As organizations adopt cloud-native architectures at scale, protecting workloads requires more than scanning. Today, 82% of container users run Kubernetes in production, making runtime visibility and protection critical for modern applications.¹

That change, from scanning workloads to protecting them where they run, is exactly what Frost & Sullivan describes in its Frost Radar™: Cloud Workload Protection Platforms, 2026. Out of more than 45 qualified vendors, it benchmarked 20, and it found the category moving to a single runtime security model, one that ties together code, cloud, runtime, identity, and the security operations center (SOC).

Within that market, Frost & Sullivan names Microsoft a visionary leader, its category for vendors that balance innovation with growth and help set the direction of the market. Microsoft is also the largest cloud workload protection platform (CWPP) provider by revenue, with an estimated share of more than 22% of the global CWPP market. In the analyst’s words:

“Microsoft is positioned as a visionary leader in this analysis for its scale and breadth of [Microsoft] Defender for Cloud within a unified framework. The platform stands out for its breadth of coverage across infrastructure, workloads, identities, entitlements, data, and applications, and for its deep integration with Microsoft’s broader security ecosystem, allowing organizations to secure modern and AI-native application lifecycles, while reducing operational complexity.”

Scale and breadth, in one framework. That is what customers are asking for, and it is where this category is heading. 

Why cloud workload protection is being redefined

For a long time, protecting a workload meant scanning its image, fixing known vulnerabilities, and hardening configurations before deployment. That still matters. But it is no longer enough, because what looks safe before deployment can become exploitable once the workload is running.

Most teams are also dealing with real sprawl. A modern estate spans several clouds and mixes containers, Kubernetes, serverless functions, microservices, and AI workloads. Every layer throws off its own signals, and those signals rarely connect on their own. One misconfiguration looks harmless until it sits next to an over-permissioned identity and a container that is already live. Then it is a path into production.

The tools were not built for this. Posture sits in one console, workload scanning in another, detection in a third, and teams are left connecting them by hand, usually in the middle of an incident. What they need instead is one platform that can:

• Bring posture, runtime, identity, and control-plane signals into one place.
• Rank risk by what is truly exploitable, not by a severity score alone.
• Stop risky workloads close to deployment, before they reach production.
• Get what it finds at runtime to the developers and the SOC who can act on it.

The market is moving the same way. Frost & Sullivan expects CWPP spending to grow from $6.43 billion in 2025 to about $7.95 billion in 2026, and 19.1% a year through 2030. That is teams voting with their budgets to modernize cloud security, meet regulation, and protect the workloads behind their apps, data, and AI services.

What distinguishes leading platforms

Frost & Sullivan scores vendors on two things: how fast they innovate and how fast they grow. But the report is blunt about something more telling: the bar for leadership has moved. It is now, in the analyst’s words:

“Increasingly defined by runtime telemetry depth, container, and K8s security, workload behavior analysis, cloud-native threat detection, remediation and response automation, SOC integration, AI workload protection, and global go-to-market execution.”

Put plainly, discovery, scanning, and compliance checklists no longer separate the leaders. Depth at runtime does. The platforms pulling ahead tend to share a few traits:

• They cover real ground, from infrastructure and workloads to identities, data, and applications, without asking you to bolt five products together.
• They go deep at runtime, not just posture and log review.
• They carry cloud detection and response (CDR) straight into the SOC.
• They connect code, cloud, and the SOC instead of treating each as its own island.
• They span clouds with both agent and agentless coverage, and they are moving quickly on AI and data security.

None of that is about longer findings lists. It is about context: seeing how the pieces connect and acting on the few that matter.

How Microsoft helps organizations protect cloud workloads

Microsoft’s capabilities address the problems customers raise most, and Frost & Sullivan points to the same strengths: 

“The strength in scaled runtime protection depth, strong CDR expansion, and ability to operationalize cloud runtime security across [Microsoft] Defender XDR, [Microsoft] Sentinel, GitHub, [Microsoft] Security Copilot, and the broader Microsoft security stack give Microsoft clearest advantages, particularly for large enterprises that already operate across Microsoft security, Azure infrastructure, GitHub, and Sentinel environments.”

Here is what that looks like in practice, starting from the problem in each case. 

1. Protect workloads while they are running

Microsoft Defender for Cloud watches workloads while they run. A lightweight sensor (eBPF-based) picks up Kubernetes events, process activity, and network traffic, and detections map to MITRE ATT&CK, so alerts line up with real cyberattacker behavior. Most of the recent effort has gone into the container layer: DNS detection for Kubernetes on Azure AKS, Amazon EKS, and Google GKE; anti-malware that blocks rather than just alerts; runtime protection for EKS Bottlerocket; and drift blocking when a binary changes mid-run.

Defender for Cloud can also act before a workload starts. Kubernetes’ gating applies policy at the cluster and namespace level, so a risky or non-compliant image is blocked before it ever starts. Frost & Sullivan calls this out as especially relevant to CWPP, because it puts preventive controls right next to production. That is the whole idea: catch a bad image before it becomes an incident, not after.

2. Get runtime signal to the SOC

Runtime signal only helps if it reaches the people who respond. With expanded CDR, Defender for Cloud ties runtime telemetry, Kubernetes audit data, process and network activity, control-plane events, and identity signals to specific workload incidents, then hands them to Microsoft Defender XDR and Microsoft Sentinel. A suspicious process in a running cluster does not land as a lonely alert. It arrives already connected to the identity that launched it and the activity around it.

For the SOC, that means faster answers and far less stitching signals together by hand.

3. Send runtime findings back to the developers who can fix them

Finding a problem at runtime is only half the work. Someone still has to fix it. Defender for Cloud links runtime context, exploitability, and attack-path detail to developer workflows through GitHub Advanced Security and Copilot Autofix, syncing both ways between security and development. A risk caught in production can go straight to the engineer who owns the code, get fixed at the source, and be checked afterward.

The right issue reaches the right owner, and security and DevOps finally work from the same list.

4. Extend protection to AI and across clouds

More and more, the workloads worth protecting are AI. Defender for Cloud supports model scanning and threat protection, including prompt injection and suspicious access, for Azure AI Foundry and Azure OpenAI, and AI security posture management for Google Vertex AI and Amazon Bedrock. It spans Microsoft Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), and hybrid environments with both agent and agentless coverage, and Microsoft Security Copilot adds guided investigation across the workflow.

Protection follows the workload, whether that is a new AI service or a third cloud.

What this signals for security leaders

For anyone choosing a workload protection platform this year, the shift in this report changes the questions worth asking. The ones to put at the top:

• Is workload protection part of one cloud security platform, or a separate tool wired onto the SOC after the fact?
• Can it stop a risky workload before production, or only flag it afterward?
• Does it connect runtime activity to identity, data, and control-plane context, and rank what is genuinely exploitable?
• Do its findings reach both the SOC and the developers who can act on them?
• Does it hold up across several clouds and AI workloads?

The vendors that can answer “yes” are the ones shaping what comes next, and the Frost Radar places Microsoft among them.

Bottom line

Frost & Sullivan’s Frost Radar™: Cloud Workload Protection Platforms, 2026 reinforces a clear shift. Cloud workload protection is leaving isolated scanning behind for runtime security that connects posture, identity, code, and the SOC. Frost & Sullivan positions Microsoft as a visionary leader, and the largest CWPP provider by revenue, because Defender for Cloud brings that range together in one framework, goes deep at runtime and in CDR, and plugs into the wider Microsoft security stack.

Learn more

• Read Frost & Sullivan’s Frost Radar™: Cloud Workload Protection Platforms, 2026 to see how leading vendors are evaluated and how the category is shifting toward unified cloud runtime security. 
• Explore Microsoft cloud security solutions to see how unified posture management, risk prioritization, and protection across cloud and AI can help reduce risk.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

¹Kubernetes Established as the De Facto ‘Operating System’ for AI as Production Use Hits 82% in 2025 CNCF Annual Cloud Native Survey. PR Newswire, January 20, 2026.

The post Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026 appeared first on Microsoft Security Blog.

We are excited to announce that we have been named a Leader in the 2026 IDC MarketScape: Worldwide MDR/MXDR for the Enterprise Vendor Assessment (Doc #US54792426, July 2026). Read the excerpt here.

Expert-led MDR, built on the Microsoft Defender platform

Microsoft Defender Experts MDR is a round-the-clock, expert-led managed detection and response service that helps security teams triage, investigate, and respond to incidents so they can stop cyberattackers in their tracks and prevent future compromise. Rather than bolting a separate stack of tools and connectors onto your environment, the service operates natively on Microsoft Defender, with built-in protection across endpoints, identities, email, cloud apps, cloud workloads, and network security, as well as around-the-clock proactive threat hunting with Microsoft Defender Experts Hunting.

Because the service is delivered on the same platform it monitors, detection and intelligence improvements reach customers continuously. The insights our experts generate also strengthen protection across the broader Defender ecosystem, so every customer benefits from what we learn defending the next environment.

Threat intelligence at internet scale

Great detection starts with great intelligence. Defender Experts MDR draws on Microsoft’s global threat intelligence: more than 10,000 security researchers and 100 trillion signals analyzed every day across billions of users and millions of organizations.¹ That breadth lets our analysts recognize subtle patterns early, often before a campaign escalates, and respond with higher-confidence attribution than intelligence sourced from any single customer’s telemetry could provide.

AI-accelerated operations, expert-led decisions

Defender Experts MDR also combines advanced AI and generative AI with seasoned human experts. AI filters noise, grades and classifies incidents, and accelerates investigation at machine speed and scale, while our analysts own the outcome. According to the IDC MarketScape, “70% AI-assisted workflows are enabled through automated noise filtering, AI-based grading, and agentic operations while maintaining expert decision-making.” Furthermore, “quantified outcomes noted include 97% AI classification accuracy, 77% malware/phishing agent-investigated, 72% faster resolution combining AI and humans, and 45% autonomous investigations.”

The impact shows up in the work. Over the past year, Defender Experts mitigated 27,000 high-severity incidents, and the team’s threat research now contributes a meaningful share of all Defender detections, enriching protection for customers well beyond the MDR service itself. Throughout, a dedicated security delivery expert and on-demand access to our experts keep customers informed with proactive check-ins, live dashboards, and clear, actionable reporting.

Managed threat hunting, included

Many providers treat proactive threat hunting as a premium add-on. Defender Experts MDR includes it as a core part of the service with Defender Experts Hunting, extending your team with Microsoft experts who continuously look for advanced threats across your environment. These hunts are informed by Microsoft Threat Intelligence, Defender telemetry, and human analysis, in order to better identify malicious activity and improve security operations center (SOC) response.

When a threat is found, Defender Expert notifications appear as incidents in the Defender portal with technical context, recommended remediation, and, when needed, access to on-demand support for additional guidance. The work also feeds back into hunter-trained AI and reporting, so customers can see what was investigated, how the activity maps to MITRE tactics, and how threats are categorized by behavior, characteristics, and impact.

Get started

Read the IDC MarketScape: Worldwide MDR/MXDR for the Enterprise 2026 Vendor Assessment excerpt, and visit the Microsoft Defender Experts MDR webpage to see how expert-led, round-the-clock managed detection and response can extend your team, drive SOC efficiency, and help you stay ahead of emerging cyberthreats.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters, and follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

¹Microsoft Digital Defense Report 2025.

The post Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise  appeared first on Microsoft Security Blog.

Modern IT estates now span multiple clouds and on-premises systems, with architectures built on containers, Kubernetes, serverless functions, microservices, APIs, and AI-powered workloads. This increases both the volume and the interconnectedness of security signals. The challenge is no longer identifying individual risks, but determining how misconfigurations, identities, and data exposures combine to create real attack paths, and which of these are most critical to fix at the source. 

KuppingerCole’s Leadership Compass: Cloud Native Application Protection Platforms (CNAPP) reflects this shift. The report describes how CNAPP is evolving from a consolidation of cloud security tools into the security foundation for AI-native enterprises, combining cloud security, AI security posture management, runtime protection, attack path analysis, cloud detection and response, and agentic AI operations into unified platforms.

Within this evolving market, KuppingerCole names Microsoft a Leader across all four of its Leadership categories: Overall, Product, Innovation, and Market. In the report’s words: 

“Microsoft earns its Overall Leadership with its Defender for Cloud that is redefining the CNAPP market by extending cloud security beyond infrastructure protection and into a unified security platform for cloud, data, identity, AI, and security operations, supported by one of the industry’s most advanced agentic AI ecosystems.” 

That recognition reflects where the category is heading: toward platforms that unify cloud and AI security into one operational view of risk. 

Why CNAPP is being redefined 

KuppingerCole makes a clear point: CNAPP is no longer about posture or visibility alone. It is becoming the operational foundation for securing AI-powered applications, services, and business processes, across the full software lifecycle from cloud infrastructure to the AI systems running on top of it.

Modern environments introduce complexity across: 

• Multicloud and hybrid infrastructure. 
• Rapid development and continuous deployment. 
• Containers, serverless, microservices, and APIs. 
• AI models, agents, pipelines, and machine identities. 

This complexity exposes the limits of traditional, siloed tools, where cloud posture, workload protection, AI security, and the security operations center (SOC) each live in their own console. Organizations now need platforms that can: 

• Correlate posture, runtime, identity, data, application, and AI signals. 
• Prioritize risk based on exploitability, not severity alone. 
• Integrate security across development, cloud operations, and the SOC. 
• Bring AI systems into the same risk model as the rest of the cloud. 

Runtime intelligence is now central to this shift. Across the platforms KuppingerCole evaluated, 94% detect active exploitation of the complex attack paths they surface, moving teams from long lists of findings to the exposures threat actors can actually use. 

What distinguishes leading platforms 

KuppingerCole evaluates providers on product strength, innovation, and market presence, and, more importantly, on how effectively they help organizations manage real risk across cloud and AI. Several themes define the next generation of platforms: 

• AI security posture management that governs models, pipelines, and AI-specific attack paths. 
• Agentic AI that investigates, validates exposures, and helps remediate, not just detect. 
• Runtime-driven risk prioritization focused on what is exploitable in production. 
• Security graphs and attack path analysis across identity, data, network, workload, and AI. 
• Convergence of CNAPP with cloud detection and response, integrated with the SOC. 

Taken together, these capabilities represent a move from fragmented visibility to connected, contextual risk management that spans cloud and AI in a single fabric. 

How Microsoft helps organizations manage real risk 

1. Connect cross-domain signals to prioritize real attack paths 

Most security tools surface large volumes of findings, but isolated findings do not reflect how cyberattacks actually happen. Microsoft Defender for Cloud uses the Cloud Security Graph and risk-based, multicloud attack path analysis to correlate posture, identity (human and non-human), data, network, and workload signals and identify which risks are truly exploitable. A misconfigured storage resource may look low priority on its own. Exposed to the internet, combined with excessive permissions, and connected to sensitive data, it becomes part of a clear attack path.  

What this means: Security teams can prioritize real attack paths instead of individual findings, helping reduce alert fatigue and improve remediation speed and precision.  

2. Secure AI as part of cloud risk, and use AI to run security 

Defender for Cloud brings AI security posture management into the same model as the rest of the cloud, helping organizations validate AI deployment configurations, access controls, model provenance, approved model usage, and identify potential shadow AI risks within supported environments. Through Microsoft Security Copilot and a growing set of specialized security agents, the platform also helps teams investigate, prioritize, guide remediation, and automate workflows.  

What this means: Organizations can govern AI as part of cloud risk rather than in a separate silo, and shift AI from flagging risk to actively helping resolve it. 

3. Reduce complexity from code to cloud to SOC 

As environments scale, fragmented tools make it difficult to understand how risks connect and where to focus first. Defender for Cloud connects code and infrastructure definitions, assesses cloud configurations, protect workloads at runtime, monitor applications and APIs, govern identities, correlate threats across the broader digital estate, and use AI to accelerate investigation and remediation across multicloud and hybrid environments. 

What this means: Security teams can investigate faster, prioritize more consistently, and respond more quickly across fragmented cloud and application environments. 

What this signals for security leaders 

The Leadership Compass offers a signal for where cloud security is headed: toward platforms that connect context across cloud, application, and AI environments so teams can prioritize the risks most likely to be exploited and reduce exposure faster. Security leaders should now ask: 

• Can the platform correlate signals across identity, endpoints, data, cloud, runtime, and applications? 
• Does it see AI models, agents, and pipelines as part of cloud risk, or is AI a separate tool? 
• Can it prioritize risk based on exploitability, not just severity? 
• Does AI help the team investigate and remediate, or only detect? 
• Can it scale across multicloud and AI environments and reach into the SOC? 

These are the capabilities that define the next generation of cloud-native application protection. 

Bottom line 

KuppingerCole’s 2026 CNAPP Leadership Compass reinforces a clear shift: CNAPP is becoming the control plane for managing risk across cloud, identity, data, applications, and AI. Microsoft’s recognition as a Leader across all four Leadership categories reflects this shift, bringing posture, runtime, identity, data, application, and AI signals into a connected platform that helps organizations prioritize and reduce risk continuously.  

Learn more 

• Read KuppingerCole’s Leadership Compass: Cloud Native Application Protection Platforms (CNAPP)  to see how leading vendors are evaluated and how the category is shifting toward securing the AI-native enterprise. 
• Explore Microsoft cloud security solutions to see how unified posture management, risk prioritization, and protection across cloud and AI can help reduce risk. 

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

The post ​​Microsoft named a Leader in the KuppingerCole Leadership Compass for Cloud Native Application Protection Platforms (CNAPP) appeared first on Microsoft Security Blog.

Frost & Sullivan’s 2025 Frost Radar™ for Cloud Security Posture Management points to a structural shift: CSPM is no longer a periodic compliance exercise. It’s a continuous, risk‑based governance layer inside modern cloud native application protection platforms (CNAPPs). Frost & Sullivan projects the CSPM market will grow from $2.82 billion in 2025 to $6.96 billion by 2030 at a 19.8% compound annual growth rate (CAGR)—reflecting the growing shift from standalone posture tools to integrated, platform‑based approaches.

A cloud native application protection platform (CNAPP) brings together posture, workload protection, identity and entitlement management, and related controls to secure applications across the full lifecycle—from development through runtime operations.

Frost & Sullivan’s analysis also reinforces Microsoft’s position among leading CSPM providers, with strong performance across innovation and growth. This reflects Microsoft’s approach to unifying posture management with workload protection, identity, and data security as part of a broader CNAPP platform—aligning directly with how CSPM is evolving from point-in-time compliance to continuous risk management.

Below are five key insights from the Frost Radar and what they mean for security leaders navigating today’s cloud threat landscape.

1. CSPM is becoming the governance layer for CNAPP 

Frost & Sullivan research suggests CSPM is evolving beyond a standalone tool focused on configuration hygiene. Instead, it increasingly serves as the entry point and governance backbone for CNAPP—integrating posture signals with workload protection, identity, data security, and security operations center (SOC) workflows.

Modern CSPM solutions are expected to:

• Provide continuous visibility across infrastructure as a service (IaaS), platform as a service (PaaS), and software as a service (SaaS).
• Correlate misconfigurations, identities, vulnerabilities, and data exposure.
• Feed high‑fidelity posture context into runtime protection and incident response workflows.

What to look for

Unified visibility that connects posture findings with workload, identity, and data signals—so investigations don’t begin from scratch when posture risk turns into an incident.

Frost notes that by 2030, CSPM is expected to become less a standalone market and more a foundational governance layer inside CNAPP platforms—unifying code‑to‑cloud policy and feeding posture context into runtime and SOC workflows

2. The market is moving beyond compliance to risk‑based prioritization

Compliance coverage is now table stakes. Frost highlights that for organizations to differentiate they need solutions that continuously assess risk, reduce noise, and guide remediation—helping teams focus on the “toxic combinations” that create real exposure.

Leading solutions need to:

• Continuously assess risk rather than rely on point‑in‑time scans.
• Reduce alert fatigue through contextual correlation.
• Prioritize remediation based on exploitability and business impact.

Organizations are increasingly using CSPM to drive ongoing risk reduction—with compliance reporting treated as an outcome of stronger controls.

What to look for

Prioritization that highlights likely cyberattack paths—not just severity scores—so teams can fix what’s exploitable first and minimize false positives.

Security leaders are adjusting how they evaluate CSPM vendors in response to these shifts. Rather than asking how many compliance frameworks a solution supports, they’re looking at whether posture insights can be correlated with identity, workload, and runtime signals to expose exploitable attack paths and guide remediation across developer and SOC workflows. Frost & Sullivan’s evaluation framework reflects this transition—placing greater emphasis on integrated, code to cloud risk management capabilities inside broader CNAPP platforms.

3. Code‑to‑cloud visibility is now required

Another major theme in the Frost Radar report is how organizations can embed posture management earlier in the application lifecycle to prevent misconfigurations before deployment—and continuously detect drift as environments change.

The report emphasizes:

• Infrastructure‑as‑code (IaC) scanning and policy‑as‑code enforcement
• Continuous integration and continuous delivery (CI/CD) pipeline integration
• Ownership mapping so issues are routed to the right developer or team

By extending posture management into DevSecOps workflows, organizations can reduce remediation costs and prevent risk from reaching production.

What to look for

Security guardrails embedded in CI/CD pipelines—with clear ownership routing—so remediation happens earlier and doesn’t bounce between teams.

4. Multicloud complexity is driving platform consolidation

Fragmented tools and siloed data continue to create blind spots across posture, identity, and workload risk—overwhelming SOC teams and reducing operational effectiveness.

As a result, buyers are consolidating point products into integrated CNAPP platforms that correlate posture, workload, identity, and runtime signals.

Platform convergence is reshaping CSPM investment and deployment models:

• A growing share of CSPM capability is delivered as part of a broader platform.
• Shared dashboards improve visibility across hybrid and multicloud environments.

Consolidation reduces tool sprawl and improves SecOps efficiency.

What to look for

A platform approach that standardizes policies across clouds and carries posture insights into security operations (SecOps) workflows—improving both signal quality and remediation speed.

5. AI is reshaping CSPM—from operations to new workloads

Frost highlights AI as both an operational enabler and a new security domain for CSPM.

AI is being used to:

• Reduce alert fatigue through contextual prioritization.
• Generate compliance evidence.
• Deliver guided remediation for developers and security teams.

At the same time, CSPM capabilities are expanding into AI workload posture management—covering models, pipelines, and related infrastructure.

What to look for

AI assisted prioritization and guided remediation—plus posture coverage for AI workloads—so emerging risks such as prompt injection or data leakage are managed alongside traditional cloud risk.

What this means for security leaders

Frost & Sullivan’s analysis underscores that CSPM is no longer about checking compliance boxes—it’s becoming a strategic control layer for managing cloud risk across the entire application lifecycle.

If you’re evaluating CSPM capabilities in 2025–2026, ask:

• Can posture findings be correlated with identity, workload, and data context to expose exploitable cyberattack paths?
• Can security guardrails be embedded earlier in CI/CD pipelines through IaC and policy‑as‑code?
• Can posture insights flow into SOC workflows for faster investigation and response?
• Can risk be continuously prioritized across multicloud environments—not just reported periodically?

How Microsoft aligns with CSPM’s next phase

Frost & Sullivan attributes Microsoft’s leadership in CSPM to its ability to operationalize posture management as part of a broader cloud security platform—aligning with the report’s emphasis on integrating posture with runtime protection, identity, data security, and SecOps workflows across the application lifecycle. These capabilities align with the same governance, prioritization, DevSecOps integration, and lifecycle visibility themes highlighted across the Frost Radar insights above.

Rather than operating as a standalone compliance layer, Microsoft correlates posture data with runtime telemetry and identity signals—integrating findings into developer pipelines and SOC workflows through GitHub, Azure DevOps, and Microsoft Defender XDR. Frost highlights Microsoft’s multicloud visibility across Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP); policy‑as‑code enforcement and CI/CD integration to strengthen shift‑left security; and unified dashboards that carry posture context into investigations and response.

The Frost report also notes Microsoft’s expansion into emerging posture domains—including AI and API posture management—to continuously manage cloud and AI workload risk across the application lifecycle.

Learn more

• Read the Frost & Sullivan Frost Radar™ for Cloud Security Posture Management (2025) to see how CSPM leaders are evaluated—and what capabilities matter most as vendor selection criteria shift toward integrated CNAPP platforms.

• Explore Microsoft cloud security solutions to see how unified posture management, risk prioritization, and protection across the application lifecycle can help reduce cloud risk.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

The post 5 insights from Frost & Sullivan’s 2025 Frost Radar™ for Cloud Security Posture Management appeared first on Microsoft Security Blog.

As organizations expand across multicloud and hybrid environments, they adopt modern architectures built on containers, Kubernetes, microservices, APIs, and AI-powered workloads. This increases both the volume and interconnectedness of security signals. The challenge is no longer identifying individual risks, but determining how vulnerabilities, identities, and data exposures combine across infrastructure and the applications running on it to create real attack paths, and which of these are most critical to fix at the source. Effective risk reduction depends on understanding which of these paths are actually reachable and exploitable in a live environment.

Frost & Sullivan’s 2026 Frost Radar™ for Cloud/Application Runtime Security (CARS) reflects this shift. The report highlights how cloud security is evolving from a collection of posture and workload capabilities into a unified runtime risk operations model, correlating signals across code, cloud, runtime, applications, and security operations center (SOC) workflows to prioritize and reduce risk continuously.

Within this evolving market, Microsoft is positioned as a visionary leader because of the scale of its hyperscale ecosystem, operational breadth of Microsoft Defender for Cloud when integrated with Microsoft Defender XDR, and large customer base. That recognition reflects where the category is heading: toward platforms that connect cloud and application security into one operational view of risk.

Why cloud security is being redefined

The Frost Radar makes a clear point: cloud security is no longer about visibility or compliance alone. It is becoming an operational discipline for reducing risk across the full runtime—from cloud infrastructure to the application code executing on top of it.

Modern environments introduce complexity across:

• Multicloud and hybrid infrastructure.
• Rapid development and continuous deployment.
• Containers, serverless, microservices, and APIs.
• AI-powered workloads, agents, and machine identities.

This complexity exposes the limits of traditional, siloed tools—where cloud posture, workload protection, and application security each live in their own console. Organizations now need platforms that can:

• Correlate posture, runtime, identity, data, and application signals.
• Prioritize risk based on exploitability—not severity alone.
• Integrate security across development, cloud operations, and the SOC.
• Validate whether a vulnerability is actually reachable inside a running application.

This is the shift the report describes: from detecting issues to operationalizing risk reduction across the lifecycle—and across both cloud and application layers.

What distinguishes leading platforms

Frost & Sullivan evaluates providers on growth and innovation—but, more importantly, on how effectively they help organizations manage real risk. Five themes define the next generation of platforms:

1. Platform unification over point solutions.
2. Code-to-cloud-to-SOC integration.
3. Risk prioritization based on exploitability.
4. Correlation across identity, data, cloud, and application context.
5. Expansion into AI-powered workloads.

Taken together, these capabilities represent a move from fragmented visibility to connected, contextual risk management that spans cloud detection and response (CDR) and application detection and response (ADR)—the two halves the market is converging into a single runtime fabric.

How Microsoft help organizations manage real risk

1. Connect signals to prioritize real attack paths

Most security tools surface large volumes of findings across cloud infrastructure and applications, but isolated findings do not reflect how cyberattacks actually happen. Threat actors exploit how misconfigurations, excessive permissions, and data exposure combine to create a path to critical assets.

Microsoft Defender for Cloud correlates posture, identity, data, and runtime signals to identify which risks are truly exploitable. A misconfigured storage resource on its own may appear low priority. However, when it is exposed to the internet, combined with excessive access permissions, and connected to sensitive data, it becomes part of a clear attack path that can be used to compromise the environment.

What this means: Security teams can prioritize real attack paths instead of individual findings, helping to reduce alert fatigue and improve remediation speed and precision.

2. Continuously validate and act on risk across the lifecycle

Security needs to operate continuously across development, runtime, and operations, spanning both the application and the cloud environment it runs in. Defender for Cloud connects insights across code and infrastructure definitions, cloud configuration and runtime context, application and API layers, and security operations workflows through Defender XDR.

A vulnerability identified before deployment can be tracked through to runtime, where it is evaluated in the context of the running environment and surfaced in security operations if it is determined to be exploitable.

What this means: Organizations can continuously validate risk and respond more effectively by connecting development, cloud environments, and security operations.

3. Reducing complexity across fragmented cloud and application security workflows

As environments scale, fragmented tools and workflows make it difficult to understand how risks connect and where to focus first. When cloud infrastructure and application security are managed separately, investigation becomes slower and more manual.

Defender for Cloud helps bring these signals together in a single investigative flow, where risks can be analyzed across configuration, runtime context, application behavior, and identity exposure.

Instead of switching between separate tools, security teams can investigate a single incident across its initial misconfiguration, runtime impact, application behavior, and identity exposure, a more connected experience.

What this means: Security teams can investigate faster, prioritize risk more efficiently, focus on what matters most, and respond more quickly across fragmented cloud and application environments.

What this signals for security leaders

The Frost Radar offers a signal for where cloud security is headed: toward platforms that connect context across cloud and application environments so teams can prioritize the risks most likely to be exploited and reduce exposure faster. Security leaders should now ask:

• Can the platform correlate signals across identity, endpoints, data, cloud, runtime, and applications?
• Does it span the full code-to-cloud lifecycle—and reach into the SOC?
• Can it prioritize risk based on exploitability—not just severity?
• Does it bring cloud detection and response together with application detection and response?
• Can it scale across multicloud and AI environments?

These are the capabilities that define the next generation of cloud and application runtime security.

Bottom line

Frost & Sullivan’s 2026 CARS analysis reinforces a clear shift: cloud security is moving from fragmented visibility to unified, contextual risk management across the entire lifecycle—and across both the cloud and the application layer.

Microsoft’s position as a visionary leader in the Frost Radar reflects this shift—bringing together posture, runtime, identity, endpoints, data, and application signals into a connected platform that helps organizations prioritize and reduce risk continuously.

Learn more

• Read Frost & Sullivan’s 2026 Frost Radar™ for Cloud/Application Runtime Security to see how leading vendors are evaluated—and how the category is shifting toward unified cloud and application runtime risk operations.
• Explore Microsoft cloud security solutions to see how unified posture management, risk prioritization, and protection across the application lifecycle can help reduce cloud risk.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

The post Microsoft named a leader in the Frost Radar for cloud and application runtime security appeared first on Microsoft Security Blog.

Why Microsoft Intune is a leader in endpoint management

The Forrester Wave™ Endpoint Management Platforms, Q2 2026 report includes eight endpoint management platform providers, assessed across current offering, strategy, and customer feedback. Forrester’s assessment of Microsoft reflects how Intune is built. The vision Forrester describes is one built on Microsoft Entra, Microsoft Defender, Windows, and Windows 365 as a connected system, not a collection of adjacent tools. Customers can enforce conditional access, apply compliance policies, and correlate device health signals from a single admin center. That reach is what the cross-platform, cloud-native architecture is built for.

Microsoft Intune offers a strong platform for Windows environments, as customer feedback in the Forrester report notes, and Intune brings management across Windows, macOS, iOS, and Android together in the same admin console. That leadership extends from information worker devices to the frontline worker endpoints that are increasingly critical to business operations. On macOS specifically, Intune uses declarative device management to apply configuration and compliance policies natively, without requiring a separate tool or an additional management layer. Frontline workers on shared kiosks and handheld scanners, and information workers on corporate laptops, fall under the same policies without requiring parallel toolchains.

Endpoint Privilege Management (EPM) received explicit recognition from Forrester, which noted that AI embedded in Intune powers EPM and device onboarding workflows to help IT analyze device data and troubleshoot issues. Elevating or restricting privileges used to require manual review cycles. With AI in that workflow, admins make faster decisions on which requests to approve, deny, or escalate.

Security Copilot in Intune operates directly within the admin experience, operating on the same data and policy surface IT teams already use. From policy configuration, to identifying vulnerabilities, and recommending remediation, agentic assistance handles investigation and triage so admins focus on decisions that need judgment. The recent public preview of the Vulnerability Remediation Agent extends that further, drawing on Microsoft Defender Vulnerability Management to surface CVEs across Intune-managed Windows devices and apps, with Copilot-assisted impact summaries, suggested actions, and step-by-step remediation guidance, all without leaving the console.

These capabilities do not stand alone. Forrester also recognized a superior partner strategy. Our strategy helps connect endpoint management to the service desk, device procurement, and mobile threat defense tools already in the environment. Endpoint management that stops at the device boundary does not close the loop on risk. Intune, with capabilities such as EPM and AI-assisted remediation, brings its partner ecosystem together to help turn Zero Trust from core principles into daily IT practice: apply least privilege, verify explicitly, and enforce through policy to prevent breach.

On licensing, Forrester’s independent customer feedback pointed to the economic value of Microsoft simplified, bundled pricing. Intune is included in Microsoft 365 E3 and Microsoft 365 E5. Starting this month, advanced management solutions of the Intune Suite, including EPM, join those plans automatically. Full details are in our announcement blog: Microsoft 365 adds advanced Microsoft Intune solutions at scale. We continue to invest in areas such as unattended remote access sign-in for Intune Remote Help and automatic updates of required apps for Intune Enterprise Application Management, both of which will roll out for general availability in July 2026, and Intune now supports Red Hat Enterprise Linux 9 and 10.

Governing AI for the future of work

Every organization putting AI to work in practice needs IT and security teams that can say yes confidently: Yes to new device types, yes to modern workloads, and yes to agents running alongside users. Trust and confidence are requirements for safe AI adoption. Microsoft Agent 365 gives organizations a control plane for agents they can trust, and confidence comes from having a platform where identity, device management, and security policy are already connected. A unified platform does not just reduce complexity. It changes what teams are able to do with their time, and what the organization is able to do with AI.

AI agents are now endpoints, and Intune is the policy layer for Agent 365 that governs how they run. Through Microsoft Execution Containers, Intune gates local agent runtime execution directly on Windows devices, requiring isolation with guardrails like filesystem rules so agents run in controlled environments rather than with unchecked access to host systems. Windows 365 for Agents extends that model to cloud PCs provisioned specifically for agent workloads: Each agent Cloud PC is Entra-joined and Intune-managed, configured with the same security, compliance, and policy controls as user devices, so governance scales without new infrastructure.

For shadow AI, Intune is one of three signals alongside Defender and Entra that surface unmanaged agents. Defender discovers agents and adds inline protection; Intune applies policies to block common execution methods and device-level runtime security policies, giving multiple connected signals and one coordinated posture rather than multiple parallel workflows. That is how AI moves from an isolated pilot into the daily practice of how organizations operate, govern and protect AI, not just enable it.

At Microsoft, we believe Forrester’s assessment reflects where the market is heading, where governance, identity, and security work as one system. Each capability is more effective because it operates on shared signal, not siloed data. Microsoft Intune helps organizations reduce complexity, strengthen security, and make AI adoption practical at scale—governed and protected.

Learn more about Microsoft Intune solutions. Bookmark the Microsoft Intune blog to keep up with our expert coverage on endpoint management.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here . 

The post Microsoft a Leader in The Forrester Wave™ for Endpoint Management Platforms appeared first on Microsoft Security Blog.

Frost & Sullivan’s 2026 Frost Radar™ for Cloud-Native Application Protection Platforms (CNAPP) reflects this shift. The report highlights how CNAPP is evolving from a collection of posture and workload capabilities into a unified cloud risk operations platform—one that correlates signals across code, cloud, runtime, and SOC workflows to prioritize and reduce risk continuously. Within this evolving market, Microsoft is positioned among leading CNAPP vendors—reflecting alignment with where the category is heading.

Why CNAPP is being redefined

The Frost Radar makes a clear point: CNAPP is no longer about visibility or compliance—it is becoming an operational platform for reducing risk.

Modern environments introduce complexity across:

• Multicloud and hybrid infrastructure.
• Rapid development and continuous deployment.
• Containers, serverless, and APIs.
• AI-powered workloads.

This complexity exposes the limits of traditional tools.

Organizations now require platforms that can:

• Correlate posture, runtime, identity, and data signals.
• Prioritize risk based on exploitability—not severity alone.
• Integrate security across development and operations.
• Support faster investigation and response.

This is the shift: from detecting issues to operationalizing risk reduction across the application lifecycle.

What distinguishes leading CNAPP platforms

Frost evaluates CNAPP providers based on growth and innovation—but more importantly, on how effectively they help organizations manage risk.

According to the report, five themes define the next generation of platforms:

• Platform unification over point solutions.
• Code-to-cloud-to-SOC integration.
• Risk prioritization based on exploitability.
• Correlation across identity, data, and application context.
• Expansion into AI-powered workloads.

These capabilities represent a shift from fragmented visibility to connected, contextual risk management.

How Microsoft aligns with CNAPP’s next phase

1. Correlating risk across identity, endpoints, data, and cloud

Most security tools surface findings. Fewer connect them meaningfully. Modern attacks exploit the combination of misconfigurations, excessive permissions, and data exposure—not isolated issues. Microsoft Defender for Cloud correlates posture findings with identity, data, and runtime signals—helping surface risks that are exploitable. A misconfigured storage resource on its own may not appear critical. But when combined with excessive access permissions and the presence of sensitive data, it can create a clear attack path.

What this means: Security teams can prioritize real attack paths instead of individual findings, reducing alert fatigue and improving remediation speed and precision.

2. Extending security from code to cloud to SOC

Security must operate continuously across development, runtime, and operations.

Defender for Cloud connects:

• Code and infrastructure-as-code scanning.
• Cloud posture and runtime protection.
• Security operations and response workflows.

A vulnerability identified in infrastructure-as-code before deployment can be tracked through to runtime—where it is validated against real-world behavior and surfaced in security operations if actively exploitable.

What this means: Organizations move from fragmented workflows to continuous risk validation and response across the lifecycle.

3. Reducing complexity across fragmented security workflows

As environments scale, tool sprawl limits visibility and slows response. Microsoft delivers CNAPP capabilities as part of a connected platform—integrating posture management, workload protection, identity, data, and threat detection across multicloud environments. Instead of switching between separate tools, security teams can investigate a single incident across initial misconfiguration, runtime impact, and identity exposure, enabling a more connected experience.

What this means: Security teams can investigate faster, prioritize risk more consistently, and reduce exposure across fragmented cloud environments.

Where security leaders focus next

The Frost Radar offers a signal for where cloud security is headed: toward platforms that connect context across cloud environments so teams can prioritize the risks most likely to be exploited and reduce exposure faster.

Security leaders should now ask:

• Can the platform correlate signals across identity, end points, data, cloud, and runtime?
• Does it span the full code-to-cloud lifecycle?
• Can it prioritize risk based on exploitability—not just severity?
• Does it integrate with SOC workflows for faster response?
• Can it scale across multicloud and AI environments?

These are the capabilities that define the next generation of CNAPP.

Bottom line

Frost & Sullivan’s 2026 CNAPP analysis reinforces a clear shift: Cloud security is moving from fragmented visibility to unified, contextual risk management across the entire lifecycle. Microsoft’s position in the Frost Radar reflects this shift—bringing together posture, runtime, identity, end points, and data signals into a connected platform that helps organizations prioritize and reduce risk continuously.

Learn more

• Read Frost & Sullivan’s 2026 Frost Radar™ for Cloud-Native Application Protection Platforms (CNAPP) to see how leading vendors are evaluated—and how the category is shifting toward unified cloud risk operations platforms.
• Explore Microsoft cloud security solutions to see how unified posture management, risk prioritization, and protection across the application lifecycle can help reduce cloud risk.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Microsoft Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

The post CNAPP evolution: How Microsoft aligns with leading cloud risk management platforms appeared first on Microsoft Security Blog.

What end-to-end security delivers

Based on in-depth interviews with a survey of 362 customers and 11 security decision-makers using Microsoft Security solutions, the Forrester study revealed the impact of consolidating with Microsoft Security. To model the financial impact, Forrester aggregated insights into a single composite organization—a global business-to-business (B2B) company with 10,000 employees—and constructed a TEI framework that quantifies costs, benefits, and risks. Through its study, Forrester projected that an organization would experience the following over three years.

• Up to 30% reduction in the likelihood of a breach
  Integrated protection across identities, endpoints, data, and infrastructure helps prevent attacks before they succeed.

• Up to 25% reduction in cost to remediate remaining attacks
  End-to-end visibility and coordinated response cut the cost of incidents that do occur.

• Up to 23% reduced annual technology spend
  Consolidating point solutions eliminates redundant tooling and the licensing and services that come with it.

• Up to 32% avoided headcount growth
  Automation, integration, and self-service let teams scale without scaling proportionally.

• 20% lower total cost of ownership—$3.0M in TCO savings
  A unified platform reduces the operating drag of running disconnected tools.

Based on interviews, Forrester’s financial analysis found that a composite organization experiences $30.0 million in benefits over three years versus $13.4 million in costs, resulting in a net present value (NPV) of $16.6 million and an ROI of 124%.

Read the full Forrester TEI study for a complete methodology, assumptions, and detailed financial analysis.

Microsoft Security allows us to deploy modern solutions and be on the leading edge of technologies at enterprise scale.” 

—Senior information security officer, NGO

Value beyond what’s measured

The numbers tell part of the story. What we hear from defenders and what the Forrester study reinforces is that the real value of consolidation shows up in the work itself: faster decisions, less friction, more time spent on the cyberthreats that matter. That’s especially true as AI changes both what cyberattackers can do and what defenders can build.

• Security for AI – New solutions like Microsoft Agent 365 with foundations of Microsoft Security, extend identity, governance, and control to AI agents, so customers can adopt them with confidence. 

• AI for Security – Microsoft Security Copilot, together with Microsoft Defender, Entra and Purview provides AI-assisted insights to help defenders investigate, prioritize, and respond to security incidents.

• Security foundations for Zero Trust – Identity and access controls work consistently across the environment, without stitching together multiple vendors. 

• Simplified hiring and skill development – Building on tools security teams already know makes it easier to recruit, onboard, and grow talent. 

• Improved employee experience – Single sign-on and streamlined device onboarding reduce friction, so people can focus on their work. 

I like Microsoft because it’s the only vendor that provides a single view or a single location for all the security needs: cloud posture, endpoint protection management, data loss prevention. You don’t have that many vendors today that have the Swiss Army Knife-style platform.”

—Regional chief information security officer (CISO), engineering

An evolving playbook for the agentic era

An integrated approach to security is especially important as threat complexity grows—some organizations use an average of 45 security tools,² which can increase operational overhead and limit visibility. At the same time, AI-powered threats are accelerating. As human-led AI agents begin to respond to threats, a connected security model becomes even more critical—extending consistent protections not only to traditional surfaces, but also to emerging layers such as prompts, models, plug-ins, and the agents themselves.

Security as the core primitive of the AI stack

As security systems evolve to meet the demands of the agentic era, we see security differently. In the agentic era, security should be the core primitive of the AI stack—woven into and around every layer, ambient, and autonomous, like the AI it protects.

This principle is why we built our platform end-to-end—from identity and endpoint management to data security, compliance, and threat protection—creating an agentic defense platform that unifies the security operations center (SOC) and uses AI to help defenders operate at machine speed with Microsoft Security Copilot. Microsoft Agent 365 extends on this foundation as the control plane for agents, giving security, IT, and business teams the visibility and controls they need to govern agents at scale. Built to work together natively, these aren’t separate products that happen to integrate. They’re a single platform designed for end-to-end security in the age of AI.

Microsoft has done an excellent job developing security agents such as identity and intelligence… Microsoft is innovating as fast as tech startups in the space.” 

—Global CISO, professional services

Built to secure what comes next

The era of agentic AI doesn’t just raise the stakes for security. It changes what security should be. Alongside our customers and our partners, we’re building the future of security. Read the full Forrester Total Economic Impact™ of Microsoft Security study. Explore end-to-end Security for AI to learn how to safeguard your AI platforms, apps, and agents with comprehensive solutions.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

¹Cyber Pulse: An AI Security Report. Microsoft Security Insider.

²Gartner Identifies the Top Cybersecurity Trends for 2025,” March 3, 2025. https://www.gartner.com/en/newsroom/press-releases/2025-03-03-gartner-identifiesthe-top-cybersecuri…

The post New Forrester Total Economic Impact™ study projects a 124% ROI from unifying with Microsoft Security appeared first on Microsoft Security Blog.

In the report, Forrester writes that “Microsoft articulates a compelling vision to build a Frontier approach to security, bringing people and AI together while the platform continuously shields against and disrupts attacks.”

A new frontier for XDR

That recognition reflects how Microsoft sees the next phase of XDR evolution. As cyberattackers use AI to scale and accelerate their campaigns, defenders need more than correlated signals. They need a system that brings together data, people, and workflows so security can operate with the same speed and coordination.  

At Microsoft, XDR is that foundation. It connects signals across identities, endpoints, email, software as a service (SaaS) apps, and cloud workloads into a shared layer of context bringing together the signals, workflows, and actions security runs on. 

That foundation extends directly into how protection and operations are delivered. Microsoft Defender’s native capabilities continuously shield against attacks with built-in, system-level defenses, while embedded agents help triage alerts, hunt for threats, and deliver intelligence in the flow of work. The result is a shift from fragmented response to coordinated, system-level defense—where decisions, actions, and protection move together by default.

Attack disruption is one of the clearest expressions of that vision today. It uses cross-domain signals and AI to stop multi-stage cyberattacks like ransomware and adversary-in-the-middle attacks while they are active and unfolding.

Forrester specifically notes attack disruption in the report, “As well as its roadmap, it (Microsoft) has built unique features, like automatic attack disruption, to help deliver on its vision.”

World-class threat intelligence at the core

Threat intelligence is a brand-new evaluation criterion in this Wave and Microsoft earned the highest possible score. This reflects a broader shift: intelligence is no longer a bolt-on, but fundamental to how modern XDR platforms detect, prioritize, and disrupt cyberattacks.

Microsoft Threat Intelligence is built on a broad vantage point, analyzing 100 trillion signals each day. That intelligence is delivered directly into the analyst experience, which provides context on threat actors: their motivations and tactics appear inside incidents, alongside affected assets, and tied to response actions.

The intelligence is built into detections, attack disruption, hunting, and AI that helps analysts make sense of what they’re seeing. It’s also continuously informed by Microsoft’s global security research teams tracking nation-state actors, ransomware groups, and emerging cyberthreats, which brings frontline insight directly to defenders.

Innovation that reinforces continued leadership

We believe Microsoft’s ranking as a leader in this report is a reflection of the pace of innovation across the Defender portfolio over the past year. Highlights include:

Adaptive defense to contain active attacks: Attack disruption now expands autonomous protection to predict and shield against a threat actor’s next move during active cyberattacks. It acts just in time to defend against common attacker tactics such as group policy objects (GPOs), Safeboot, and identity compromise, with new controls that now include device isolation.

Native protection across cloud, identity, and SIEM: Microsoft delivers differentiated protection across cloud and identity by natively harnessing signals from Azure and Microsoft 365 coverage. Combined with Microsoft Sentinel’s powerful security information and event management (SIEM) and threat hunting capabilities, this foundation goes beyond detection, enabling disruption of attacks directly within the SOC for critical data sources including Amazon Web Services (AWS), Okta, and Proofpoint, fundamentally turning your SIEM into a threat protection solution. 

Microsoft Security Copilot alert triage agent: Security Copilot agents in Defender help security operations center (SOC) teams investigate faster, automate response, and prioritize high-risk cyberthreats. Microsoft recently extended the Security Copilot alert triage agent to cloud and identity, extending assistive and autonomous AI to two of the most critical attack surfaces security teams defend every day. By helping analysts triage alerts faster, surface high-value context, and move more quickly from signal to action, these new capabilities strengthen the SOC where speed and precision matter most. That momentum reinforces that Microsoft received the highest possible scores in both identity detection and cloud detection.

Securing local AI agents: Microsoft recently announced endpoint security for local AI agents at Microsoft Build 2026. Defender helps security teams gain visibility into AI agents running on devices, assess exposure across identities and resources, block malicious activity in real time, and investigate agent activity through Advanced Hunting.

What this recognition means for our customers

Being named a Leader in The Forrester Wave™: Extended Detection and Response Platforms, Q2 2026 reinforces Microsoft’s commitment to helping defenders stay ahead of modern cyberattacks. We believe this recognition reflects the strength of our vision, the breadth of our protection across identities, endpoints, email, cloud, and applications, and our continued investment in bringing people and AI together in the SOC.

As the threat landscape continues to evolve, we remain focused on helping customers investigate faster, respond more effectively, and strengthen their security operations with an integrated platform built for today’s cyberattacks.

Learn more

• Access the full Forrester Wave™ report to read the full analysis behind Microsoft’s positioning as a Leader.
• Learn more about Microsoft Defender.
• Try Microsoft Defender today with a free trial.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here .  

The post ​​Forrester names Microsoft a Leader in the 2026 Extended Detection and Response Platforms Wave™ report appeared first on Microsoft Security Blog.

Microsoft Defender delivers industry-leading Endpoint Detection and Response (EDR), powered by global threat intelligence and built for the scale and speed of today’s attacks. For many of our customers, Defender’s endpoint capabilities are the foundation for a coordinated system of defense that spans endpoints, identities, email, apps, cloud, and data.

Bringing these signals together changes what’s possible. It enables earlier detection, stronger prevention, and capabilities like predictive shielding that help stop attacks before they spread. This is the shift underway in security: from isolated tools to a connected system that can see across the environment, understand what’s changing, and take action in real time. It’s what makes the next generation of AI-driven, agentic security possible and helps defenders stay ahead of threats, not just respond to them.

Sustained innovation to stay ahead of changing threats

Over the past year, Microsoft has introduced key advancements to endpoint protection that have empowered defenders to stay ahead of evolving cyberthreats, including:

Proactive defense during attacks: Attack disruption now expands autonomous protection to predicting and blocking an adversary’s next move during active attacks. It acts just in time to harden against some of the most common attacker tactics, such as group policy objects (GPOs), Safeboot, and identity compromise, to stop lateral movement and defend dynamically.

Custom telemetry: With new custom data collection capabilities, Defender makes it easy for security teams to collect specialized data directly within the Defender portal. It allows organizations to extend their endpoint telemetry beyond the 200+ default signals to support tailored detections and advanced hunting scenarios, such as AMSI for hunting over script content and Kerberos for auth-based and network attacks.

Simplified onboarding: To help security teams onboard simply and securely, we’ve built new Defender deployment tools for Windows and Linux, which handle the entire process for you. Just download a single package and it will dynamically adapt to the operating system, take care of prerequisites, and install the latest version of Defender available as needed for older devices that don’t have it already built in. The Defender deployment tools eliminate friction, automate tricky steps, and provide predictability throughout the onboarding journey.

Sovereign-ready protection: Defender enables customers to meet data storage and privacy needs while operating under public, sovereign, hybrid, or disconnected models. Its multi‑tenant architecture enables organizations to balance centralized security visibility with localized control over their data, reflecting a shift from basic compliance to operational governance.

End-to-end security for local AI agents: Microsoft announced agentic endpoint security as a part of A365 to discover, govern, and block AI agents such as OpenClaw and previously unseen applications running locally on endpoints.

Innovations such as these represent the continued commitment to drive the next wave of innovation. Stay tuned for more exciting advancements at Microsoft Build on June 2^nd.

Learn more

If you’re not yet taking advantage of Microsoft’s leading endpoint security solution, visit Microsoft Defender for Endpoint and start a free trial today to evaluate our leading endpoint protection platform. 

Are you a regular user of Microsoft Defender for Endpoint? Share your insights on Microsoft Defender for Endpoint and get rewarded with a $25 gift card on Gartner Peer Insights™.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

Gartner, Magic Quadrant for Endpoint Protection, Deepak Mishra, Evgeny Mirolyubov, Nikul Patel, 26 May 2026.

Gartner is a registered trademark and service mark and Magic Quadrant is a registered trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved. 

This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from.

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. 

The post Microsoft is named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection appeared first on Microsoft Security Blog.