That pattern continued as defenders embraced automation and AI to manage expanding digital estates. SOCs were often early scale adopters—using machine learning to reduce noise, improve visibility, and respond faster across growing environments. Cyberattackers became more targeted and multistage, moving deliberately across identities, endpoints, cloud resources, and email, where detection was hardest. Success increasingly depended on moving fast enough to act before analysts could connect the dots. Even with this progress, security operations (SecOps) still feel asymmetrical: threat actors only need to be right once, while defenders are judged by every miss. If defense depends on human intervention to begin, defense will always feel asymmetrical.

To change the outcome, SOCs must change how defense itself works. This is the agentic SOC: where security delivers adaptive, autonomous defense, freeing defenders for strategic, high‑impact work. In this series, we’ll break down what that shift requires, what early experimentation has taught us, and where organizations can start today. Read more about how some organizations moving toward the agentic SOC and access a foundational roadmap for this transformation in our new whitepaper, The agentic SOC: Your teammate for tomorrow, today.

What we mean by “the agentic SOC”

At its core, the agentic SOC is an operating model that shifts security from reacting to incidents to anticipating how cyberattackers move—and actively reshaping the environment to cut off their paths.

It brings together a platform that can increasingly defend itself through built-in autonomous defense, with AI agents working alongside humans to accelerate investigation, prioritization, and action—so teams spend less time on execution and more time on judgment, risk, and the decisions that matter.

How does that change day-to-day work? Imagine a credential theft attempt. Built-in defenses automatically lock the affected account and isolate the compromised device within seconds—before lateral movement can begin. At the same time, an AI agent initiates an investigation, hunting for related activity across identity, endpoint, email, and cloud signals, and correlating everything into a single view.

When an analyst opens their queue, the “noise” of overwhelming alerts is already gone. Evidence has been pre-assembled. Likely next steps are suggested. The analyst can start right away by answering higher impact questions: Is this part of a broader campaign? Should this authentication method be hardened? Are there related techniques this cyberattacker commonly uses that the environment is still exposed to?

In today’s SOC, we see that sequence often takes hours—and the proactive improvement is very limited, if it ever happens; there’s simply not enough time. In an agentic SOC, it happens in minutes, and teams can spend the time they’ve gained on deeper investigation, systemic hardening, and reducing the likelihood of repeat cyberattacks.

A layered model for the agentic SOC

This model works because an agentic SOC is built on two distinct, but interdependent layers. The first is an underlying threat protection platform that has fundamentally evolved how cyberattacks are defended against and disrupted. High confidence cyberthreats are handled automatically through deterministic, policy-bound controls built directly into the platform. Known attack patterns are blocked in real time—without deliberation or creativity—shielding the environment from machine-speed cyberthreats before scarce human attention or token intensive reasoning is required. This disruption layer is not optional; it is the prerequisite that makes an agentic SOC safe, scalable, and sustainable.

The second layer operates at the operational level, where agents take on tough analysis and correlation work to dramatically increase the leverage of security teams and shift focus from uncovering insight to acting on it. These agents reason over evidence, coordinate investigations, orchestrate response across domains, and learn continuously from outcomes. Over time, they help identify recurring attack paths, surface gaps in posture, and recommend changes that make the environment harder to exploit—not just faster to respond.

Together, they transform the SOC from a reactive workflow engine into a resilient system.

What’s real now, and why there’s reason for optimism

The optimism around our view of the agentic SOC comes from operational discipline and proven, real-world impact. Autonomous attack disruption has been operating at scale for years.

Attacks like ransomware are disrupted in an average of three minutes, and tens of thousands of attacks are contained every month by isolating compromised users and devices before lateral movement can take hold. This all done with a 99.99% confidence rating, so SOC teams can trust in its efficacy.

Building on that proven foundation, newer capabilities like predictive shielding extend autonomous defense further—anticipating how cyberattacks are likely to progress and proactively restricting high-risk paths or assets during an intrusion.

Together, these system-level protections show that platforms can safely intervene earlier in the cyberattack chain without introducing unnecessary disruption.

Agentic capabilities are also being similarly scoped. Internally, we’ve been testing task agents for triage and investigations under our expert supervision of our defenders. In live environments, these agents automate 75% of phishing and malware investigations. We’ve also tested agents on more complex analytical tasks, such as assessing exposure to specific vulnerabilities—work that once required a full day of engineering effort and can now be completed in less than an hour by an agent.

How day-to-day SOC work will change in the future

In an agentic SOC, the center of gravity will change for roles like an analyst. Fewer analysts are pulled into firefighting; more time is spent investigating how the organization is being targeted and what steps can be taken to reduce exposure. Within this new operating model, security teams will be freed to evolve the team structure and their day-to-day responsibilities.

Agentic systems increase demand for oversight, tuning, and governance. Detection and response engineering becomes more central, as teams design policies, confidence thresholds, and escalation paths. New roles emerge around supervising outcomes and refining system behavior over time.

Expertise becomes more valuable, not less. Judgment, context, and institutional knowledge are no longer consumed by repetitive tasks—they shape how the SOC operates at scale. And skilled practitioners closer to strategy, quality, and accountability.

To make this shift tangible, here’s how key roles are evolving:

• Analysts: from triaging alerts to supervising outcomes. Analysts validate agent‑led investigations, determine when deeper inquiry is needed, focus on ambiguous cases, and guide system learning over time.
• Detection engineers: from writing rules to teaching the system what matters. Engineers decide which signals are trustworthy, add the right context, and set confidence thresholds so detections can be acted on automatically—without human review every time.
• Threat hunters: from manual queries to hypothesis-driven exploration. Hunters use AI to surface anomalies and focus on creative investigation and adversary simulation.
• SOC leadership: from managing queues to orchestrating autonomy. Leaders define automation policies, oversee governance, and align AI actions with business risk.

Each shift reflects a broader truth: in the agentic SOC, people don’t do less—they do more of what matters.

The agentic SOC journey

This is a significant change in how security teams operate, and it doesn’t happen overnight. Based on our own experience, we’ve outlined a maturity model that shows how organizations can progress toward an agentic SOC over time.

Organizations begin by establishing a trusted foundation that unifies security tooling, enables the deployment of autonomous defense and begins unifying security signal in earnest. From there, they introduce agents to take on bounded, high-volume work under human supervision, learning where automation adds leverage and where judgment still matters most. Over time, as confidence, governance, and operational discipline mature, agents expand from assisting individual workflows to coordinating broader security outcomes. At every stage, progress is measured not by how much work is automated, but by how effectively human expertise is amplified.

SOC 1—Unify your platform foundation

The shift begins with a unified security platform that enables autonomous defense. Deterministic, policy-bound protections stop high confidence cyberthreats automatically—removing urgency, reducing blast radius, and eliminating the constant context switching that slows human response. By integrating signals across identity, endpoints, and cloud, defenders gain a shared view of cyberattacks instead of stitching evidence together across tools. This foundation is what makes cross-domain action possible—and separates experimental automation from production-ready operations.

SOC 2—Accelerate operations with generative AI and task agents

With urgency reduced, generative AI changes how work flows through the SOC. Instead of pushing alerts forward, AI assembles context, synthesizes signals across domains, and produces coherent investigations. Repetitive, high-volume tasks like triage, correlation, and basic investigation are absorbed by the system, allowing analysts to focus on higher impact decisions. This stage establishes new operational patterns where humans and AI work together—accelerating response while preserving judgment and accountability.

SOC 3—Deploy agentic automation

As trust grows, agents move from assistance to action. Specialized agents autonomously orchestrate specific tasks—containing compromised identities, isolating devices, or remediating reported phishing—while humans shift into supervisory roles. Over time, agents help identify patterns, anticipate attack paths, and optimize defenses across the environment. Security teams spend less time managing queues and more time shaping posture, risk, and outcomes. These shifts compound across all three stages.

What comes next for the SOC evolution?

We believe the strongest agentic SOC models will begin with autonomous defense—deterministic, policy‑bound actions that safely stop what is already known to be dangerous at machine speed. That foundation removes urgency, noise, and latency from security operations.

Additionally, agents and humans work differently. Agents assemble context, coordinate remediation, and optimize how the SOC operates. Humans provide intent, judgment, and accountability—turning time saved into smarter, more strategic security outcomes.

This is the first of a series of posts that will explore what makes the agentic SOC model real: the platform foundations required to defend autonomously, the governance and trust mechanisms that keep autonomy safe, and the adoption journey organizations take to get there. Some organizations are already rebuilding their businesses around AI, a new class of Frontier Firms. Read more about how they’re making their move toward the agentic SOC and access a foundational roadmap for this transformation in our new whitepaper, The agentic SOC: Your teammate for tomorrow, today.

Learn more

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity. 

The post The agentic SOC—Rethinking SecOps for the next decade appeared first on Microsoft Security Blog.

The forces pushing modern SOC operations to a breaking point

The report surfaces five specific operational pressures shaping the modern SOC—spanning fragmentation, manual toil, signal overload, business-level risk exposure, and detection bias. Separately, each data point is striking. But taken together, they reveal a more consequential reality: analysts spend their time stitching context across consoles and working through endless queues, while real cyberattacks move in parallel. When investigations stall and alerts go untriaged, missed signals don’t just hurt metrics—they create the conditions for preventable compromises. Let’s take a closer look at each of the five issues:

1. Fragmentation

Fragmented tools and disconnected data force analysts to pivot across an average of 10.9 consoles¹ and manually reconstruct context, slowing investigations and increasing the likelihood of missed signals. These gaps compound when only about 59% of tools push data to the security information and event management (SIEM), leaving most SOCs manually ingesting data and operating with incomplete visibility.

2. Manual toil

Manual, repetitive data work consumes an outsized share of analyst capacity, with 66% of SOCs losing 20% of their week to aggregation and correlation—an operational drain that delays investigations, suppresses threat hunting, and weakens the SOC’s ability to reduce real risk.

3. Security signal overload

Surging alert volumes bury analysts in noise with an estimated 46% of alerts proving false positives and 42% going uninvestigated, overwhelming capacity, driving fatigue, and increasing the likelihood real cyberthreats slip through unnoticed.

4. Operational gaps

Operational gaps are directly translating into business disrupting incidents, with 91% of security leaders reporting serious events and more than half experiencing five or more in the past year—exposing organizations to financial loss, downtime, and reputational damage.

5. Detection bias

Detection bias keeps SOCs focused on tuning alerts for familiar cyberthreats—52% of positive alerts map to known vulnerabilities—leaving dangerous blind spots for emerging tactics, techniques, and procedures (TTPs). This reactive posture slows proactive threat hunting and weakens readiness for novel attacks even as 75% of security leaders worry the SOC is losing pace with new cyberthreats.

Read the full report for the deeper story, including chief information security officer (CISO)-level takeaways, expanded data, and the complete analysis behind each operational pressure, as well as insights that can help security professionals strengthen their strategy and improve real world SOC outcomes.

What CISOs can do now to strengthen resilience

Security leaders have a clear path to easing today’s operational strain: unify the environment, automate what slows teams down, and elevate identity and endpoint as a single control plane. The shift is already underway as forward-leaning organizations focus on high-impact wins—automating routine lookups, reducing noise, streamlining triage, and eliminating the fragmentation and manual toil that drain analyst capacity. Identity remains the most critical failure point, and leaders increasingly view unified identity to endpoint protection as foundational to reducing exposure and restoring defender agility. And as environments unify, the strength of the underlying graph and data lake becomes essential for connecting signals at scale and accelerating every defender workflow.

As AI matures, leaders are also looking for governable, customizable approaches—not black box automation. They want AI agents they can shape to their environment, integrate deeply with their SIEM, and extend across cloud, identity, and on-premises signals. This mindset reflects a broader operational shift: modern key performance indicators (KPIs) will improve only when tools, workflows, and investigations are unified, and automation frees analysts for higher value work.

The report details a roadmap for CISOs that emphasizes unifying signals, embedding AI into core workflows, and strengthening identity as the primary control point for reducing risk. It shows how leaders can turn operational friction into strategic momentum by consolidating tools, automating routine investigation steps, elevating analysts to higher value work, and preparing their SOCs for a future defined by integrated visibility, adaptive defenses, and AI-assisted decision making.

Chart your path forward

The pressures facing today’s SOCs are real, but the path forward is increasingly clear. As this report shows, organizations that take these steps aren’t just reducing operational friction—they’re building a stronger foundation for rapid detection, decisive response, and long-term readiness. Read State of the SOC—Unify Now or Pay Later for deeper guidance, expanded findings, and a phased roadmap that can help security professionals chart the next era of their SOC evolution.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

¹The study, commissioned by Microsoft, was conducted by Omdia from June 25, 2025, to July 23, 2025. Survey respondents (N=300) included security professionals responsible for SOC operations at mid-market and enterprise organizations (more than 750 employees) across the United States, United Kingdom, and Australia and New Zealand. All statistics included in this post are from the study.

The post Unify now or pay later: New research exposes the operational cost of a fragmented SOC appeared first on Microsoft Security Blog.

Build a unified, future-proof foundation

As organizations step into the agentic AI era, the priority shifts to establishing a security foundation that can absorb rapid change without adding operational drag. That requires an architecture built for flexibility—one that brings security data, analytics, and response capabilities together rather than scattering them across aging infrastructure. A unified, cloud‑native platform gives security teams the structural advantage of consistent visibility, elastic scale, and a single source of truth for both human analysts and AI systems. By consolidating core functions into one environment, leaders can modernize the SOC in a deliberate, sustainable way while positioning their teams to capitalize on emerging AI‑powered security capabilities.

Accelerate detection and response with AI

As cyberthreats evolve faster than traditional workflows can manage, the advantage shifts to SOCs that can elevate detection and response with adaptive automation. Modern platforms augment analysts with real‑time correlation, automated investigation, and adaptive orchestration that reduces manual steps and shortens exposure windows. By standardizing access to high‑quality security data and enabling agents to act on that context, organizations improve precision, reduce noise, and transition from reactive triage to continuous, intelligence‑driven response. This shift not only accelerates outcomes but frees teams to focus on higher‑value threat hunting and strategic risk reduction.

Maximize return on investment and accelerate time to value

Driving measurable value is now a leadership imperative, and modern SIEM platforms must deliver results without protracted deployments or heavy reliance on specialized expertise. AI-ready solutions reduce onboarding friction through prebuilt connectors, embedded analytics, and turnkey content that produce meaningful detection coverage within hours—not months.

“Microsoft Sentinel’s ease of use means we can go ahead and deploy our solutions much faster. It means we can get insights into how things are operating more quickly.”

—Director of IT in the healthcare industry

By consolidating core workflows into a single environment, organizations avoid the hidden costs of operating multiple tools and shorten the path from implementation to impact. As adaptive AI optimizes configurations, prioritizes coverage gaps, and streamlines operations, security leaders gain a clearer return on investment while reallocating resources toward strategic risk reduction instead of maintenance and integration work. AI‑ready solutions reduce onboarding friction through pre‑built connectors, embedded analytics, and turnkey content that produce meaningful detection coverage within hours—not months.

Turning guidance into action with Microsoft

The guide also outlines where Microsoft Sentinel delivers meaningful advantages for modern SOC leaders—from its cloud‑native scale and unified data foundation to integrated SIEM, security orchestration, automation, and response (SOAR), extended detection and response (XDR), and advanced analytics in a single AI‑ready platform. It includes practical tips for evaluating vendors, highlighting the importance of unification, cloud‑native elasticity, and avoiding fragmented add‑ons that drive hidden costs. Together, the three essentials—building a unified foundation, accelerating detection and response with AI, and maximizing return on investment through rapid time to value—establish a clear roadmap for modernizing security operations.

Read The strategic SIEM buyer’s guide for the full analysis, vendor considerations, and detailed guidance on selecting an AI‑ready platform for the agentic era.

Learn more

Learn more about Microsoft Sentinel or discover more about Microsoft Unified SecOps.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

The post The strategic SIEM buyer’s guide: Choosing an AI-ready platform for the agentic era appeared first on Microsoft Security Blog.

In our new e-book, 3 reasons point solutions are holding you back, we share how a unified, AI-ready platform can transform your security operations to help keep your organization safe. Read on to learn more about the key concepts in our new e-book.

What you’ll learn:

1. The hidden costs of fragmented tools: How disconnected solutions inflate operational costs, slow investigations, and prevent AI from delivering its full potential.
2. The power of unification: Why a unified platform delivers full-spectrum visibility, predictive defense, and agentic assistance—helping teams respond faster and more effectively.
3. Real-world results: See how organizations are reducing breach exposure, cutting incident response effort, and lowering costs through consolidation.

Rethinking security for the AI era

AI is transforming cybersecurity for both defenders and threat actors. But disconnected tools prevent defenders from seeing the full picture and block AI from delivering its full value. Without unified data and context, AI models can’t detect subtle patterns or anticipate evolving cyberthreats. Imagine a security approach that doesn’t just react but predicts—one that turns fragmented signals into actionable insight. An AI-ready platform unifies security data into a scalable, intelligent data lake enriched with threat intelligence and mapped into a living security graph. In our e-book, we explore how this shift transforms security from a patchwork of disparate tools to a strategic advantage for organizations—delivering clarity, speed, and resilience in ways point solutions simply can’t match.

The e-book shares more about how AI-ready unity includes the ability to:

• Predict attack paths and prevent breaches with exposure management.
• Rapidly remediate with AI-powered protection and improved mean time to resolution (MTTR).
• Detect emerging cyberthreats using cyberattacker-level intelligence.
• Continuously optimize security operations center (SOC) operations with centralized data and advanced analytics.

Measurable benefits of a unified security platform

By moving away from fragmented portfolios, organizations see dramatic improvements in efficiency and resilience. Instead of drowning in alert triage, security teams can redirect their focus to proactive remediation and prevention. And AI-powered detection shortens containment from hours to minutes—often halting ransomware before encryption begins.

Stay ahead of accelerating cyberthreats

Microsoft Defender, powered by Microsoft Sentinel, unifies prevention, detection, and response across ransomware, phishing, malware, and other advanced cyberthreats. Together with Microsoft Security Copilot, the stack brings AI-powered guidance and autonomous protection to investigations and response.

The e-book shares more about the key benefits, including:

• Unified foundation: Security information and event management (SIEM), data lake, and graph in one platform.
• Proactive resilience: Continuous exposure management and prioritized prevention.
• AI-accelerated defense: Generative guidance and autonomous response.
• Operational efficiency: Simplified onboarding, connectors, and workflows.
• Strategic value: Lower costs through consolidation and higher return on investment.

Ready to move beyond point solutions?

Download the 3 reasons point solutions are holding you back e-book and discover how a unified, AI-ready platform can help your team stay ahead of cyberthreats and prepare for the future.

Envision a future where defenders and AI agents work together. Hear Charlie Bell, Executive Vice President of Microsoft Security, and Vasu Jakkal, Corporate Vice President of Microsoft Security Business, share how leading organizations are securing AI innovation at scale—plus get demos and actionable steps. Watch now!

Learn more

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity. 

The post New Microsoft e-book: 3 reasons point solutions are holding you back appeared first on Microsoft Security Blog.

Ten years ago, as threat actors began following our growing customer base to the Microsoft Cloud, I founded the Microsoft Threat Intelligence Center (MSTIC), which focuses deeply on addressing this type of cyberattacker. One of the first things we learned was that to find threat actors you need to think like them. That’s what led me to begin thinking in graphs. Any infrastructure you need to defend is conceptually a directed graph of credentials, dependencies, entitlements, and more. Cyberattackers find footholds, pivot within infrastructure, and abuse entitlements and secrets to expand further. Software systems and online services are built from components—many of these components have logs of what’s happening, but this results in a lot of siloed logs. To see what a threat actor is doing, you have to reconstruct that red thread of activity from logs. Then, from those logs you can create a graph. 

By adopting this same graph-based thinking, we put ourselves on more even footing with cyberattackers. But we don’t really want to be on even footing. We want to retake the advantage for ourselves. That’s why it’s also important to keep our best practices up, making sure our infrastructure is well managed, maintaining a well-educated team of analysts on our team, and collaborating with our competitors on defense. All together, this is of course a lot of work. It’s easy to see why some security professionals out there see the physics of defense as being against them. And in some ways, it has been. So, let’s change that.

We’ve got more data and more advanced tools at our fingertips than ever before, including some very good AI. Let’s take a look at each of these best practices, as well as how we can use our new tools to reduce the cost and effort involved in maintaining the advantage against threat actors.

The defense benefits of attack graphs

Most defenders today live in a tabular, relational world of data and the databases in which that data lives. At Microsoft, this is Azure Data Explorer databases queried using Kusto Query Language (KQL). And we know that if we can represent data in other ways, like in a graph, we can suddenly look at our data in ways that are difficult to do in traditional databases. This is a chief reason why threat actors build attack graphs of their targets. The graph lets them more easily see the many ways they can break into the target’s network, pivot to the things they need, get the credentials they need, and exploit things within the blast radius those credentials give them. That’s why it’s important to build a great attack graph for all the things that you must defend and equip your defenders with it. With a graph, you can ask questions like “what’s the blast radius of this kind of access?”, “can I get from identity A to infrastructure B?”, or “if a threat actor has taken over this specific node, can they get to our crown jewels?” With an attack graph in hand, those questions become easier to answer.

Relational tables and graphs are just two of the ways to represent security data. We’re currently working on broadening those ways to also include anomalies and vectors over time. All together, these four data representations are what I refer to as the algebras of defense. As a defender equipped with these algebras, you can easily represent security data in multiple different ways. You can ask it questions in domains they are highly specialized in answering and get the answers you need from your security data in ways that drive you very quickly to the outcomes you need. What’s really exciting about this concept is that the benefits don’t just extend to your security team. Your advanced AI can use them to similar effect, turning each algebra into a new way to detect, for instance, what constitutes an anomaly and what does not. It’s giving AI the ability to use the same intuitions that human experts use but in a much more highly dimensional space.

Building difficult terrain through proper cyber defense hygiene

A well-managed target is a harder target to attack. Defenders that excel in security don’t just react to cyberthreats, they proactively shape their environments to be inhospitable to bad actors. This begins with investing in preventative controls. Rather than waiting for incidents to occur, successful defenders deploy technologies and processes that anticipate and block cyberattacks before they materialize. This includes endpoint protection, network segmentation, behavioral analytics, threat modeling, and more.

It’s also important to deprecate legacy systems as they often harbor vulnerabilities that cyberattackers exploit. By retiring outdated solutions and replacing them with modern, secure alternatives, organizations reduce their exposure and simplify their defense posture. The same goes for entitlement management. By continuously reviewing who has what access, organizations can help prevent lateral threat actor movement.

You’ll also want to make sure you’re conducting top-tier asset management. You can’t protect what you don’t know exists. Maintaining an accurate, real-time inventory of devices, applications, and identities helps defenders monitor, patch, and secure every component of the environment. Removing orphaned elements goes hand-in-hand with this concept. Unused accounts, forgotten servers, and abandoned cloud resources—all of these remnants of past projects can easily become low-hanging fruit for cyberattackers.

You should invest time and effort into creating difficult terrain for attackers, making it harder for them to traverse your networks. Phishing-resistant multifactor authentication is a way to do this. So is not just having strong identity management, but requiring it to be used from expected, well-defined places on the network. For example, forcing admin access to be used from hardened, pre-identified locations.

Layered defenses with multiple controls working in concert help quiet your network. By reducing randomness and enforcing predictability, you can eliminate much of the noise that threat actors rely on to hide, ultimately removing entire classes of threat actors from the equation.

Invest in internal expertise and collaborate with others who do the same

While preventative controls are essential for raising the cost of cyberattacks, no defense is impenetrable. That’s why remediation remains a critical pillar of cyber hygiene. Organizations must be equipped to both block threats and to detect and respond to those that slip through.

This begins with data visibility. Security teams need to be on top of their telemetry so they can spot anomalies quickly. And you’ll need a team of educated analysts who understand cyberattacker behavior and can distinguish signal from noise. With their expertise, you’ll be better equipped to identify subtle indicators of compromise and initiate swift, effective remediation efforts.

It’s also important to work on cyber defense together with organizations that you otherwise view as your competitors. And, thankfully, here’s where I get to impart a bit of good news. Over the past decade, the tech industry has undergone a profound shift in how it approaches this concept. As organizations, we’re now way better about taking news about the security events happening to us to trusted spaces and talking about them in trusted ways than we were 10 years ago. What was once taboo, like the sharing of breach details with competitors, is now a mainstay of our collective defense. This cultural shift has led to the rise of trusted security forums, cross-industry intelligence sharing, and joint incident response efforts, allowing all of our defenders to learn from each other and respond faster to emerging threats.

Optimizing the defense curve

We now operate in a world where vast, high-fidelity data sets and advanced AI systems can amplify our reach, sharpen our detection, and accelerate our response. By embracing graph-based thinking, cultivating difficult terrain, and investing in collaborative intelligence, defenders can fundamentally shift the physics of defense beneath their would-be attackers’ feet.

With the algebras of defense, defenders can interrogate their environments in ways that were previously impossible, surfacing insights that drive proactive, precision-based security. And with AI as a partner, we can turn complexity into clarity, noise into signal, and partner swift remediations with anticipation. By rewriting the physics of defense, we can reclaim the advantage and redefine what it means to be secure.

Microsoft
Deputy CISOs

To hear more from Microsoft Deputy CISOs, check out the OCISO blog series:

To stay on top of important security industry updates, explore resources specifically designed for CISOs, and learn best practices for improving your organization’s security posture, join the Microsoft CISO Digest distribution list.

Learn more

To hear more from Microsoft Deputy CISOs, check out the OCISO blog series. To stay on top of important security industry updates, explore resources specifically designed for CISOs and best practices for improving your organization’s security posture  join the Microsoft CISO Digest (sent every two months) distribution list, go to this webpage.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

The post Changing the physics of cyber defense appeared first on Microsoft Security Blog.

To help security teams better face the growing challenges, generative AI offers transformative capabilities that can bridge critical gaps. In a newly released e-book from Microsoft, we share multiple scenarios that showcase how Microsoft Security Copilot, powered by generative AI, can empower security analysts, accelerate incident response, and improve operational inefficiencies. Sign up to get the e-book, From Alert Fatigue to Proactive Defense: What Generative AI Can Do for Your SOC, and learn how AI can transform organizations like yours today.

Enhance every stage of the security operations workflow

The teams we talk to mention how generative AI is dramatically improving the efficacy and efficiency of their security operations (SecOps)—it helps analysts triage alerts by correlating threat intelligence and surfacing related activity that might not trigger a traditional alert. It generates rapid incident summaries so teams can get started faster, guides investigations with step-by-step context and evidence, and automates routine response tasks like containment and remediation through AI-powered playbooks. Additionally, generative AI supports proactive threat hunting by suggesting queries that uncover lateral movement or privilege escalation, and streamlines reporting by producing clear, audience-ready summaries for stakeholders, all of which means SOC teams spend less time on manual, repetitive work and more time focusing on high-impact cyberthreats—ultimately allowing for faster, smarter, and more resilient security operations.

Microsoft Security Copilot helps organizations address critical challenges of scale, complexity, and inefficiencies—as well as streamlining investigations, simplifying reporting, and more. It gives analysts a good idea of where to start, how to prioritize, and improves analyst confidence with actionable insights. By embedding generative AI into existing workflows, SOCs can operationalize and contextualize security data in ways never possible before—delivering guided responses, accelerating investigations, and transforming complex data into clear, actionable insights for both technical teams and business leaders.

Organizations using Security Copilot report a 30% reduction in mean time to resolution (MTTR).⁵

How Security Copilot delivers real value in everyday SOC tasks

The e-book spans four chapters that cover key scenarios, including investigation and response, AI-powered analysis, proactive threat hunting, and simplified security reporting. Each chapter presents the core challenges faced by today’s SOC teams, how generative AI accelerates and improves outcomes, and measurable, real-world results that show improvements for security analysts—like reduced noise, faster critical insights, identified cyberattack paths, and audience-ready summaries generated by AI. For example, when an analyst receives alerts about unusual login activity from multiple geolocations targeting a high-privilege account, generative AI consolidates related alerts, prioritizes the incident, and provides actionable summaries, allowing for faster triage and confident response.

Included in the e-book are summaries of AI in action, with step-by-step explanations of how Copilot is:

• Guiding analysts to confident, rapid decisions—helping SOC analysts quickly triage alerts, summarize incidents, recommend precise actions, and guide responses, for faster, more confident threat containment.
• Turning complex scripts into clear insights—supporting SOC analysts to decode malicious scripts, correlate threat intelligence, and automate investigations.
• Anticipating cyberthreats before they escalate—empowering threat hunters to quickly query indicators of compromise (IOCs), uncover hidden cyberattack patterns, and take proactive actions, for more predictive defense against evolving cyberthreats.
• Simplifying security reporting for analysts–letting SOC analysts to instantly consolidate data, capture critical details, and produce clear, audience-ready reports.

We analyze results about 60% to 70% faster with Security Copilot. It plays a central role in our ability to speed up threat analyses and activities, fundamentally reducing the risks for our IT landscape worldwide.

—Norbert Vetter, Chief Information Security Officer, TÜV SÜD

The future of SecOps is here with generative AI

For security leaders looking to improve their response time and better support their teams, generative AI isn’t just a vision for the future—it’s available today. From triage to reporting, generative AI–powered assistants enhance every stage of the SecOps workflow—delivering faster responses, stronger defenses, and more confident decision-making. At the forefront of this transformation is Microsoft Security Copilot, which unifies tools, operationalizes threat intelligence, and guides analysts through complex workflows, letting SOC teams adapt to evolving cyberthreats with ease. Sign up to access “What Generative AI Can Do for Your SOC” today and learn how your team can move from overwhelmed to empowered, tackling today’s challenges with confidence and preparing for tomorrow’s uncertainties. Or read more about Microsoft AI-powered unified security operations and how they can move your team from overwhelmed to empowered.

Learn more with Microsoft Security

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

Microsoft Ignite

Join us at Microsoft Ignite to explore the latest solutions for securing AI. Connect with industry leaders, innovators, and peers shaping what’s next.

San Francisco on November 17-21
Online (free) on November 18-20

Register now

¹ “Generative AI and Security Operations Center Productivity: Evidence from Live Operations,” page 2, Microsoft, November 2024

² Cybersecurity Workforce Study: How the Economy, Skills Gap, and Artificial Intelligence Are Challenging the Global Cybersecurity Workforce 2023,” page 20, ISC2, 2023

³ The Unified Security Platform Era Is Here,” page 7, Microsoft, 2024

⁴ “Global Security Operations Center Study Results,” page 6, IBM, March 2023

⁵ “Generative AI and Security Operations Center Productivity: Evidence from Live Operations,” page 2, Microsoft, November 2024 

The post ​​Learn what generative AI can do for your security operations center appeared first on Microsoft Security Blog.

Strengthening cyber defense in the age of agentic AI with Microsoft Sentinel

Microsoft Sentinel has now evolved beyond a cloud-native SIEM into a unified, AI-powered security platform, connecting analytics and context across ecosystems at scale. With a centralized, purpose-built security data lake and graph capabilities, organizations gain deeper insights and richer context for more effective cyberthreat detection and investigation. The Model Context Protocol (MCP) server and agentic tools make data agent-ready, paving the way for seamless integration with autonomous security agents and unlocking new possibilities for proactive defense.

We realized that we needed to uplift our capability in the security operations center. We wanted a platform that could help us face the challenges of offensive use of AI so we could defend at machine speed.

—David Boda, Chief Security and Resilience Officer, Nationwide

Optimizing costs and coverage

Now generally available, the Microsoft Sentinel data lake serves as the foundation for modern, AI-powered security operations. Purpose-built for security, it features a cloud-native architecture that centralizes all security data from more than 350 sources across platforms and clouds. The Microsoft Sentinel data lake simplifies data management, eliminating silos, and enables cost-effective long-term retention, empowering organizations to maintain strong security postures while optimizing budget. By unifying historical and real-time security data, the data lake helps AI agents and automation perform advanced analytics, detect anomalies, and execute autonomous cyberthreat responses with precision and speed.

To further help organizations optimize their security operations, Microsoft Sentinel has native features like:

• SOC optimization helps security teams improve coverage, reduce costs, and streamline operations by providing AI-powered recommendations on data usage, cyberthreat detection gaps, and analytics efficiency. These insights empower defenders to make smarter decisions and maximize return on investment.
• New cost management features in preview help customers with cost predictability, billing transparency, and operational efficiency.

Accelerating the SOC with advanced analytics and AI

Microsoft Sentinel is transforming security operations with advanced analytics, agentic AI, and MCP server. Microsoft Sentinel data lake centralizes security data from hundreds of sources, enabling real-time detection, contextual analysis, and autonomous response. The integration of agentic AI and Microsoft Security Copilot allows defenders to automate investigations, correlate complex signals, and respond to cyberthreats at machine speed. The MCP server further enhances these capabilities by making security data agent-ready. Support for tools like Kusto Query Language (KQL) queries, Spark notebooks, and machine learning models within the Microsoft Sentinel data lake empowers agentic systems to continuously learn, adapt, and act on emerging cyberthreats, driving smarter, faster, and more contextual security operations across the SOC. This AI-powered approach reduces alert fatigue and accelerates decision-making, strengthening security posture across the SOC.

Together, these capabilities empower SOC teams to operate at the speed of AI, reduce noise, and focus on high-impact investigations, driving clarity, efficiency, and resilience across the security lifecycle.

Empowering defenders with industry-leading SIEM

Microsoft Sentinel enhances security operations by unifying SIEM, security orchestration, automation, and response (SOAR), user and entity behavior analytics (UEBA), and threat intelligence into a single, integrated experience. With full integration into the Microsoft Defender portal, Microsoft Sentinel delivers a consolidated view for detection, investigation, and response across endpoints, identities, cloud, and network—streamlining workflows and enhancing efficiency for SOC teams.

• Advanced correlation algorithms combine behavioral analytics, machine learning, and threat intelligence to connect events and deliver comprehensive security insights.
• Custom rules and MITRE ATT&CK® mapping allow defenders to tailor detection strategies for their specific needs.
• Built-in orchestration and automation capabilities reduce manual effort, accelerate incident response, and free analysts to focus on high-value tasks.
• UEBA powered by AI provide deep behavioral insights to detect anomalies and insider threats.
• Integrated threat intelligence enriches investigations with real-time insights, enabling faster detection, deeper context, and more accurate response across the SOC.
• Embedded AI and machine learning accelerate threat detection, reduce false positives, and enable advanced hunting and automated investigations—helping SOC teams respond faster and with precision.

Microsoft Sentinel has comprehensive machine learning threat analytics models that allow us to hunt and detect any security threat, no matter how sophisticated or hidden they are. Microsoft Sentinel has intelligent security event management features which help us to accurately investigate security threats to understand the origin, making it easy to identify the most appropriate way to handle them.

—Software Development Project Manager, Software Industry (Source: Gartner Peer Insights™)

Download the report

To learn more about why Microsoft was named a Leader in the 2025 Gartner® Magic Quadrant™ for SIEM, download the full report.

Looking forward

As cyberthreats grow in sophistication, the need for intelligent, adaptive, and end-to-end AI security platforms becomes more urgent. Microsoft is committed to leading this transformation by:

• Investing in agentic AI to empower defenders with autonomous capabilities.
• Empowering defenders with a cost-effective data lake for deeper insights and scalable analytics.
• Enhancing cross-platform integrations for holistic protection.
• Driving community collaboration through open content hubs and shared analytics.

We’re not just building tools; we’re shaping the future of cybersecurity. Our roadmap is guided by the real-world challenges faced by SOCs and the outcomes they strive for: faster detection, smarter response, and stronger resilience.

We’re honored by the Gartner recognition and deeply grateful to our customers, partners, and the analyst community for their continued trust and collaboration.

Are you a regular user of Microsoft Sentinel? Share your insights and get rewarded with a $25 gift card on Gartner Peer Insights™.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

¹Gartner® Magic Quadrant™ for Security Information and Event Management, Andrew Davies, Eric Ahlm, Angel Berrios, Darren Livingstone, 8 October 2025

Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s Research & Advisory organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Gartner Peer Insights content consists of the opinions of individual end users based on their own experiences with the vendors listed on the platform, should not be construed as statements of fact, nor do they represent the views of Gartner or its affiliates. Gartner does not endorse any vendor, product or service depicted in this content nor makes any warranties, expressed or implied, with respect to this content, about its accuracy or completeness, including any warranties of merchantability or fitness for a particular purpose.

This graphic was published by Gartner, Inc. as part of a larger research document and should be evaluated in the context of the entire document. The Gartner document is available upon request from Microsoft.

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, Magic Quadrant and Peer Insights are registered trademarks of Gartner, Inc. and/or its affiliates and is used herein with permission. All rights reserved.

The post Microsoft named a Leader in the 2025 Gartner® Magic Quadrant™ for SIEM appeared first on Microsoft Security Blog.

Comprehensive visibility across the enterprise

Defender XDR has the broadest signal coverage across the enterprise spanning endpoints, identities, email and collaboration tools, software as a service (SaaS) apps, cloud workloads, and data security—which enables security leaders to consolidate visibility, automate response, and outperform siloed tools. It combines native capabilities in threat detection, prevention, and response backed by AI-powered automation, rich telemetry, and seamless security information and event management (SIEM) integration to deliver a comprehensive and proactive defense strategy for modern enterprises. But Microsoft’s advantage goes beyond coverage. As one of the Big Three public cloud providers—and the originator of widely adopted platforms like Microsoft 365 and Microsoft Entra ID—Microsoft has unparalleled insight into the very technologies it secures.

Driving AI innovation in cybersecurity

Microsoft also stands out for its use of AI in cybersecurity through Microsoft Security Copilot. First introduced in March 2023 with generative AI capabilities, these digital assistants have evolved into a suite of autonomous AI agents announced in 2025, each designed to support specific use cases such as triaging user-reported phishing emails. This agentic approach enhances operational efficiency and empowers security teams with intelligent, task-specific automation. In fact, the phishing triage agent examines thousands of alerts each day—typically within 15 minutes of detection—which saves time, accelerates threat response, and allows security operations center (SOC) teams to focus on more meaningful tasks.   

Complementing this agentic approach, IDC specifically highlighted Microsoft Defender’s automatic attack disruption, an AI-powered capability that disrupts in-progress cyberattacks like ransomware by containing compromised assets to prevent lateral movement—often within an average of just three minutes. Together, these innovations show how Microsoft is redefining the modern SOC to infuse AI throughout standard SOC workflows and rapidly respond to sophisticated cyberattacks.

Microsoft provides a full life cycle offering from preemptive and prevention technologies to detection and response.

—IDC MarketScape: Worldwide XDR Software 2025 report

Preemptive posture that reduces risk

In their report, IDC shared that one key Microsoft strength lies in its ability to unify proactive defense with intelligent response. Defender XDR natively integrates exposure management, attack surface reduction, secure configuration monitoring, and data loss prevention—giving security teams the tools to identify and mitigate vulnerabilities before they’re exploited. This preemptive posture and built-in attack disruption not only reduces risk but also enhances the fidelity of alerts, enabling faster, more accurate threat detection.

Defender script analysis and threat hunting

Sophisticated cyberattacks often evade detection using cloaked scripts and PowerShell commands. Defender XDR includes built-in script analysis, allowing analysts to inspect and classify scripts without external tools—reducing complexity and accelerating response. And for deeper threat hunting, Defender XDR supports Kusto Query Language (KQL), enabling analysts to parse telemetry, discover patterns, and identify outliers. Novice users can leverage a guided user interface experience to build and customize queries with ease while building their skillset.

Seamless integration and correlation between SIEM and XDR

IDC also noted that what sets Microsoft apart is its seamless correlation between SIEM and XDR, allowing insights from threat actor behavior and anomalies to flow across platforms without requiring customers to deploy both. With all this, plus powerful visualizations, KQL-based threat hunting, and deep identity threat detection, Microsoft delivers a strongly competitive, comprehensive, and adaptive security operations experience.

Learn more

Read the complete IDC MarketScape: Worldwide Extended Detection and Response (XDR) Software 2025 report and visit the Microsoft Defender XDR webpage to learn how you can elevate your security with unified visibility, investigation, and response across the cyberattack chain with an industry-leading XDR solution.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity. 

IDC MarketScape vendor assessment model is designed to provide an overview of the competitive fitness of technology and service suppliers in a given market. The research utilizes a rigorous scoring methodology based on both qualitative and quantitative criteria that results in a single graphical illustration of each supplier’s position within a given market. IDC MarketScape provides a clear framework in which the product and service offerings, capabilities and strategies, and current and future market success factors of technology suppliers can be meaningfully compared. The framework also provides technology buyers with a 360-degree assessment of the strengths and weaknesses of current and prospective suppliers. 

The post Microsoft named a Leader in the IDC MarketScape for XDR appeared first on Microsoft Security Blog.

We know security teams today are navigating a landscape of escalating cyberthreats and operational complexity. But the real opportunity lies in transformation—not just defense. At Microsoft, our mission is to help organizations consolidate fragmented security capabilities and apply intelligence to deliver better outcomes. With integrated tools and AI-powered insights, Microsoft Defender, powered by Microsoft Sentinel, empowers SecOps teams to strengthen their security posture, accelerate response, and build lasting resiliency across hybrid and multicloud environments.

The Forrester Total Economic Impact™ (TEI) study also shows the consequences of under-equipped and disconnected security teams are costly. Toxic team dynamics and insufficient tooling correlate to higher breach rates and inflated incident costs. Organizations without robust incident response capabilities spend an average of $204,000 more per breach and suffer nearly one additional breach annually, on average. These findings underscore the critical need for integrated, intelligent security solutions—which can unify detection, investigation, and response—empowering SecOps teams to operate with resilience, precision, and speed.

Organizations face increasing security challenges

Many organizations have already made significant investments in cybersecurity to keep pace with evolving cyberthreats. Despite these efforts, they continue to face persistent challenges. One major issue—the proliferation of security tools across hybrid and multicloud environments—has led to excess costs, complexity, and risk. Additionally, legacy on-premises infrastructure demands high overhead and convoluted workflows, often resulting in poor visibility and inefficient threat detection. Security teams also struggle with alert fatigue and false positives, delaying incident response and increasing the likelihood of breaches. Security operations center (SOC) engineering teams are stretched thin and some lack the advanced coding skills needed to build effective detections. These gaps leave organizations vulnerable to cyberthreats like ransomware and phishing, with some experiencing costly breaches that disrupt operations and erode profitability.

In response, organizations set clear investment objectives. They need a solution that scales securely without adding complexity—one that can integrate seamlessly with existing Microsoft and third-party tools and reduce the cognitive load on analysts.

How Microsoft Defender delivers ROI, speed, and simplicity

Microsoft Defender and Microsoft Sentinel integrate to provide a unified security operations platform, delivering cost effective storage for security data with full security information and event management (SIEM) capabilities. The integration allows security teams to correlate incidents, hunt cyberthreats, and respond faster by combining Defender’s deep endpoint and identity insights with Sentinel’s scalable analytics and automation.

The cohesive user experience of Microsoft Defender, lower false-positive rate, and ability to surface meaningful insights with fewer steps makes it a compelling choice for customers. They also value its support for Kusto Query Language (KQL), which enables sophisticated detections without requiring deep engineering expertise. Ultimately, organizations looking at Defender hope it can help them consolidate tooling, improve visibility across their environments, and mitigate the risk and cost of breaches—empowering their security teams to respond faster, smarter, and more effectively.

According to the Forrester Total Economic Impact (TEI) study, organizations using Microsoft Defender realized a 242% return on investment over three years, with a net present value of $12.6 million. That’s not just cost savings—it’s strategic value creation. It’s money for future product innovations or salary for more SecOps team members. Microsoft Defender helps consolidate tools, reduce licensing overhead, and streamline operations, freeing up budget and bandwidth for innovation. Key statistics shared by Forrester include:

• Significantly faster cyberthreat remediation: Speed is the new currency in cybersecurity. The study found that Defender enabled security teams to remediate threats faster, dropping mean time to acknowledge (MTTA) from 30 minutes to 15 minutes and mean time to resolve (MTTR) from up to three hours to less than 1 hour in many cases. That improvement in speed can mean the difference between a contained incident and a costly breach. With built-in automation and AI-driven insights, Microsoft Defender empowers analysts to act decisively—before cyberattackers can gain a foothold. 

• $17.8 million in benefits to the business: A breakdown of the benefits over three years to businesses using Microsoft Defender include up to $12 million in reduced costs from vendor consolidation, $2.4 million in savings from SecOps optimization, and $2.8 million in reduced cost of material breaches. 

• Less than 6 months to investment payback: Organizations that invested in Microsoft Defender found their investment paid off in less than six months, on average. 

What surprised me was how interconnected it is with Microsoft’s tooling, and not just their security tooling but [also in] the way you manage your devices. I can see everything about [Microsoft] Intune. I can see all of the audit logs for everything that happens in [Microsoft] Azure, everything like that—it’s just there. I didn’t have to intentionally turn it on.

—Manager of Cyberdefense, Consumer Packaged Goods

What can security leaders take away from this research?

• Defender delivers measurable ROI and cost efficiencies through consolidation of security tools, reduced licensing and managed security service provider (MSSP) costs, and streamlined operations that can free up both budget and staff time. 

• Defender helps modernize security operations and enables SecOps teams to remediate cyberthreats up to 30% faster, thanks to built-in automation, AI-powered threat detection and response, and close integration with Microsoft Sentinel for coordinated defense. 

• Defender unifies security across multicloud and hybrid environments, helping teams reduce alert fatigue, prioritize cyberthreats effectively, and strengthen security and compliance postures. 

Read more detail about the Forrester Total Economic Impact™ (TEI) study or visit AI-powered security operations to learn more about how Microsoft Defender can help your organization today.

Learn more with Microsoft Security

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity. 

​​*Total Economic Impact is a methodology developed by Forrester Research that enhances a company’s technology decision-making processes and assists solution providers in communicating their value proposition to clients. The TEI methodology helps companies demonstrate, justify, and realize the tangible value of business and technology initiatives to both senior management and other key stakeholders.

¹The financial results calculated in the Benefits and Costs sections can be used to determine the return on investment (ROI), net present value (NPV), and payback period for the composite organization’s investment. Forrester assumes a yearly discount rate of 10% for this analysis. 

These risk-adjusted ROI, NPV, and payback period values are determined by applying risk-adjustment factors to the unadjusted results in each Benefit and Cost section. 

The initial investment column contains costs incurred at “time 0” or at the beginning of Year 1 that are not discounted. All other cash flows are discounted using the discount rate at the end of the year. Present value (PV) calculations are calculated for each total cost and benefit estimate. NPV calculations in the summary tables are the sum of the initial investment and the discounted cash flows in each year. Sums and present value calculations of the Total Benefits, Total Costs, and Cash Flow tables may not exactly add up, as some rounding may occur. 

The post Microsoft Defender delivered 242% return on investment over three years​​ appeared first on Microsoft Security Blog.

A unified approach to identity threat detection and response (ITDR) is no longer a luxury; it’s a necessity. Whether you are an identity admin or a security operations center (SOC) analyst, minimizing your risk starts with eliminating gaps in protection.

From chaos to control: Uniting identity and security solutions

As the corporate IT landscape has evolved organizations have been left managing complex webs of identities across multiple environments, tools, and vendors, giving cyber criminals many potential gaps to sneak through. The recent Secure Access Report illustrates the direct correlation between complex, multisolution identity vendors and the probability of a significant breach.

According to the report research, companies relying on a patchwork of six or more identity and network solutions not only face operational inefficiencies but also a 79% higher probability of a significant breach.²

At Microsoft, we understand that ITDR is an integrated partnership between identity and access management (IAM) and extended detection and response (XDR) and our vision has been to eliminate the organizational silos and unite these teams, their tools, and processes.

One of the key advantages of our integrated solution is its ability to provide end-to-end visibility and protection. Microsoft Entra natively feeds critical signals to Microsoft Defender and vice versa, enabling comprehensive identity protection across both on-premises, cloud environments, and third parties. Customers like ElringKlinger have recognized that fragmented, siloed security solutions were no longer sufficient to address the sophisticated nature of cyberthreats.

The combination of the individual Microsoft identity solutions is great. It helps us find issues that we might not uncover if we had siloed identity solutions and makes life easier for our team.

—Alexander Maute, Director of IT at ElringKlinger

Proactive protection: Hardening your Identity security posture

ITDR starts long before a cyberattack ever begins, specifically by minimizing your attack surface area. From an identity perspective this means eliminating the vulnerable configurations, stale accounts, and instances of over-privilege that cyberattackers often look to exploit. Microsoft’s approach to ITDR emphasizes this proactive stance: posture management isn’t just a best practice—it’s the foundation that makes real-time ITDR possible. We also understand that successful security practices require coordination across different teams and processes.

Microsoft Entra and Microsoft Defender surface actionable recommendations directly into Microsoft Secure Score and Extended Security Exposure Management (XSPM), enabling security teams to visualize attack paths, prioritize remediation, and proactively harden their defenses before threats materialize. The Identity Security initiative offers an identity-specific view of recommended actions from across on-premises and cloud identities, identity infrastructure, and third-party identity providers. These and other recommendations across endpoints, applications, data, networks, and identities help provide security leaders with unmatched visibility into potential attack paths and vulnerabilities, allowing them to identify and mitigate risks before they escalate.

Milliseconds matter: The power of real-time detection and response

Prevention alone is no longer sufficient in today’s evolving threat landscape—true cyber resilience relies on the ability to detect and respond at speed. In an environment where every second counts, Microsoft’s ITDR approach stands apart by delivering strategically layered defenses that help actively disrupt cyberthreats in real time by unifying the data, tools, and workflows across IAM and SOC teams.

The first layer comes in the form of dynamic, risk-based access controls leveraging the unparalleled insights from the identity landscape. As the identity provider, Microsoft Entra directly manages cloud authentication and enforces protection in real time at the point of authentication. This allows us to dynamically enforce access controls and step-up authentication faster and more consistently than anyone else. This is made possible through the native bi-directional integration between Entra and Defender, which enables continuous, real-time sharing of identity signals across identity and security operations.

What differentiates this approach is the built-in feedback loop: identity signals inform security detections instantly, and threat intelligence from Defender directly influences access decisions in Entra—without manual handoffs, or latency. In addition to adding more potential points of failure, multivendor solutions typically rely on older logs from prior log-on attempts and may not have the full context or see the changes that have happened since then.

Where the integration truly shines, however, is our identity threat response capabilities.  During an active cyberattack, speed of response is critical. That’s why Microsoft has automatic attack disruption, a built-in self-defense capability that uses the correlated native signal in XDR, AI, and latest threat intelligence to identify and contain in-progress attacks like AiTM, ransomware, and more to prevent further lateral movement. Attack disruption maps out the attack path using insights from the unified platform to accurately predict where the attacker will go next. Once a threat is confirmed, Defender initiates automatic containment—isolating compromised assets or shutting down user sessions to prevent further spread.

This near real-time response not only stops the attack but also minimizes its impact, giving security teams critical time to investigate and remediate without disruption to the broader environment. This closed-loop integration strengthens risk engines over time, and responses become smarter and faster, saving time and balancing productivity and security for your identity and SOC teams.

Extending Zero Trust beyond ITDR

ITDR is a critical component of a modern cybersecurity strategy, but it’s only one part of a larger, evolving vision. At Microsoft, Zero Trust is not a checkpoint—it’s a guiding security philosophy that continues to scale and adapt with the evolving threat landscape. Securing the modern organization means adopting a Zero Trust strategy that protects users, data, applications, and infrastructure—regardless of where they reside. This includes enforcing least privileged access, verifying explicitly, and assuming breach as a constant. These principles must extend across the digital estate, not just within identity, but across endpoints, applications, and networks.

Microsoft delivers on this vision through an end-to-end portfolio that supports the full spectrum of Zero Trust capabilities. Microsoft Entra provides robust identity and access management. Microsoft Intune ensures device compliance and health. Microsoft Purview enforces data security and governance. Microsoft Defender offers threat protection across endpoints, identities, software as a service apps, email and collaboration tools, multicloud workloads, and data security insights. And Microsoft’s network access capabilities—delivered through the Entra Suite—secure connections and reduce lateral movement risks. And when you use them together, you can secure any identities, any apps, anywhere.

As organizations navigate increasingly complex environments—from hybrid work to multicloud infrastructures—Microsoft is committed to being a trusted partner on the Zero Trust journey. With Microsoft, organizations are not only prepared for today’s identity threats—they’re equipped for the future of secure digital transformation.

Microsoft Identity Threat Detection and Response

Get comprehensive protection for all of your identities and identity infrastructure. Learn more and explore products.

The future of ITDR

As threat actors grow more sophisticated, security strategies must evolve beyond fragmented tools and isolated signals. Looking ahead, ITDR will continue to serve as a cornerstone of Zero Trust—one that is natively integrated across identity, apps, endpoints, cloud, network, and beyond. With Microsoft as a trusted partner, business leaders are equipped to go beyond ITDR and protect your identities, secure your operations, and build resilience for the future.

Watch our video to learn more.

Learn more about Microsoft Identity Threat Detection and Response.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity.

¹Microsoft Digital Defense Report 2024

²Secure employee access in the age of AI

The post Modernize your identity defense with Microsoft Identity Threat Detection and Response appeared first on Microsoft Security Blog.