Skip to main content
Microsoft Security

Endpoint security

Endpoint security, or endpoint protection, helps protect endpoints from malicious actors and exploits. Cybercriminals target endpoints because they are doorways to corporate data and by nature vulnerable to attack. They are outside network security and dependent on users to put security measures into place—leaving room for human error. Protecting endpoints from attack has become more challenging as the workforce becomes more distributed, with office-based, remote, and hybrid workers using more devices from anywhere in the world.

Photo of a worker using industrial tool in electronics factory assembly line.
Published
7 min read

Vulnerabilities in PanelView Plus devices could lead to remote code execution 

Microsoft discovered and responsibly disclosed two vulnerabilities in Rockwell’s PanelView Plus that could be remotely exploited by unauthenticated attackers, allowing them to perform remote code execution (RCE) and denial-of-service (DoS). PanelView Plus devices are graphic terminals, which are known as human machine interface (HMI) and are used in the industrial space.

Photo of Male developer is coding at his workspace in an enterprise office using Visual Studio on a MacBook Pro multi-monitor set up.
Published
10 min read

Multiple North Korean threat actors exploiting the TeamCity CVE-2023-42793 vulnerability 

Since early October 2023, Microsoft has observed North Korean nation-state threat actors Diamond Sleet and Onyx Sleet exploiting the Jet Brains TeamCity CVE-2023-42793 remote-code execution vulnerability. Given supply chain attacks carried out by these threat actors in the past, Microsoft assesses that this activity poses a particularly high risk to organizations who are affected.

Practitioner and chief information security officer collaboration in a security operations center.
Published
5 min read

Microsoft Defender for Endpoint now stops human-operated attacks on its own 

Today, we’re pleased to announce that Microsoft Defender for Endpoint customers will now be able automatically to disrupt human-operated attacks like ransomware early in the kill chain without needing to deploy any other capabilities. Now, organizations only need to onboard their devices to Defender for Endpoint to start realizing the benefits of attack disruption.