro-code, low-code, and no-code building platforms, building agents is now accessible to everyone, many without extensive developer or security knowledge. To help security teams better manage these risks we are excited to announce that we are extending the capabilities and experiences in Microsoft Defender to the protection of agents. From agent security posture management, to attack path analysis, and threat protection for Copilot Studio, Azure Foundry, and agents built and connected via the Microsoft Agent 365 SDK. Learn more about how Microsoft Defender can help protect your agents against threats like prompt injections and more. There is so much more innovation we are introducing in Microsoft Defender today, including expanded endpoint security coverage for legacy systems, improvements to how you can investigate identity-centric threats, and we are bringing cloud security posture management into the Defender portal. Check out the other Defender news blogs for more details. Join us in San Francisco, November 17–21, or online, November 18–20, for deep dives and practical labs to help you maximize your Microsoft Defender investments and to get more from the Microsoft capabilities you already use. Featured sessions: Microsoft Defender: Building the agentic SOC with guest Allie Mellen Blueprint for building the SOC of the future Empowering the SOC: Security Copilot and the rise of agentic defense Identity Under Siege: Modern ITDR from Microsoft AI vs AI: Protect email and collaboration tools with Microsoft Defender AI-powered defense for cloud workloads Endpoint security in the AI era: What's new in DefenderMonthly news - December 2025
Microsoft Defender Monthly news - December 2025 Edition This is our monthly "What's new" blog post, summarizing product updates and various new assets we released over the past month across our Defender products. In this edition, we are looking at all the goodness from October 2025. Defender for Cloud has its own Monthly News post, have a look at their blog space. 😎 Microsoft Ignite 2025 - now on-demand! 🚀 New Virtual Ninja Show episode: Advancements in Attack Disruption Vulnerability Remediation Agent in Microsoft Intune Microsoft Defender Ignite 2025: What's new in Microsoft Defender? This blog summarizes our big announcements we made at Ignite. (Public Preview) Defender XDR now includes the predictive shielding capability, which uses predictive analytics and real-time insights to dynamically infer risk, anticipate attacker progression, and harden your environment before threats materialize. Learn more about predictive shielding. Security Copilot for SOC: bringing agentic AI to every defender. This blog post gives a great overview of the various agents supporting SOC teams. Account correlation links related accounts and corresponding insights to provide identity-level visibility and insights to the SOC. Coordinated response allows Defenders to take action comprehensively across connected accounts, accelerating response and minimizing the potential for lateral movement. Enhancing visibility into your identity fabric with Microsoft Defender. This blog describes new enhancements to the identity security experience within Defender that will help enrich your security team’s visibility and understanding into your unique identity fabric. (Public Preview) The IdentityAccountInfo table in advanced hunting is now available for preview. This table contains information about account information from various sources, including Microsoft Entra ID. It also includes information and link to the identity that owns the account. Microsoft Sentinel customers using the Defender portal, or the Azure portal with the Microsoft Sentinel Defender XDR data connector, now also benefit from Microsoft Threat Intelligence alerts that highlight activity from nation-state actors, major ransomware campaigns, and fraudulent operations. For more information, see Incidents and alerts in the Microsoft Defender portal. (Public Preview) New Entity Behavior Analytics (UEBA) experiences in the Defender portal! Microsoft Sentinel introduces new UEBA experiences in the Defender portal, bringing behavioral insights directly into key analyst workflows. These enhancements help analysts prioritize investigations and apply UEBA context more effectively. Learn more on our docs. (Public Preview) A new Restrict pod access response action is now available when investigating container threats in the Defender portal. This response action blocks sensitive interfaces that allow lateral movement and privilege escalation. (Public Preview) Threat analytics now has an Indicators tab that provides a list of all indicators of compromise (IOCs) associated with a threat. Microsoft researchers update these IOCs in real time as they find new evidence related to the threat. This information helps your security operations center (SOC) and threat intelligence analysts with remediation and proactive hunting. Learn more. In addition the overview section of threat analytics now includes additional details about a threat, such as alias, origin, and related intelligence, providing you with more insights on what the threat is and how it might impact your organization. Microsoft Defender for Identity (Public Preview) In addition to the GA release of scoping by Active Directory domains a few months ago, you can now scope by Organizational Units (OUs) as part of XDR User Role-Based Access Control. This enhancement provides even more granular control over which entities and resources are included in security analysis. For more information, see Configure scoped access for Microsoft Defender for Identity. (Public Preview). New security posture assessment: Change password for on-prem account with potentially leaked credentials. The new security posture assessment lists users whose valid credentials have been leaked. For more information, see: Change password for on-prem account with potentially leaked credentials. Defender for Identity is slowly rolling out automatic Windows event auditing for sensors v3.x, streamlining deployment by applying required auditing settings to new sensors and fixing misconfigurations on existing ones. As it becomes available, you will be able to enable automatic Windows event-auditing in the Advanced settings section in the Defender portal, or using the Graph API. Identity Inventory enhancements: Accounts tab, manual account linking and unlinking, and expanded remediation actions are now available. Learn more in our docs. Microsoft Defender for Cloud Apps (Public Preview) Defender for Cloud Apps automatically discovers AI agents created in Microsoft Copilot Studio and Azure AI Foundry, collects audit logs, continuously monitors for suspicious activity, and integrates detections and alerts into the XDR Incidents and Alerts experience with a dedicated Agent entity. For more information, see Protect your AI agents. Microsoft Defender for Endpoint Ignite 2025: Microsoft Defender now prevents threats on endpoints during an attack. This year at Microsoft Ignite, Microsoft Defender is announcing exciting innovations for endpoint protection that help security teams deploy faster, gain more visibility, and proactively block attackers during active attacks. (Public Preview) Defender for Endpoint now includes the GPO hardening and Safeboot hardening response actions. These actions are part of the predictive shielding feature, which anticipates and mitigates potential threats before they materialize. (Public Preview) Custom data collection enables organizations to expand and customize telemetry collection beyond default configurations to support specialized threat hunting and security monitoring needs. (Public Preview) Native root detection support for Microsoft Defender on Android. This enables proactive detection of rooted devices without requiring Intune policies, ensuring stronger security and validating that Defender is running on an uncompromised device, ensuring more reliable telemetry that is not vulnerable to attacker manipulation. (Public Preview) The new Defender deployment tool is a lightweight, self-updating application that streamlines onboarding devices to the Defender endpoint security solution. The tool takes care of prerequisites, automates migrations from older solutions, and removes the need for complex onboarding scripts, separate downloads, and manual installations. It currently supports Windows and Linux devices. Defender deployment tool: for Windows devices for Linux devices (Public Preview) Defender endpoint security solution for Windows 7 SP1 and Windows Server 2008 R2 SP1. A Defender for endpoint security solution is now available for legacy Windows 7 SP1 and Windows Server 2008 R2 SP1 devices. The solution provides advanced protection capabilities and improved functionality for these devices compared to other solutions. The new solution is available using the new Defender deployment tool. Microsoft Defender Vulnerability Management (Public Preview) The Vulnerability Management section in the Microsoft Defender portal is now located under Exposure management. This change is part of the vulnerability management integration to Microsoft Security Exposure Management, which significantly expands the scope and capabilities of the platform. Learn more. (General Availability) Microsoft Secure Score now includes new recommendations to help organizations proactively prevent common endpoint attack techniques. Require LDAP client signing and Require LDAP server signing - help ensure integrity of directory requests so attackers can't tamper with or manipulate group memberships or permissions in transit. Encrypt LDAP client traffic - prevents exposure of credentials and sensitive user information by enforcing encrypted communication instead of clear-text LDAP. Enforce LDAP channel binding - prevents man-in-the-middle relay attacks by ensuring the authentication is cryptographically tied to the TLS session. If the TLS channel changes, the bind fails, stopping credential replay. (General Availability) These Microsoft Secure Score recommendations are now generally available: Block web shell creation on servers Block use of copied or impersonated system tools Block rebooting a machine in Safe Mode Microsoft Defender for Office 365 Microsoft Ignite 2025: Transforming Phishing Response with Agentic Innovation. This blog post summarizes the following announcements: General Availability of the Security Copilot Phishing Triage Agent Agentic Email Grading System in Microsoft Defender Cisco and VIPRE Security Group join the Microsoft Defender ICES ecosystem. A separate blog explains these best practices in more detail and outline three other routing techniques commonly used across ICES vendors. Blog series: Best practices from the Microsoft Community Microsoft Defender for Office 365: Fine-Tuning: This blog covers our top recommendations for fine-tuning Microsoft Defender for Office 365 configuration from hundreds of deployments and recovery engagements, by Microsoft MVP Joe Stocker. You may be right after all! Disputing Submission Responses in Microsoft Defender for Office 365: Microsoft MVP Mona Ghadiri spotlights a new place AI has been inserted into a workflow to make it better… a feature that elevates the transparency and responsiveness of threat management: the ability to dispute a submission response directly within Microsoft Defender for Office 365. Blog post: Strengthening calendar security through enhanced remediation.Microsoft Defender for Cloud Customer Newsletter
What's new in Defender for Cloud? Defender for Cloud integrates into the Defender portal as part of the broader Microsoft Security ecosystem, now in public preview. This integration, while adding posture management insight, eliminates silos natively to allow security teams to see and act on threats across all cloud, hybrid, and code environments from one place. For more information, see our public documentation. Discover Azure AI Foundry agents in your environment The Defender Cloud Security Posture Management (CSPM) plan secures generative AI applications and now, in public preview, AI agents throughout its entire lifecycle. Discover AI agent workloads and identify details of your organization’s AI Bill of Materials (BOM). Details like vulnerabilities, misconfigurations and potential attack paths help protect your environment. Plus, Defender for Cloud monitors for any suspicious or harmful actions initiated by the agent. Blogs of the month Unlocking Business Value: Microsoft’s Dual Approach to AI for Security and Security for AI Fast-Start Checklist for Microsoft Defender CSPM: From Enablement to Best Practices Announcing Microsoft cloud security benchmark v2 (public preview) Microsoft Defender for Cloud Innovations at Ignite 2025 Defender for AI services: Threat protection and AI red team workshop Defender for Cloud in the field Revisit the Cloud Detection Response experience here.. Visit our YouTube page: here GitHub Community Check out the Microsoft Defender for Cloud Enterprise Onboarding Guide. It has been updated to include the latest network requirements. This guide describes the actions an organization must take to successfully onboard to MDC at scale. Customer journeys Discover how other organizations successfully use Microsoft Defender for Cloud to protect their cloud workloads. This month we are featuring Icertis. Icertis, a global leader in contract intelligence, launched AI applications using Azure OpenAI in Foundry Models that help customers extract clauses, assess risk, and automate contract workflows. Because contracts contain highly sensitive business rules and arrangements, their deployment of Vera, their own generative AI technology that includes Copilot agents and analytics for tailored contract intelligence, introduced challenges like enforcing and maintaining compliance and security challenges like prompt injections, jailbreak attacks and hallucinations. Microsoft Defender for Cloud’s comprehensive AI posture visibility with risk reduction recommendations and threat protection for AI applications with contextual evidence helped preserve their generative AI applications. Icertis can monitor OpenAI deployments, detect malicious prompts and enforce security policies as their first line of defense against AI-related threats. Join our community! Join our experts in the upcoming webinars to learn what we are doing to secure your workloads running in Azure and other clouds. Check out our upcoming webinars this month! DECEMBER 4 (8:00 AM- 9:00 AM PT) Microsoft Defender for Cloud | Unlocking New Capabilities in Defender for Storage DECEMBER 10 (9:00 AM - 10:00 AM PT) Microsoft Defender for Cloud | Expose Less, Protect More with Microsoft Security Exposure Management DECEMBER 11 (8:00 AM - 9:00 AM PT) Microsoft Defender for Cloud | Modernizing Cloud Security with Next‑Generation Microsoft Defender for Cloud We offer several customer connection programs within our private communities. By signing up, you can help us shape our products through activities such as reviewing product roadmaps, participating in co-design, previewing features, and staying up-to-date with announcements. Sign up at aka.ms/JoinCCP. We greatly value your input on the types of content that enhance your understanding of our security products. Your insights are crucial in guiding the development of our future public content. We aim to deliver material that not only educates but also resonates with your daily security challenges. Whether it’s through in-depth live webinars, real-world case studies, comprehensive best practice guides through blogs, or the latest product updates, we want to ensure our content meets your needs. Please submit your feedback on which of these formats do you find most beneficial and are there any specific topics you’re interested in https://aka.ms/PublicContentFeedback. Note: If you want to stay current with Defender for Cloud and receive updates in your inbox, please consider subscribing to our monthly newsletter: https://aka.ms/MDCNewsSubscribe
Key findings from product telemetry: top storage security alerts across industries
1.0 Introduction Cloud storage stands at the core of AI-driven applications, making its security more vital than ever. As generative AI continues to drive innovation, protecting the storage infrastructure becomes central to ensuring both the reliability and safety of AI solutions. Every industry encounters its own set of storage security challenges. For example, financial services must navigate complex compliance requirements and guard against insider risks. Healthcare organizations deal with the protection of confidential patient information (e.g. electronic medical records), while manufacturing and retail face the complexities of distributed environments and vulnerable supply chains. At Microsoft, we leverage product telemetry to gain insight into the most frequent storage security alerts and understand how risks manifest differently across various customer sectors. This article delves into how storage threats are shaped by industry dynamics, drawn on data collected from our customer base to illustrate emerging patterns and risks. Acknowledgement: This blog represents the collaborative work of the following Stroage security in MDC v-team members: Fernanda Vela and Alex Steele, for initiating the project and preparing the initial draft and directing the way we tell the story Eitan Bremler and Lior Tsalovich, for product and customer insights, synthesizing product telemetry and providing review Yuri Diogenes, for his supervision, review and cheerleading We extend our sincere appreciation to each contributor for their dedication and expertise. 1.1 Key findings from product telemetry: Top storage security alerts across industries Based on telemetry gathered from Microsoft Defender for Cloud, certain alerts consistently emerge as the most prevalent across different sectors. These patterns highlight the types of threats and suspicious activities organizations encounter most frequently, reflecting both industry-specific risks and broader attack trends. In the section that follows, this information is presented in detail, offering a breakdown of the most common alerts observed within each industry and providing valuable insight into how storage environments are being targeted and defended. 1.1.1 How does storage security alert in Defender for Cloud work To protect storage accounts from threats, Microsoft Defender for Cloud storage security provides a wide range of security alerts designed to detect suspicious, risky, or anomalous activity across Azure Storage services such as Blob Storage, Data Lake Gen2, and Azure Files. These alerts cover scenarios like unauthorized access attempts, abnormal usage patterns, potential data exfiltration, malware uploads or downloads, sensitive data exposure and changes that may expose storage containers to the public. They leverage threat intelligence and behavioral analytics to identify activity from malicious IPs, unusual geographies, or suspicious applications, ensuring organizations are alerted when their storage environment is potentially at risk. Each alert is categorized by severity, helping organizations prioritize responses to the most critical threats, such as confirmed malware or credential compromise, while also surfacing medium and low-risk anomalies that may indicate early stages of an attack. Overall, Defender for Storage enables proactive monitoring and rapid detection of threats to cloud storage, reducing the risk of exposure, misuse, or compromise of valuable data assets. 1.1.2 Top alert types for major industries Financial, healthcare, technology, energy and manufacturing are often cited as the most targeted industries because of the value of their data, regulatory exposure and their role in critical infrastructure. Our telemetry from Microsoft Defender for Cloud (MDC) shows the top security alerts in storage resources across these five industries: Finance industry Health care industry Manufacturing industry Software industry Energy industry 1.1.3 Top 9 alerts across industries Across industries, the most common alert—averaging 1,300 occurrences per month—is “Unusual application accessed a storage account,” indicating unexpected access to a storage account. Below are the top cross-industry alerts based on this analysis. 1.2 Analysis Application Anomaly Alerts Ranking: #1 across all industries (Finance, Manufacturing, Software, Energy, Healthcare) Alert: Access from a suspicious application (Storage.Blob_ApplicationAnomaly) Why it happens: Organizations increasingly use automation, third-party integrations, and custom scripts to interact with cloud storage. Shadow IT and lack of centralized app governance lead to unexpected access patterns. In sectors like healthcare and finance, sensitive data attracts attackers who may use compromised or malicious apps to probe for weaknesses. Interpretation: High prevalence indicates a need for stricter application registration, monitoring, and access controls. Industries should prioritize visibility into which apps are accessing storage and enforce policies to block unapproved applications. Geo-Anomaly Alerts Ranking: #2 or #3 in most industries Alert: Access from an unusual location (Storage.Blob_GeoAnomaly, Storage.Files_GeoAnomaly) Why it happens: Global operations, remote work, and distributed teams are common in energy, manufacturing, and healthcare. Attackers may use VPNs or compromised credentials to access storage from unusual regions. Interpretation: Frequent geo-anomalies suggest gaps in geo-fencing and conditional access policies. Organizations should review access logs, enforce region-based restrictions, and monitor cross-border data flows. Malware-Related Alerts Ranking: Prominent in healthcare, finance, and software sectors Alert: Malware found in blob (Storage.Blob_AM.MalwareFound) Malware download detected (Storage.Blob_MalwareDownload) Access from IP with suspicious file hash reputation (Storage.Blob_MalwareHashReputation) Why it happens: High-value data and frequent file exchanges make these industries attractive targets for ransomware and malware campaigns. Insufficient scanning capacity or delayed remediation can allow malware to persist. Interpretation: Rising malware alerts point to active threat campaigns and the need for real-time scanning and automated remediation. Industries should scale up Defender capacity, integrate threat intelligence, and enable automatic malware removal. Open Container Scanning Alerts Ranking: More frequent in energy and manufacturing Alerts: Successful discovery of open storage containers (Storage.Blob_OpenContainersScanning.SuccessfulDiscovery) Failed attempt to scan open containers (Storage.Blob_OpenContainersScanning.FailedAttempt) Why it happens: Rapid cloud adoption and operational urgency can lead to misconfigured storage containers. Legacy systems and lack of automated policy enforcement increase exposure risk. Interpretation: High rates of open container alerts signal the need for regular configuration audits and automated security policies. Organizations should prioritize closing public access and monitoring for changes in container exposure. Anonymous Access & Data Exfiltration Alerts Ranking: Present across industries, especially where sensitive data is stored Alerts: Anonymous access anomaly detected (Storage.Blob_AnonymousAccessAnomaly) Data exfiltration detected: unusual amount/number of blobs (Storage.Blob_DataExfiltration.AmountOfDataAnomaly, Storage.Blob_DataExfiltration.NumberOfBlobsAnomaly) Why it happens: Attackers may attempt to access data anonymously or exfiltrate large volumes of data. Weak access controls or lack of monitoring can enable these behaviors. Interpretation: These alerts should trigger immediate investigation and remediation. Organizations must enforce strict access controls and monitor for abnormal data movement. Key Takeaways Across Industries Application anomaly and geo-anomaly alerts are universal, reflecting the challenges of managing automation and global access in modern cloud environments. Malware-related alerts are especially critical in sectors handling sensitive or regulated data, indicating active targeting by threat actors. Open container and capacity alerts reveal operational and configuration risks, often tied to rapid scaling and cloud adoption. Interpreting these trends: High alert shares for specific patterns should drive targeted investments in security controls, monitoring, and automation. Industries must adapt their security strategies to their unique risk profiles, balancing innovation with robust protection. 1.3 Protect storage accounts from threats To address these challenges, Microsoft Defender for Cloud Storage Security offers: Real-time monitoring of storage-related threats: Identifies unusual access patterns with direct integration with Azure. Detect and mitigate with threat intelligence: understand threat context and reduce false positives. Integration with Defender XDR: Provides unified threat correlation, investigation and triaging with industry leading SIEM integration. 2.0 Malware in Storage: A Growing Threat Based on the findings from section 1, let’s analyze which industry receives the most amount of malware related threats: 2.1 Top Findings Healthcare: Malware found in blob (8.6%) Malware download detected (5.5%) Malware hash reputation (4.6%) Total malware-related share: ~18.7% Finance: Malware found in blob (4.5%) Malware download detected (3.9%) Malware hash reputation (4.6%) Total malware-related share: ~13% Manufacturing: Malware found in blob (8.5%) Malware download detected (2.7%) Malware hash reputation (3.3%) Total malware-related share: ~14.5% Software: Malware found in blob (7.8%) Malware download detected (5.9%) Malware hash reputation (15.6%) Total malware-related share: ~29.3% (notably high due to hash reputation alert) Energy: Malware hash reputation (4.2%) Malware found in blob (not top 7) Malware download detected (not top 7) Total malware-related share: ~4.2% (lower than other sectors) 2.2 Analysis Software industry has the highest ranked malware alerts, especially due to a very high share for “Malware hash reputation” (15.6%) and significant shares for “Malware found in blob” and “Malware download detected.” Healthcare also has a high combined share of malware alerts, but not as high as software. Finance, Manufacturing, and Energy have lower shares for malware alerts compared to software and healthcare. How to Read This Trend Software companies are likely targeted more for malware due to their high volume of code, frequent file exchanges, and integration with many external sources. Healthcare is also a prime target because of sensitive patient data (e.g. electronic medical records) and regulatory requirements. If your organization is in software or healthcare, pay extra attention to malware scanning, automated remediation, and threat intelligence integration. Regularly review and update malware protection policies. 2.3 How Microsoft Helps Prevent Malware Spread Defender for Cloud mitigates these risks by: Scanning for malicious content on upload or on demand, in storage accounts Automatic remediation after suspicious uploads Integrating with threat intelligence for threat context correlation, advance investigation and threat response. To learn more about Malware Scanning in Defender for Cloud, visit: Introduction to Defender for Storage malware scanning - Microsoft Defender for Cloud | Microsoft Learn 3.0 Conclusion As cloud and AI adoption accelerate, storage security is now essential for every industry. Microsoft Defender for Cloud storage security telemetry shows that the most frequent alerts—like suspicious application access, geo-anomalies, and malware detection—reflect both evolving threats and the realities of modern operations. These trends highlight the need for proactive monitoring, and strong threat detection and mitigation. Defender for Cloud helps organizations stay ahead of risks, protect critical data, and enable safe innovation in the cloud. Learn more about Defender for Cloud storage security: Microsoft Defender for Cloud | Microsoft Security Start a free Azure trial. Read more about Microsoft Defender for Cloud Storage Security here. 4.0 Appendix: Detailed Data for Top Industry-Specific Alerts 4.1 Finance Industry Alert Type Tag Description Share (%) Access from a suspicious application Storage.Blob_ApplicationAnomaly Blob accessed using a suspicious/uncommon application 34.40 Access from an unusual location Storage.Blob_GeoAnomaly Blob accessed from a geographic location that deviates from typical patterns 23.10 Access from an unusual location (Azure Files) Storage.Files_GeoAnomaly Azure Files share accessed from an unexpected geographic region 7.90 Access from a suspicious application (Files) Storage.Files_ApplicationAnomaly Azure Files share accessed using a suspicious application 7.80 Failed attempt to scan open containers Storage.Blob_OpenContainersScanning.FailedAttempt Failed attempt to scan publicly accessible containers for security risks 6.40 Access from IP with suspicious file hash Storage.Blob_MalwareHashReputation Blob accessed from an IP with known malicious file hashes 4.60 Malware found in blob Storage.Blob_AM.MalwareFound Malware detected within a blob during scanning 4.50 Malware download detected Storage.Blob_MalwareDownload Blob download activity suggests malware distribution 3.90 Anonymous access anomaly detected Storage.Blob_AnonymousAccessAnomaly Blob accessed anonymously in an abnormal way 3.30 Data exfiltration: unusual amount of data Storage.Blob_DataExfiltration.AmountOfDataAnomaly Large volume of data accessed/downloaded, possible exfiltration 2.20 4.2 Healthcare Industry Alert Type Tag Description Share (%) Access from a suspicious application Storage.Blob_ApplicationAnomaly Blob accessed using a suspicious/uncommon application 42.40 Access from an unusual location Storage.Blob_GeoAnomaly Blob accessed from a geographic location that deviates from typical patterns 17.10 Access from a suspicious application (Files) Storage.Files_ApplicationAnomaly Azure Files share accessed using a suspicious application 9.70 Malware found in blob Storage.Blob_AM.MalwareFound Malware detected within a blob during scanning 8.60 Access from an unusual location (Files) Storage.Files_GeoAnomaly Azure Files share accessed from an unexpected geographic region 8.20 Malware download detected Storage.Blob_MalwareDownload Blob download activity suggests malware distribution 5.50 Access from IP with suspicious file hash Storage.Blob_MalwareHashReputation Blob accessed from an IP with known malicious file hashes 4.60 Failed attempt to scan open containers Storage.Blob_OpenContainersScanning.FailedAttempt Failed attempt to scan publicly accessible containers for security risks 4.10 4.3 Manufacturing Industry Alert Type Tag Description Share (%) Access from a suspicious application Storage.Blob_ApplicationAnomaly Blob accessed using a suspicious/uncommon application 28.70 Access from an unusual location Storage.Blob_GeoAnomaly Blob accessed from a geographic location that deviates from typical patterns 24.10 Access from a suspicious application (Files) Storage.Files_ApplicationAnomaly Azure Files share accessed using a suspicious application 9.40 Failed attempt to scan open containers Storage.Blob_OpenContainersScanning.FailedAttempt Failed attempt to scan publicly accessible containers for security risks 8.90 Malware found in blob Storage.Blob_AM.MalwareFound Malware detected within a blob during scanning 8.50 Access from an unusual location (Files) Storage.Files_GeoAnomaly Azure Files share accessed from an unexpected geographic region 7.00 Anonymous access anomaly detected Storage.Blob_AnonymousAccessAnomaly Blob accessed anonymously in an abnormal way 5.20 Access from IP with suspicious file hash Storage.Blob_MalwareHashReputation Blob accessed from an IP with known malicious file hashes 3.30 Malware download detected Storage.Blob_MalwareDownload Blob download activity suggests malware distribution 2.70 Data exfiltration: unusual number of blobs Storage.Blob_DataExfiltration.NumberOfBlobsAnomaly Unusual number of blobs accessed, possible exfiltration 2.30 4.4 Software Industry Alert Type Tag Description Share (%) Access from a suspicious application Storage.Blob_ApplicationAnomaly Blob accessed using a suspicious/uncommon application 22.20 Access from an unusual location Storage.Blob_GeoAnomaly Blob accessed from a geographic location that deviates from typical patterns 16.40 Access from IP with suspicious file hash Storage.Blob_MalwareHashReputation Blob accessed from an IP with known malicious file hashes 15.60 Access from a suspicious application (Files) Storage.Files_ApplicationAnomaly Azure Files share accessed using a suspicious application 8.10 Malware found in blob Storage.Blob_AM.MalwareFound Malware detected within a blob during scanning 7.80 Failed attempt to scan open containers Storage.Blob_OpenContainersScanning.FailedAttempt Failed attempt to scan publicly accessible containers for security risks 7.10 Malware download detected Storage.Blob_MalwareDownload Blob download activity suggests malware distribution 5.90 Anonymous access anomaly detected Storage.Blob_AnonymousAccessAnomaly Blob accessed anonymously in an abnormal way 5.50 Access from an unusual location (Files) Storage.Files_GeoAnomaly Azure Files share accessed from an unexpected geographic region 5.50 Data exfiltration: unusual amount of data Storage.Blob_DataExfiltration.AmountOfDataAnomaly Large volume of data accessed/downloaded, possible exfiltration 3.30 Data exfiltration: unusual number of blobs Storage.Blob_DataExfiltration.NumberOfBlobsAnomaly Unusual number of blobs accessed, possible exfiltration 2.50 4.5 Energy Industry Alert Type Tag Description Share (%) Access from a suspicious application Storage.Blob_ApplicationAnomaly Blob accessed using a suspicious/uncommon application 38.60 Access from an unusual location Storage.Blob_GeoAnomaly Blob accessed from a geographic location that deviates from typical patterns 22.60 Successful discovery of open containers Storage.Blob_OpenContainersScanning.SuccessfulDiscovery Publicly accessible containers discovered during scanning, exposure risk 13.50 Access from a suspicious application (Files) Storage.Files_ApplicationAnomaly Azure Files share accessed using a suspicious application 10.20 Access from an unusual location (Files) Storage.Files_GeoAnomaly Azure Files share accessed from an unexpected geographic region 5.90 Failed attempt to scan open containers Storage.Blob_OpenContainersScanning.FailedAttempt Failed attempt to scan publicly accessible containers for security risks 3.0Security Copilot for SOC: bringing agentic AI to every defender
Cybersecurity has entered an era of relentless complexity. As threat actors increasingly leverage artificial intelligence to automate attacks, evade detection, and scale their tactics, defenders are challenged to keep up. In this new era, security operations centers (SOCs) must transform to not just react, but to anticipate, disrupt, and outpace the next wave of cyberthreats. Microsoft’s goal is to empower every organization to meet this challenge head-on by transforming how security operates. We believe the future of the SOC is more than just agentic: it’s predictive and proactive. This means moving beyond fragmented tools and manual processes, and instead embracing a unified, intelligent approach where AI-driven skills and agents work in concert with human expertise. To bring this vision to life, it’s essential to look at the SOC through the lens of its lifecycle—a dynamic continuum that spans from anticipation and prevention through to recovery and optimization—and to recognize the unique challenges and opportunities within each stage. With Security Copilot’s GenAI and agentic capabilities woven across this lifecycle, Microsoft is delivering an integrated defense platform that enables defenders to move faster, act smarter, and stay ahead of adversaries. Introducing agentic innovation across the SOC lifecycle At Ignite, our agentic innovations are concentrated in three of the five SOC lifecycle pillars, and each one represents a leap forward in how analysts anticipate, detect, triage and investigate threats. Predict and prevent Threat Intelligence Briefing Agent: Introduced in March, this agent has already helped security teams move from reactive to anticipatory defense. At Ignite, we’re announcing that the Threat Intelligence Briefing Agent is now fully embedded in the Microsoft Defender portal, delivering daily, tailored briefings that synthesize Microsoft’s unparalleled global intelligence with organization-specific context in just minutes. Teams no longer need to spend hours gathering TI from disparate sources—the agent automates this process, offering the most current and relevant insights. Analysts can reference the summary to prioritize action, using the agent’s risk assessments, clear recommendations, and links to vulnerable assets to proactively address exposures. Detect and disrupt Dynamic Threat Detection Agent: Detections have long been bottlenecked by the limitations of traditional alerting systems, which rely on predefined logic that can’t scale fast enough to match the speed and variability of modern attacks— resulting in blind spots and missed threats. The Dynamic Threat Detection Agent addresses this challenge head-on. Instead of depending on static rules or isolated input, it continuously analyzes incidents and telemetry, searching for gaps in coverage and correlating signals across the entire security stack. For example, this is how it surfaced a recent AWS attack: a threat actor used an EntraID account to federate into an AWS admin account to exfiltrate sensitive data. The Dynamic Threat Detection Agent generated an alert before the intruder even authenticated into the single sign-on flow, driven by a correlated signal from Sentinel. That alert didn’t exist beforehand; the agent created it on the fly to stop the attack. The result is an adaptive system that extends Microsoft’s industry-leading, research-based detections with context-aware alerts tailored to each organization, closing gaps and revealing threats that legacy systems miss. Triage and investigate Phishing Triage Agent: In March 2025, we introduced the Phishing Triage Agent, built to autonomously handle user-submitted phishing reports at scale. The agent classifies incoming alerts and resolves false positives, escalating only the malicious cases that require human expertise. At Microsoft Ignite, we’re announcing its general availability, backed by strong early results: the agent identifies 6.5 times more malicious alerts, improves verdict accuracy by 77%, and frees analysts to spend 53% more time investigating real threats. St. Luke’s even said it’s saving their team nearly 200 hours each month. Coming soon, we’ll be extending these autonomous triage capabilities beyond phishing to identity and cloud alerts, bringing the same precision and scale to more SOC workflows. Threat Hunting Agent: this agent reimagines the investigation process. Instead of requiring analysts to master complex query languages or sift through mountains of data, Threat Hunting Agent enables natural language investigations with contextual insight. Analysts can vibe with the agent by asking questions in plain English, receive direct answers, and be guided through comprehensive hunting sessions. It levels up the existing Security Copilot NL2KQL capability by enabling teams to explore patterns, pivot intuitively and uncover hidden signals in real time for a fluid, context-aware experience. This not only accelerates investigations but makes advanced threat hunting accessible to every member of the SOC, regardless of experience level. Agents built into your workflows To make the agents easily accessible and help security teams get started more quickly, we are excited to announce that Security Copilot will be available to all Microsoft 365 E5 customers. Rollout starts today for existing Security Copilot customers with Microsoft 365 E5 and will continue in the upcoming months for all Microsoft 365 E5 customers. Customers will receive 30-day advanced notice before activation. Learn more: https://aka.ms/SCP-Ignite25 Discover more: the Security Store The Security Store, now generally available, is the central hub for discovering, deploying, and managing first-party and third-party security agents. Today, it provides instant access to 20+ agents deployable directly in the Microsoft Defender portal, all within a broader ecosystem of 100+ trusted security solutions. Whether you're investigating incidents, hunting threats, or automating response, the Security Store extends Defender with vetted, scenario-aligned tools that can be set up in minutes. Learn more in this blog. Introducing new GenAI embedded capabilities Security Copilot isn’t just growing through agents—it’s also gaining new embedded capabilities: GenAI skills that help SOC teams work faster, operate at greater scale, and get upleveled directly inside Microsoft Defender. Today, we’re excited to introduce new innovations: Analyst Notes represent a meaningful shift in how investigation work is captured and shared. For organizations that choose to opt into this capability, Copilot automatically reconstructs an analyst’s investigation session—from the moment they open an incident to the moment they close it—and turns that activity into clear, structured notes. The system can even track multiple sessions in parallel and attribute actions to the right incident, and analysts can fully review and edit the generated notes before saving them. This not only saves teams valuable time and effort, it preserves the actual investigation path with far greater accuracy and consistency than manual documentation ever could. The result is a living, cumulative record of how the SOC investigates threats: easier handoffs, stronger auditability, faster onboarding, and a deeper shared understanding of how incidents unfold across multiple SecOps members and phases. Standard Operating Procedures (SOPs) for guided response allows organizations to upload their own internal procedures so Security Copilot can align its recommendations with established guidebooks and compliance requirements. Guided response is one of the ways Copilot helps analysts navigate an incident: it offers one-click actions across triage, containment, investigation and remediation that teams can take immediately. With SOPs uploaded, these recommendations draw directly from organizational workflows and policy standards, ensuring they are contextually relevant and trusted. For defenders, this translates into greater confidence and faster, more consistent decision-making. We’re also eager to share that we’re introducing auto-generated content configuration for Security Copilot’s incident summaries. This new feature allows security admins to decide how and when summaries are produced, choosing between always auto-generating, manual trigger only, or auto-generating based on incident severity. The configuration is managed directly in the Microsoft Defender portal, giving organizations flexibility to fine-tune Copilot’s outputs to their operational needs. Join us at Ignite We invite you to learn more and see these innovations in action at Microsoft Ignite. Don’t miss our featured sessions: Microsoft Defender: Building the agentic SOC with guest Allie Mellen on Wednesday, November 19 th with Allie Mellen, Corina Feuerstein, and Rob Lefferts. Learn more. Empowering the SOC: Security Copilot and the rise of Agentic Defense on Friday, November 21 st with Corina Feuerstein and Cristina da Gama. Learn more. Join us to discover how Microsoft is shaping the future of cybersecurity—making intelligent, agentic defense accessible to every organization.Unlocking Business Value: Microsoft's Dual Approach to AI for Security and Security for AI
Overview In an era where cyber threats evolve at an unprecedented pace and artificial intelligence (AI) transforms business operations, Microsoft stands at the forefront with a comprehensive strategy that addresses both leveraging AI to bolster security and safeguarding AI systems themselves. This white paper, presented in blog post format, explores Microsoft's business value model for "AI for Security" – using AI to enhance threat detection, response, and prevention – and "Security for AI" – protecting AI deployments from emerging risks. Drawing from independent studies, real-world case studies, and economic analyses, we demonstrate how these approaches deliver tangible returns on investment (ROI) and total economic impact (TEI). Whether you're a CISO evaluating security investments or a business leader integrating AI, this post provides insights, visuals, and calculations to guide your strategy. Executive Summary The enterprise adoption of AI has transcended from a technological novelty to a strategic imperative, fundamentally altering competitive landscapes and business models. Organizations that fail to integrate AI risk operational inefficiency, diminished competitiveness, and missed revenue opportunities. However, the path from initial awareness to full-scale transformation is fraught with a new and complex class of security risks that traditional cybersecurity postures are ill-equipped to address. This report provides a comprehensive analysis of the enterprise AI adoption journey, the evolving threat landscape, and a data-driven financial case for securing AI initiatives exclusively through Microsoft's unified security ecosystem. The AI journey is a multi-stage process, beginning with Awareness and Experimentation before progressing to Operational deployment, Systemic integration, and ultimately, Transformational impact. Advancement through these stages is contingent not on technology alone, but on a clear executive vision, a structured roadmap that aligns AI potential with business reality, and a foundational commitment to responsible AI governance. This journey is paralleled by the emergence of a sophisticated AI threat landscape. Malicious actors are no longer targeting just infrastructure but the very logic and integrity of AI models. Threats such as data poisoning, model theft, prompt injection, risks to intellectual property, data privacy, regulatory compliance, and brand reputation. Furthermore, the proliferation of generative AI tools creates a novel "accidental insider" risk, where well-intentioned employees can inadvertently leak sensitive corporate data to third-party models. To counter these multifaceted threats, a fragmented, multi-vendor security approach is proving insufficient. Microsoft offers a cohesive, AI-native security platform that provides end-to-end protection across the entire AI lifecycle. This unified framework integrates Microsoft Purview for proactive data security and governance, Microsoft Sentinel for AI-powered threat detection and response, and Microsoft Defender alongside Azure AI Services for comprehensive endpoint, application, infrastructure protection and Microsoft Entra for securing and protecting the identity and access management control. The platform's strength lies in its deep, native integration, which creates a virtuous cycle of shared intelligence and automated response that siloed solutions cannot replicate. A rigorous market analysis, based on independent studies from Forrester and IDC, demonstrates that investing in this unified security framework is not a cost center but a significant value driver. The financial returns are compelling: Microsoft Purview delivers a 355% Return on Investment (ROI) over three years, driven by a 30% reduction in data breach likelihood and a 75% improvement in security investigation time. For more details: mccs-ms-purview-final-9-3.pdf Microsoft Sentinel generates a 234% ROI, reducing the Total Cost of Ownership (TCO) from legacy Security Information and Event Management (SIEM) solutions by 44% and cutting false positives by up to 79%. For more details: The Total Economic Impact™ Of Microsoft Sentinel Microsoft Defender provides a 242% ROI with a payback period of less than six months, fueled by significant savings from vendor consolidation and a 30% faster threat remediation time. For more details: TEI-of-M365Defender-FINAL.pdf Microsoft Entra Suite: 131% ROI over three years, with $14.4 million in benefits, $8.2 million net present value, payback in less than six months, 30% reduction in identity-related risk exposure, 60% reduction in VPN license usage, 80% reduction in user management time, and 90% fewer password reset tickets. For more details: The Total Economic Impact™ Of Microsoft Entra Suite Collectively, these solutions do more than mitigate risk; they enable innovation. By establishing a secure and trusted data environment, organizations can confidently accelerate their adoption of transformative AI technologies, unlocking the broader business value and competitive advantage that AI promises. This report concludes with a clear strategic recommendation: to successfully navigate the AI frontier, executive leadership must prioritize investment in a unified, AI-native security and governance framework as a foundational enabler of their digital transformation strategy. AI Risks/Challenges AI is transforming cybersecurity, but it also might introduce new vulnerabilities and attack surfaces. Organizations adopting AI must address risks such as data leakage, prompt injection attacks, model poisoning, identity and access management, and compliance gaps. These threats are not hypothetical—they are already impacting enterprises globally. Key Risks and Their Impact Data Security & Privacy 80%+ of security leaders cite leakage of sensitive data as their top concern when adopting AI. BYOAI (Bring Your Own AI) is rampant: 78% of employees use unapproved AI tools at work, increasing exposure to unmanaged risks. Source: Microsoft Work Trend Index & ISMG Study Emerging Threats Indirect Prompt Injection Attacks: 77% of organizations are concerned; 11% are extremely concerned. Hijacking & Automated Scams: 85% of respondents fear AI-driven scams and hijacking scenarios. Source: KPMG Global AI Study Compliance & Governance: 55% of leaders admit they lack clarity on AI regulations and compliance requirements. Agentic AI Risks: 88% of organizations are piloting AI agents, creating agent sprawl and new attack vectors. by 2029, 50%+ of successful attacks against AI agents will exploit access control weaknesses. The Numbers Tell the Story 97% of organizations reported security incidents related to Generative AI in the past year. Known AI security breaches jumped from 29% in 2023 to 74% in 2024, yet 45% of incidents go unreported. Source: Capgemini & HiddenLayer AI Threat Landscape Report Global AI cybersecurity market is projected to grow from $30B in 2024 to $134B by 2030, reflecting the urgency of securing AI systems. Source: Statista AI in Cybersecurity Where do we see customers in adoption Journey Understanding where an organization stands in its AI adoption journey is the critical first step in formulating a successful strategy. The transition from recognizing AI's potential to harnessing it for transformative business value is not a single leap but a structured progression through distinct stages of maturity. Many organizations falter by pursuing technologically interesting projects that fail to solve core business problems, leading to wasted resources and disillusionment. A coherent maturity model provides a diagnostic tool to assess current capabilities and a roadmap to guide future investments, ensuring that each step of the journey is aligned with measurable business goals. From Awareness to Transformation: A Unified AI Maturity Model By synthesizing frameworks from leading industry analysts and practitioners, a comprehensive five-stage maturity model emerges. This model provides a clear pathway for organizations, detailing the characteristics, challenges, and objectives at each level of AI integration. Stage 1: Aware / Exploration This initial stage is characterized by an early interest in AI, where organizations recognize its potential but have limited to no practical experience. Activities are focused on research and education, with internal teams exploring different tools to understand their capabilities and potential business use cases. A common and effective starting point is conducting brainstorming workshops with key stakeholders to identify pressing business pain points and map them to potential AI solutions. The primary goal is to build initial familiarity and garner buy-in from leadership to move beyond theoretical discussions. The most significant challenge at this stage is the "zero-to-one gap"—overcoming organizational inertia and a lack of executive sponsorship to secure the approval and resources needed for initial experimentation. Stage 2: Active / Experimentation In the experimentation phase, organizations have initiated small-scale pilot projects, often isolated within a data science team or a specific business unit. AI literacy remains limited, with only a few individuals or teams actively using AI tools in their daily work. A formal, enterprise-wide AI strategy is typically absent, leading to a fragmented approach where different teams may be experimenting with disparate tools. This is the stage where many organizations encounter the "Production Chasm." While they may successfully develop prototypes, they struggle to move these models into a live production environment. This difficulty arises from a critical skills gap; the expertise required for production-level AI—a multidisciplinary blend of data science, IT operations, and DevOps, often termed MLOps—is fundamentally different and far rarer than the skills needed for experimental modeling. This chasm is widened by a misleading perception of what constitutes professional-grade AI, often formed through exposure to public tools, which lack the security, scalability, and deep integration required for enterprise use. Stage 3: Operational / Optimizing Organizations reaching this stage have successfully deployed one or more AI solutions into production. The focus now shifts from experimentation to optimization and scalability. The primary challenge is to move from isolated successes to consistent, repeatable processes that can be applied across the enterprise. This requires a deliberate strategic shift from scattered efforts to a structured portfolio of AI initiatives, each with a clear business case and measurable goals. Key activities include defining a formal AI strategy, investing in enterprise-grade tools, and launching broader initiatives to improve the AI literacy of the entire workforce, not just specialized teams. The objective is to achieve tangible improvements in productivity, efficiency, and business performance through the integration of AI into key processes. Stage 4: Systemic / Standardizing At the systemic stage, AI is no longer a collection of discrete projects but is deeply integrated into core business operations and workflows. The organization makes significant investments in enterprise-wide technology, including modern data platforms and robust governance frameworks, to ensure standardized and responsible usage of AI. A culture of innovation is fostered, encouraging employees to leverage AI tools to drive the business forward. The focus is on maximizing efficiency at scale, automating complex processes, and creating a sustainable competitive advantage through widespread gains in productivity and creativity. Stage 5: Transformational / Monetization This is the apex of AI maturity, a level achieved by only a few organizations. Here, AI is a central pillar of the corporate strategy and a key priority in executive-level budget allocation.3 The organization is recognized as an industry leader, leveraging AI not just to optimize existing operations but to completely transform them, creating entirely new revenue streams, innovative business models, and disruptive market offerings.4 The focus is on maximizing the bottom-line impact of AI across every facet of the business, from employee productivity to customer satisfaction and financial performance. Why using AI in defense is imperative Cybersecurity has entered an era where the speed, scale, and sophistication of attacks outpace traditional defenses. AI is no longer optional—it’s a strategic necessity for organizations aiming to protect critical assets and maintain resilience: 1. The Threat Landscape Has Changed AI-powered attacks are real and growing fast: Breakout times for breaches have dropped to under an hour, making manual detection and response obsolete. Attackers use AI to craft polymorphic malware, deepfakes, and automated phishing campaigns that bypass legacy security controls. Source: [mckinsey.com] 93% of security leaders fear AI-driven attacks, yet 69% see AI as the answer, and 62% of enterprises already use AI in defense. 2. AI Delivers Asymmetric Advantage Predictive Threat Intelligence: AI analyzes billions of signals to anticipate attacks before they occur, reducing downtime and mitigating risk. Automated Response: AI-driven SOCs cut response times from hours to seconds, isolating compromised endpoints and revoking malicious access instantly. Source: [analyticsinsight.net] Behavioral Analytics: Detects insider threats and anomalous activities that traditional tools miss, safeguarding identities and sensitive data 3. Operational Efficiency & Talent Gap Cybersecurity teams face a global shortage of skilled professionals. AI acts as a force multiplier, automating repetitive tasks and enabling analysts to focus on strategic threats. Organizations report 76% improvement in early threat detection and $2M+ savings per breach when leveraging AI-powered security solutions. Source: AI-Powered Security: The Future of Threat Detection and Response Microsoft approach to AI security As AI adoption accelerates, Microsoft has developed a multi-layered security strategy to protect AI systems, data, and identities while enabling innovation. This approach combines platform-level security, responsible AI principles, and advanced threat protection to ensure AI is deployed securely and ethically across enterprises. 1. Foundational Principles Microsoft’s AI security strategy is grounded in: Responsible AI Principles: Fairness, privacy & security, inclusiveness, transparency, accountability, and reliability. These principles guide every stage of AI development and deployment. Secure Future Initiative (SFI): Embedding security by design, default, and deployment across AI workloads. 2. The Secure AI Framework Microsoft’s Secure AI Framework (SAIF) provides a structured approach to securing AI environments: Prepare: Implement Zero Trust principles, secure identities, and configure environments for AI readiness. Discover: Gain visibility into AI usage, sensitive data flows, and potential vulnerabilities. Protect: Apply end-to-end security controls for data, models, and infrastructure. Govern: Enforce compliance with regulations like GDPR and the EU AI Act, and monitor AI interactions for risk. 3. Key Security Controls Data Security & Governance: o Microsoft Purview for Data Security Posture Management (DSPM) in AI prompts and completions. o Auto-classification, encryption, and risk-adaptive controls to prevent data leakage. Identity & Access Management: o Microsoft Entra for securing AI agents and enforcing least privileges with adaptive access policies. Threat Protection: o Microsoft Defender for AI integrates with Defender for Cloud to detect prompt injection, model poisoning, and jailbreak attempts in real time. Compliance & Monitoring: o Continuous posture assessments aligned with ISO 42001 and NIST AI RMF. 4. Security by Design Microsoft embeds security throughout the AI lifecycle: Secure Development Lifecycle (SDL) for AI models. AI Red Teaming using tools like PyRIT to simulate adversarial attacks and validate resilience. Content Safety Systems in Azure AI Foundry to block harmful or inappropriate outputs. 5. Integrated Security Ecosystem Microsoft’s AI security capabilities are deeply integrated across its portfolio: Microsoft Defender XDR: Correlates AI workload alerts with broader threat intelligence. Microsoft Sentinel: Provides graph-based context for AI-driven threat investigations. Security Copilot: AI-powered assistant for SOC teams, accelerating detection and response. Market research on ROI and Cost Savings from securing AI Investing in a robust security framework for AI is not merely a defensive measure or a cost center; it is a strategic investment that yields a quantifiable and compelling return. Independent market analysis conducted by leading firms like Forrester and IDC, along with real-world customer case studies, provides extensive evidence that deploying Microsoft's unified security platform delivers significant financial benefits. These benefits manifest in two primary ways: a "defensive" ROI derived from mitigating risks and reducing costs, and an "offensive" ROI achieved by enabling the secure and rapid adoption of high-value AI initiatives that drive business growth. A recurring and powerful theme across these studies is that platform consolidation is a major, often underestimated, value driver. A significant portion of the quantified ROI comes from retiring a fragmented stack of legacy point solutions and eliminating the associated licensing, infrastructure, and specialized labor costs, allowing the investment in the Microsoft platform to be funded, in part or in whole, by reallocating existing budget. The Total Economic Impact™ of a Unified Security Posture Microsoft has commissioned Forrester Consulting to conduct a series of Total Economic Impact™ (TEI) studies on its core security products. These studies, based on interviews with real-world customers, construct a "composite organization" to model the financial costs and benefits over a three-year period. The results consistently show a strong positive ROI across the platform. Microsoft Purview: The TEI study on Microsoft Purview found that the composite organization experienced benefits of $3.0 million over three years versus costs of $633,000, resulting in a net present value (NPV) of $2.3 million and an impressive 355% ROI. The primary value drivers included reduced data breach impact, significant efficiency gains for security and compliance teams, and the avoidance of costs associated with legacy data governance tools. Microsoft Sentinel: For Microsoft Sentinel, the Forrester study calculated an NPV of $7.9 million and a 234% ROI over three years. Key financial benefits were derived from a 44% reduction in TCO by replacing expensive, on-premises legacy SIEM solutions, a dramatic 79% reduction in false-positive alerts that freed up analyst time, and a 35% reduction in the likelihood of a data breach. Microsoft Defender: The unified Microsoft Defender XDR platform delivered an NPV of $12.6 million and a 242% ROI over three years, with an exceptionally short payback period of less than six months. The benefits were substantial, including up to $12 million in savings from vendor consolidation, $2.4 million from SecOps optimization, and $2.8 million from the reduced cost of material breaches. Microsoft Security Copilot: As a newer technology, the TEI for Security Copilot is a projection. Forrester projects a three-year ROI ranging from a low of 99% to a high of 348%, with a medium impact scenario yielding a 224% ROI and an NPV of $1.13 million. This return is driven almost entirely by amplified SecOps team efficiency, with projected productivity gains on security tasks ranging from 23% to 46.7%, and cost efficiencies from a reduced reliance on third-party managed security services. The following table aggregates the headline financial metrics from these independent Forrester TEI studies, providing a clear, at-a-glance summary of the platform's investment value. Table: Aggregated Financial Impact of Microsoft AI Security Solutions (Forrester TEI Data) Microsoft Solution 3-Year ROI (%) 3-Year NPV ($M) Payback Period (Months) Key Value Drivers Microsoft Purview 355% $2.3 < 6 Reduced breach likelihood by 30%, 75% faster investigations, 60% less manual compliance effort, legacy tool consolidation. Microsoft Sentinel 234% $7.9 < 6 44% TCO reduction vs. legacy SIEM, 79% reduction in false positives, 85% less effort for advanced investigations. Microsoft Defender 242% $12.6 < 6 Up to $12M in vendor consolidation savings, 30% faster threat remediation, 80% less effort to respond to incidents. Security Copilot 99% - 348% (Projected) $0.5 - $1.76 (Projected) Not Specified 23%-47% productivity gains for SecOps tasks, reduced reliance on third-party services, upskilling of security personnel. Microsoft Entra Suite 131% $8.2 Not Specified 30% reduction in identity risk, 80% reduction in user management time, 90% fewer password reset tickets, 60% VPN license reduction. Quantifying Risk Reduction and Its Financial Impact A core component of the ROI calculation is the direct financial savings from preventing and mitigating security incidents. Reduced Likelihood of Data Breaches: The Forrester study on Microsoft Purview quantified a 30% reduction in the likelihood of a data breach for the composite organization. This translated into over $225,000 in annual savings from avoided costs of security incidents and regulatory fines. The study on Microsoft Sentinel found a similar 35% reduction in breach likelihood, which was valued at $2.8 million over the three-year analysis period. These figures provide a tangible financial value for improved security posture. The Cost of Inaction: The financial case is further strengthened when contrasted with the high cost of failure. The Forrester study on Microsoft Defender highlights that organizations with insufficient incident response capabilities spend an average of $204,000 more per breach and experience nearly one additional breach per year compared to their more prepared peers. This underscores that the investment in a modern, unified platform is an effective insurance policy against significantly higher future costs. Driving SOC Efficiency and Cost Optimization Beyond risk reduction, the Microsoft security platform drives substantial cost savings through automation, AI-powered efficiency, and platform consolidation. These savings free up both budget and highly skilled personnel to focus on more strategic, value-added activities. Faster Mean Time to Respond (MTTR): Time is money during a security incident. The platform's AI and automation capabilities dramatically accelerate the entire response lifecycle. The Sentinel TEI found that its AI-driven correlation engine reduced the manual labor effort for advanced, multi-touch investigations by 85%. The Defender TEI noted that security teams could remediate threats 30% faster, reducing the mean time to acknowledge (MTTA) from 30 minutes to just 15, and cutting the mean time to resolve (MTTR) from up to three hours to less than one hour in many cases. Similarly, Purview was found to reduce the time security teams spent on investigations by 75%. Legacy Tool and Cost Avoidance: Consolidating on the Microsoft platform allows organizations to retire a host of redundant security and compliance tools. The Purview study identified nearly $500,000 in savings over three years from sunsetting legacy records management and data security solutions. The Defender study attributed up to a massive $12 million in benefits over three years to vendor consolidation, eliminating licensing, maintenance, and management costs from other tools. The Microsoft Entra Suite was found to reduce VPN license usage by 60%, saving an estimated $680,000 over three years. Reduced IT Overhead and Labor Costs: Automation extends beyond the SOC to general IT operations. The Microsoft Entra study found that automated governance and lifecycle workflows reduced the time IT spent on ongoing user management by 80%, yielding $4.6 million in time savings over three years. The same study noted a 90% reduction in password reset help desk tickets, from 80,000 to just 8,000 per year, avoiding $2.6 million in support costs. For more details: https://www.microsoft.com/en-us/security/blog/2025/09/23/microsoft-purview-delivered-30-reduction-in-data-breach-likelihood/ https://www.microsoft.com/en-us/security/blog/2025/08/04/microsoft-entra-suite-delivers-131-roi-by-unifying-identity-and-network-access/ https://azure.microsoft.com/en-us/blog/explore-the-business-case-for-responsible-ai-in-new-idc-whitepaper/ https://www.microsoft.com/en-us/security/blog/2025/09/18/microsoft-defender-delivered-242-return-on-investment-over-three-years/ https://tei.forrester.com/go/microsoft/microsoft_sentinel/ https://www.gartner.com/reviews/market/email-security-platforms/compare/abnormal-ai-vs-microsoft Fast-track generative AI security with Microsoft Purview | Microsoft Security Blog Conclusion Summary Consolidating security and compliance operations on the Microsoft platform delivers substantial cost savings and operational efficiencies. Studies have shown that moving away from legacy tools and embracing automation through Microsoft solutions not only reduces licensing and maintenance expenses, but also significantly lowers IT labor and support costs. By leveraging integrated tools like Microsoft Purview, Defender, and Entra Suite, organizations can realize millions of dollars in savings and free up valuable IT resources for higher-value work. Key Highlights Significant Cost Savings: Up to $12 million in benefits over three years from vendor consolidation, and $500,000 saved by retiring legacy records management and data security solutions. License Optimization: The Microsoft Entra Suite reduced VPN license usage by 60%, saving an estimated $680,000 over three years. IT Efficiency Gains: Automated governance and lifecycle workflows decreased IT time spent on user management by 80%, resulting in $4.6 million in time savings. Support Cost Reduction: Password reset help desk tickets dropped by 90%, from 80,000 to 8,000 per year, avoiding $2.6 million in support costs.
