Microsoft’s commitment to transparency continues with the release of our second email security benchmarking report, informed by valuable customer and partner feedback. Continuing our prior benchmarking analysis, this testing relies on real-world email threats observed across the Microsoft ecosystem, rather than synthetic data or artificial testing environments. The study compares environments protected exclusively by Microsoft Defender with those using a Secure Email Gateway (SEG) positioned in front of Defender, as well as environments where Integrated Cloud Email Security (ICES) solutions add a secondary layer of detection after Defender. In addition, the benchmarking analysis for ICES vendors now includes malicious catch by Defender’s zero-hour-auto purge, which is a post-delivery capability that removes additional malicious emails after filtering is completed by any ICES solution in place, as shown in Figure 1. Throughout this process, we maintain the highest standards of security and privacy, to help ensure all data is aggregated and anonymized, consistent with practices used in the Microsoft Digital Defense Report 2025.

Updated methodology for ICES vendors

In this second report, we updated our testing methodology based on discussions with partners and gaining a deeper understanding of their architectures, to provide a more accurate and transparent view of layered email protection. First, we addressed integration patterns such as journaling and connector-based reinjection, which previously could cause the same cyberthreat to appear as detected by both Microsoft Defender and an ICES vendor even when Defender ultimately blocked it. These scenarios risked inflating or misattributing performance metrics, so our revised approach corrects this. Second, we now include Microsoft Defender zero-hour auto purge post-delivery detections alongside ICES vendor actions. This addition highlights cyberthreats that ICES vendors missed but were later remediated by Microsoft Defender, to help ensure customers see the full picture of real-world protection. Together, these changes make the benchmarking results more representative of how layered defenses operate in practice.

ICES vendors, benchmarking

Microsoft’s quarterly analysis shows that layering ICES solutions with Microsoft Defender continues to provide a benefit in reducing marketing and bulk email, with an average improvement of 9.4% across specific vendors. This helps minimize inbox clutter and improves user productivity in environments where promotional noise is a concern. For filtering of spam and malicious messages, the incremental gains remain modest, averaging 1.65% and 0.5% respectively.

When looking only at the subset of malicious messages that reached the inbox, Microsoft Defender’s zero-hour auto purge on average removed 45% of malicious mail post-delivery, while ICES vendors on average contributed 55% in post-delivery filtering of malicious mail. Per vendor details can be found in Figure 3. This highlights why post-delivery remediation is essential, even in a layered approach, for real-world protection.

SEG vendors, benchmarking

For the SEG vendors benchmarking metrics a cyberthreat was considered “missed” if it was not detected pre-delivery, or if it was not removed shortly after delivery (post-delivery).

Defender missed fewer threats in this study compared to other solutions, consistent with trends observed in our prior report.

Empowering security through transparency and data

In the face of increasingly complex email threats, clarity and transparency remain essential for informed decision-making. Our goal is to provide customers with actionable insights based on real-world data, so security leaders can confidently evaluate how layered solutions perform together.

We’ve listened to feedback from customers and partners and refined our methodology to better reflect real-world deployment patterns. These updates help ensure that vendors are more accurately represented than before, and that benchmarking results are fair, comprehensive, and useful for planning.

We will continue publishing quarterly benchmarking updates and evolving our approach in collaboration with our customers and partners, so benchmarking remains a trusted resource for optimizing email security strategies. Access the benchmarking site for more information.

Learn more with Microsoft Security

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

The post Clarity in complexity: New insights for transparent email security appeared first on Microsoft Security Blog.

Staying ahead of the evolving email threat landscape

Email remains the most exploited gateway for cyberattacks and the threat landscape is evolving fast. Cyberattackers are increasingly leveraging AI to automate and amplify their campaigns, making each attack vector more sophisticated and harder to detect. Our latest Microsoft Digital Defense Report reveals how business email compromise (BEC) has evolved from a low-volume scam into a professionalized, service-driven economy.

This industrialization of email-based crime and the growing use of AI by threat actors is one reason why we’ve doubled down on strengthening protections for our customers. Over the past year, we’ve introduced advanced defenses against emerging attack types, enhanced social engineering safeguards, and expanded coverage across collaboration tools like Microsoft Teams.

This growing cyberthreat landscape is why we need to fight AI with AI and lead with a unified platform approach to defend against sophisticated, multimodal attacks holistically.

Innovating to defend email with agentic AI

Our research shows that phishing attacks remain one of the most persistent and damaging threats to organizations worldwide. Security teams are under constant pressure to investigate a growing number of user-reported phishing emails daily, aiming for accurate verdicts and timely responses. Defender for Office 365 is focused on protecting against this evolving email and collaboration threat landscape by infusing AI agents and agentic workflows into the core of our security solution and security operations center (SOC) operations to strengthen our defenses, automate repetitive tasks, and accelerate investigations. Our recent innovations to defend against phishing attacks and more include:

• Agentic email grading system uses advanced, AI-powered analysis when admins or users submit phishing emails to Microsoft for review. By integrating language models and agentic workflows into Defender for Office 365, the system delivers rapid, transparent verdicts and provides the submitter with context-rich explanations for each reported message. This approach reduces reliance on manual reviews, thereby shortening Microsoft’s response times, and it helps deliver consistent, high-quality outcomes. A built-in feedback loop enables continuous learning for both humans and models and adapts based on new cyberthreats, so that our evaluation considers the latest threat landscape.
• Microsoft Security Copilot Phishing Triage Agent is designed to autonomously handle user-submitted phishing reports at scale in Defender for Office 365. The agent enables SOC teams by classifying incoming alerts, resolving false positives, and escalating only malicious cases that require human expertise. It automates repetitive tasks, accelerates investigations, and provides full transparency in every decision, allowing security teams to focus on what matters most—investigating real cyberthreats and strengthening the overall security posture. Early results prove how it is transforming analyst showing measurable impact of 40% reduction in time to resolution and significant decrease in manual triage workload. To make it easier than ever for organizations to harness the power of Security Copilot agents to protect at the speed and scale of AI, Security Copilot will be included for all Microsoft 365 E5 customers.*
• Email bombing protection—Email bombs send large volumes of emails to overflow a mailbox, overwhelm the user and distract attention from important email messages indicating a security breach. Defender for Office 365 now intelligently tracks message volumes across different sources and leverages historical patterns of the sender and signals related to spam content to identify these types of attacks. It automatically sends them straight to the junk folder, keeping the user’s inbox clean and the organization protected.

Driving transparency in the industry across ICES and SEG vendor effectiveness

At Microsoft, we believe that transparency is foundational to trust, and we are committed to delivering it through clear, actionable insights. By providing in-product transparency reports, we give customers visibility into security performance and outcomes. As both an email platform and a security provider, we want to work together with our ecosystem and do more to empower customers to understand email security effectiveness. That’s why earlier this year we introduced comparative benchmarking reports designed to assist customers in evaluating the benefits of integrating multiple email security solutions.

Testing these benchmarks relies on real-world email threats observed across the Microsoft ecosystem, rather than synthetic data or artificial testing environments. The study compares environments protected exclusively by Defender for Office 365 with those using a Secure Email Gateway (SEG) positioned in front of Defender, as well as environments where Integrated Cloud Email Security (ICES) solutions add a secondary layer of detection after Defender.

The future of email security

As email-based attacks continue to grow in sophistication and are increasingly fueled by AI, the need for AI-powered defenses and end-to-end AI security platforms becomes more urgent. Microsoft is committed to leading this transformation by:

• Investing in agentic AI to empower defenders with autonomous capabilities.
• Using the latest AI technology in our technology stack to defend against emerging cyberthreats.
• Expand our capabilities to new attack surfaces like Microsoft Teams and attack patterns like deepfakes.

We’re not just building tools; we’re shaping the future of cybersecurity. Our roadmap is guided by the real-world challenges faced by security teams and the outcomes they strive for: effective protection, fast detection, and smarter response.

We’re honored by the Gartner recognition and deeply grateful to our customers, partners, and the analyst community for their continued trust and collaboration.

Learn more

You can learn more by reading the full 2025 Gartner® Magic Quadrant™ for Email Security report. To learn more about Microsoft Defender for Office 365, visit our website. 

Are you a regular user of Microsoft Defender for Office 365? Share your insights on Microsoft Defender for Office 365 and get rewarded with a $25 gift card on Gartner Peer Insights™.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

*Eligible Microsoft 365 E5 customers will have 400 Security Compute Units (SCUs) per month for every 1,000 user licenses, up to 10,000 SCUs per month. This included capacity is expected to support typical scenarios. Customers will have an option to pay for scaling beyond the allocated amount at a future date with $6 per SCU on a pay-as-you-go basis, and will get a 30-day advanced notification when this option is available. Learn more.

**This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from Microsoft. 

Gartner does not endorse any vendor, product, or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. 

Gartner and Magic Quadrant are trademarks of Gartner, Inc., and/or its affiliates.

Gartner, Magic Quadrant for Email Security, 1 December 2025, By Max Taggett, Nikul Patel

The post Microsoft named a leader in the 2025 Gartner® Magic Quadrant™ for Email Security appeared first on Microsoft Security Blog.

At Microsoft, we believe that transparency is foundational to trust. As both an email platform and a security provider, we want to work together with our ecosystem and do more to empower customers to understand email security effectiveness. Today, we’re announcing two initiatives to support that objective.

First, to provide Microsoft Defender for Office 365 customers with richer data on its efficacy, we are releasing a new customer-facing dashboard that will provide visibility on our effectiveness across a range of threat vectors.

Second, we are releasing two comparative benchmarking reports designed to assist customers in evaluating the benefits of integrating multiple email security solutions. The first describes the protection value added by Integrated Cloud Email Security (ICES) vendors, which detect and remediate threats after Microsoft Defender for Office 365. The second describes the value of Secure Email Gateways (SEGs), which filter emails before they reach Microsoft Defender for Office 365. These reports are based on real-world threat data rather than synthetic tests to provide an objective basis for comparison at scale.

Security is a team sport, and we are grateful to our entire ecosystem for working together on protecting our customers. We encourage customers to see how the solutions deployed in their tenants are collectively performing for their needs.

Introducing the Defender for Office 365 overview dashboard

The new customer overview dashboard allows security teams to track efficacy across cyberthreats blocked pre-delivery, threats mitigated post-delivery, and even “missed” threats. It includes details on how Microsoft Defender for Office 365 capabilities like Safe link, Safe attachments, and Zero-hour Auto Purge contribute to threat protection across an organization. Our goal is simple: to help you confidently answer the question “How are my organization’s users being protected from malicious content and cyberattacks when using email and other collaboration surfaces like Microsoft Teams?”

Figure 1. Transparent Reporting Overview Dashboard.

Benchmarking

Transparency on effectiveness of Microsoft products alone isn’t enough. We know customers need data to evaluate effectiveness across the entire ecosystem, and our benchmarking research is intended to help you plan your cybersecurity solutions end to end.

Unlike traditional benchmarks that rely on synthetic tests or artificial environments, our reports use real email threats observed in the Microsoft ecosystem. We specifically compared environments protected solely by Microsoft Defender for Office 365 with those where an SEG was deployed in front of Defender, and with those where additional protection was provided by ICES vendors layered after Defender for Office 365. Throughout this process, we adhered to our strict security and privacy principles; all data presented in this report is aggregated and anonymized similar to data published in the Microsoft Digital Defense Report.

Figure 2. Secure Email Gateway and Integrated Cloud Email Security vendors landscape.

Benchmarking SEG vendors

SEGs continue to play an important role in many organizations’ security architectures, offering additional layers of protection. Microsoft benchmarked seven SEG vendors and Microsoft Defender for Office 365.

Methodology

Microsoft analyzed aggregated threat signals from environments using specific SEGs with Defender for Office 365, then normalized the results per 1,000 protected users to measure missed threats. 

For SEG vendors, a threat was considered “missed” if it was not detected pre-delivery, or if it was not removed shortly after delivery (post-delivery). However, for Microsoft Defender for Office 365, we applied a stricter standard; even if the threat was removed post-delivery, it was considered as missed.  

Results

This analysis showed that, when baselined against Defender for Office, Defender for Office missed the least threats.

Figure 3. Secure Email Gateway (SEG) Vendor Benchmark Data.

ICES vendors

As organizations adopt layered security strategies, ICES products execute after Microsoft Defender for Office 365 and act as a secondary filter. These solutions offer additional detection layers focusing on specific threat types or user behavior patterns.

Methodology

ICES vendors use the Microsoft Graph API to move emails to folders such as junk, promotional, or deleted items.   Messages can be moved from any delivery location, like the Inbox or even the Junk folder. In this data study, a message moved by an ICES vendor is counted as a catch. Messages marked as spam or malicious by Microsoft Defender for Office 365 before the ICES vendor moved them, are counted as duplicate catch. Generally, messages classified as spam by Microsoft Defender for Office 365 are delivered to the Junk folder and those classified as malicious go to Quarantine. However, some customer configurations can override message delivery. The ICES vendor catch is normalized by Microsoft Defender for Office 365’s overall catch to make it simple to see the value added by ICES vendor.

Figure 4. Integrated Cloud Email Security Vendor Benchmark Data.

Definitions for the categories used are:

• Marketing and bulk—Promotional offers or newsletters from known senders (for example, a coupon from a food delivery app) that are not malicious but may affect productivity.
• Spam—Nuisance emails from unsolicited or disreputable senders that are not malicious but may affect productivity.
• Malicious—Messages containing harmful content such as phishing links, malware, or other security threats.
• Non-malicious—Benign messages that could be false positives or may have been moved due to customer preferences.

Our analysis shows that combining ICES products with Defender for Office 365 yields the greatest impact in enhancing detection of promotional or bulk email, with an average improvement of 20%. These enhancements can help reduce inbox clutter to improve user experience, particularly in environments where marketing noise is a concern, and offer valuable insight for us as we consider continued investment in enabling roadmap capabilities that benefit our customers. For malicious messages and spam, across all vendors analyzed, the average improvement was 0.30% for malicious catch and 0.51% for spam catch. Look for details on each vendor on the benchmarking website.

Empowering security through transparency and data

In keeping with our commitment to transparency and data-driven rigor, we reached out to SE Labs, recognized experts in email security testing, to independently review our benchmarking methodology, ensuring we hold ourselves to the highest quality standards.

“Businesses need to choose the best security that they can afford. Showing the additional benefit vendors provide using real threats, as Microsoft has done here, can help with this important decision.

While traditional comparative tests with synthetic threats allow for testing that targets certain features in a product, using specific, advanced, or novel attack techniques, real-world data exposes how products perform against the full spectrum of threats encountered day to day.

Both types of testing provide valuable insights that together give a more complete picture of security effectiveness. We hope Microsoft’s data inspires additional comparative testing for better customer decision-making.

—Simon Edwards, Founder and Chief Executive Officer, SE Labs

In the face of increasingly complex email threats where cybersecurity decisions carry profound consequences, clarity and transparency are indispensable. To support data-driven decisions for our customers, we plan to provide quarterly updates for these benchmarks and we will continue to take feedback and refine our approach working together with our ecosystem.

Microsoft remains steadfast in its commitment not only to securing organizations but also to providing reliable tools and actionable transparent data to help you evaluate efficacy and keep your organization safe.

Learn more

Learn more about Microsoft Defender for Office 365

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

The post Transparency on Microsoft Defender for Office 365 email security effectiveness appeared first on Microsoft Security Blog.

Unique characteristics of QR code phishing campaigns

Like with other phishing techniques, the goal of QR code phishing attacks is to get the user to click on a malicious link that seems legitimate. They often use minimalistic emails to deliver malicious QR codes that prompt seemingly legitimate actions—like password resets or two-factor authentication verifications. A QR code can also be easily manipulated to redirect unsuspecting victims to malicious websites or to download malware in exactly the same way as URLs.

Figure 1. QR code as an image within email body redirecting to a malicious website.

The normal warning signs users might notice on larger screens can often go unnoticed on mobile devices. While the tactics, techniques, and procedures (TTPs) vary depending on which bad actor is at work, Microsoft Defender for Office 365 has detected a key set of patterns in QR code phishing attacks, including but not limited to:

• URL redirection, where a click or tap takes you not where you expected, but to a forwarded URL.
• Minimal to no text, which reduces the signals available for analysis and machine learning detection.
• Exploiting a known or trusted brand, using their familiarity and reputation to increase likelihood of interaction.
• Exploiting known email channels that trusted, legitimate senders use.
• A variety of social lures, including multifactor authentication, document signing, and more.
• Embedding QR codes in attachments.

The impact of QR code phishing campaigns on the broader email security industry

With the most common intent of QR code phishing being credential theft, malware distribution, or financial theft, QR code campaigns are often massive—exceeding 1,000 users and follow targeted information gathering reconnaissance by bad actors.²

Microsoft security researchers first started noticing an increase in QR-code based attacks in September 2023. We saw attackers quickly morphing their techniques in two keys ways: First by manipulating the way that the QR code rendered (such as different colors and tables), and second by manipulating the embedded URL to do redirection.

The dynamic nature of QR codes made it challenging for traditional email security mechanisms that were designed for link-based phishing techniques to effectively filter and protect against these types of cyberattacks. A key reason was the fact that extensive image content analysis was not commonly done for every image in every message, and did not represent a standard in the industry at the time of the surge.

As a result, for several months our customers saw an increase in bad email that contained malicious QR codes as we were adapting and evolving our technology to be effective against QR codes. This was a challenging time for our customers and those of other email security vendors. We added incremental resources and redirected all our engineering energy to address these issues, and along the way not only delivered new technological innovations but also modified our processes and modernized components of our pipeline to be more resilient in the future. Now these challenges have been addressed through a key set of innovations, and we want to share our learnings and technology advancements moving forward.

For bad actors, QR code phishing has become a lucrative business, and attackers are utilizing AI and large language models (LLMs) like ChatGPT to increase the speed and improve the believability of their attacks. Recent research by Insikt Group noted that bad actors can generate 1,000 phishing emails in under two hours for as little as $10.³ For the security industry, this necessitates a multifaceted response including improved employee training and a renewed commitment to innovation.

The necessity of innovation in QR code phishing defense

Innovation in the face of evolving QR code phishing risk is not just beneficial, it’s imperative. As cybercriminals continually refine their tactics to exploit new technologies, security solutions must evolve at a similar pace to remain effective. In response to the growing threat of QR code phishing, Microsoft Defender for Office 365 took decisive action to leverage advanced machine learning and AI—developing robust defenses capable of detecting and neutralizing QR code phishing attacks in real time. Our team meticulously analyzed these cyberthreats across trillions of signals, gaining valuable insights into their mechanisms and evolving patterns. This knowledge helped us refine our security protocols and enhance our platform’s resilience with several strategic updates. As the largest email security provider, we have seen a significant decline in QR code phishing attempts. At the height, Defender for Office 365 was blocking 3 million attempts daily, and with the delivery of innovative protection we have seen this number shrink to 200,000 QR code phishing attempts every day. This is testament that our innovation is having the desired effect: reducing the effectiveness of QR code-based attacks and forcing attackers to shift their tactics.

Figure 2. QR code phishing blocked by Microsoft Defender for Office 365.

Recent innovations and protections we’ve implemented and improved within Microsoft Defender for Office 365 to help combat QR code phishing include:

• URL extraction enhancements: Microsoft Defender for Office 365 has improved its capabilities to extract URLs from QR codes, substantially boosting the system’s ability to detect and counteract phishing links hidden within QR images. This enhancement enables a more thorough analysis of potential cyberthreats embedded in QR codes. In addition, we now extract metadata from QR codes, which enriches the contextual data available during threat assessments, enhancing our ability to detect suspicious activities early in the attack chain.
• Advanced image processing: Advanced image processing techniques at the initial stage of the mail flow process allow us to extract and log URLs hidden within QR codes. This proactive measure disrupts attacks before they have a chance to compromise end user inboxes, addressing cyberthreats at the earliest possible point.
• Advanced hunting and remediation: To offer a comprehensive response to QR code threats across email, endpoint, and identities with our advanced hunting capabilities, security teams across organizations are well equipped to specifically identify and filter out malicious activities linked to these codes.
• User resilience against QR code phishing: To further equip our organization against these emerging threats, Microsoft Defender for Office 365 has expanded its advanced capabilities to include QR code threats, maintaining alignment with email platforms and specific cyberattack techniques. Our attack simulation training systems along with standard setup of user selection, payload configuration, and scheduling, now have specialized payloads for QR code phishing to simulate authentic attack scenarios.

Read more technical details on how to hunt and respond to QR code-based attacks. By integrating all these capabilities across the Microsoft Defender XDR platform, we can help ensure any QR code-related threats identified in emails are thoroughly analyzed in conjunction with endpoint and identity data, creating a robust security posture that addresses threats on multiple fronts.

Staying ahead of the evolving threat landscape 

The enhancements of Microsoft Defender for Office 365 to defend against QR code-based phishing attacks showcased our need to advance Microsoft’s email and collaboration security faster. The rollout of the above has closed this gap and made Defender for Office 365 effective against these attacks, and as the use of QR codes expands, our defensive tactics will now equally advanced to combat them.

Our continuous investment in analyzing the cyberthreat landscape, learning from past gaps, and our updated infrastructure will enable us to effectively handle present issues and proactively address future risks faster as threats emerge across email and collaboration tools. We will soon be sharing more exciting innovation that will showcase our commitment to delivering the best email and collaboration security solution to customers.

For more information, view the data sheet on protecting against QR code phishing or visit the website to learn more about Microsoft Defender for Office 365.

Learn more

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

¹Attackers Weaponizing QR Codes to Steal Employees Microsoft Credentials, Cybersecurity News. August 22, 2023.

²Hunting for QR Code AiTM Phishing and User Compromise, Microsoft Tech Community. February 12, 2024.

³Security Challenges Rise as QR Code and AI-Generated Phishing Proliferate, Recorded Future. July 18, 2024.

The post How Microsoft Defender for Office 365 innovated to address QR code phishing attacks appeared first on Microsoft Security Blog.

Chances are you’ve heard the phrase “attackers don’t break in, they log in.” Identities have evolved to be the most targeted asset, because they enable cyber criminals to move and operate across environments to achieve their goals. In 2023, identity-based attacks reached a record-high with 30 billion attempted password attacks each month, as cyber-criminals capitalize on the smallest misconfigurations and gaps in your identity protection.  

As customers have applied MFA, device compliance, and other Zero Trust core principles to their identity environments, attackers have shifted to attacking the identity infrastructure itself. While it is critical to protect all identities – identifying, preventing, detecting and responding to attacks on the Identity admins, apps, and services that provide the foundation of your Zero Trust platform is more critical than ever. That’s why it’s critical for organizations to build a holistic approach to defend their identity estate across both – on-prem infrastructure and cloud identities – by making Identity Threat Detection and Response (ITDR) a cornerstone of their defense strategy. KuppingerCole defines ITDR as a class of security solutions designed to proactively detect, investigate, and respond to identity-related threats and vulnerabilities in an organization’s IT environment. 

Today we are thrilled to announce that Microsoft has been recognized as an overall leader in the KuppingerCole Leadership Compass Identity Threat Detection and Response: IAM Meets the SOC. The report calls out our strengths across key capabilities ranging from identity posture to remediation, while further highlighting Microsoft’s commitment to protecting all organizations. VP KuppingerCole US and Global Head of Research Strategy Mike Neuenschwander states that “Microsoft’s approach to ITDR is refreshingly open, including integration with other cloud identity platforms such as AWS, Google Cloud, and Okta.”.  

Figure 1: ITDR Leadership compass with Microsoft as a leader

Streamline your identity protection with ITDR and generative AI  

At Microsoft, we look at ITDR as a set of capabilities at the intersection of Identity and Access Management (IAM) and Extended Detection and Response (XDR). Designed to break down organizational silos and optimize collaboration and effectiveness of identity and SOC teams, we built a seamless integration between Microsoft Entra ID and Microsoft Defender XDR that empowers organizations to reinforce their security boundary with complete protection across their hybrid identity landscape.  Further, generative AI in the form of Microsoft Copilot for Security is embedded across all touchpoints, helping security and IT professionals respond to cyber threats, process signals, and assess risk exposure at the speed and scale of AI. 

As organizations begin to implement their ITDR strategies, they should consider 4 key areas: 

• Enforce secure, adaptive access: Adopting a comprehensive, defense-in-depth strategy that spans identities, endpoints, and networks is the starting point of any ITDR initiative. Implementing consistent identity and network access policies from a single unified engine across public and private networks is critical to protecting identities and securing access to resources. The Zero Trust Network Access model of Microsoft Entra Private Access enables secure connectivity to private resources from Windows, iOS, Mac, and Android operating systems and across any port and protocol, including SMB, RDP, FTP, SSH, SAP, printing, and all other TCP/UDP based protocols to significantly reduce the risk of potential breaches. Using advanced user and entity behavioral analytics (UEBA) in Microsoft Entra ID Protection, Conditional Access policies make real-time access decisions based on contextual factors such as user, device, location, network, and real-time risk information to control what a specific user can access and how and when they have access seamlessly across on-premises and cloud environments. Analyze risk signals in real time and automatically block access or prompt re-authentication, like MFA, to stop suspicious activity in real time and before a breach occurs.  
• Proactively protect your on-premises resources and harden your identity posture: Misconfigurations in identity infrastructure, permissions, or access controls are the Achillies’ heel of identity security. All it takes is one compromised user account, infected device, or an open port for an attacker to access and laterally move anywhere inside your network. These breaches-waiting-to-happen can have far-reaching consequences as Identities have become an integral part of almost every element of modern security practices. Microsoft provides detailed, identity-specific posture recommendations spanning on-premises Active Directory environments, Microsoft Entra ID deployments and even other common identity solutions all within the context of a broader security posture score. 
• Disrupt and remediate identity threats at machine speed: Automatic attack disruption is an out-of-the-box capability in Defender XDR that stops the progression and limits the impact of some of the most sophisticated attacks that involve identity compromise. Using the significant breadth of our signals, it not only disrupts ongoing attacks but accurately predicts the attacker’s next move and proactively blocks it with 99% confidence. Ransomware campaigns are now disrupted within an average of 3 minutes. Our powerful capabilities support identity-involved attacks like business email compromise, adversary-in-the-middle, and can even disrupt Ransomware campaigns within an average of 3 minutes. 
• Augment your security teams with generative AI: Microsoft Copilot for Security is the first generative AI security product to help protect organizations at machine speed and scale. Copilot for Security is an AI assistant for security teams that builds on the latest in large language models. Copilot is native within the existing Entra and Defender experiences, helping identity and SOC teams prioritize, understand and act upon identity risks and security incidents with step-by-step recommendations in seconds.  

As the sophistication and prevalence of identity-based attacks continue to grow, ITDR is becoming increasingly critical to modern cybersecurity and we are excited to see KuppingerCole highlight this in their latest report. Looking forward, we will continue to integrate our industry-leading solution and AI capabilities to help our customers future-proof their defenses and stay resilient against evolving cyberthreats in the workforce identity space. 

​​To learn more about Microsoft’s ITDR solution visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity. 

The post Microsoft named an overall leader in KuppingerCole Leadership Compass for ITDR appeared first on Microsoft Security Blog.