Microsoft Security Blog

News
August 4
4 min read

Microsoft Entra Suite delivers 131% ROI by unifying identity and network access

According to a new Forrester Total Economic Impact™ study, organizations using the Microsoft Entra Suite achieved a 131% ROI, $14.

News
July 22
6 min read

Microsoft Sentinel data lake: Unify signals, cut costs, and power agentic AI

We’re evolving our industry-leading Security Incidents and Event Management solution (SIEM), Microsoft Sentinel, to include a modern, cost-effective data lake.

Research
July 31
13 min read

Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats

Microsoft Threat Intelligence has uncovered a cyberespionage campaign by the Russian state actor we track as Secret Blizzard that has been ongoing since at least 2024, targeting embassies in Moscow using an adversary-in-the-middle (AiTM) position to deploy their custom ApolloShadow malware.

Threat intelligence

July 28

9 min read

Sploitlight: Analyzing a Spotlight-based macOS TCC vulnerability

Microsoft Threat Intelligence has discovered a macOS vulnerability, tracked as CVE-2025-31199, that could allow attackers to steal private data of files normally protected by Transparency, Consent, and Control (TCC), including the ability to extract and leak sensitive information cached by Apple Intelligence.
July 22

20 min read

Disrupting active exploitation of on-premises SharePoint vulnerabilities

Microsoft has observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon, exploiting vulnerabilities targeting internet-facing SharePoint servers.
June 30

18 min read

Jasper Sleet: North Korean remote IT workers’ evolving tactics to infiltrate organizations

Since 2024, Microsoft Threat Intelligence has observed remote IT workers deployed by North Korea leveraging AI to improve the scale and sophistication of their operations, steal data, and generate revenue for the North Korean government.
June 27

12 min read

Unveiling RIFT: Enhancing Rust malware analysis through pattern matching

As threat actors are adopting Rust for malware development, RIFT, an open-source tool, helps reverse engineers analyze Rust malware, solving challenges in the security industry.
May 29

12 min read

Defending against evolving identity attack techniques

Threat actors continue to develop and leverage various techniques that aim to compromise cloud identities.
May 27

16 min read

New Russia-affiliated actor Void Blizzard targets critical sectors for espionage

Microsoft Threat Intelligence has discovered a cluster of worldwide cloud abuse activity conducted by a threat actor we track as Void Blizzard, who we assess with high confidence is Russia-affiliated and has been active since at least April 2024.

View all threat intelligence

Stay ahead of threats

Get expert insights, threat intelligence, and the latest cybersecurity reports from Security Insider.

See the latest findings

AI and machine learning

August 7

5 min read

Announcing public preview: Phishing triage agent in Microsoft Defender

The Phishing Triage Agent in Microsoft Defender is now available in Public Preview.
July 16

7 min read

Protecting customers from Octo Tempest attacks across multiple industries

To help protect and inform customers, Microsoft highlights protection coverage across the Microsoft Defender security ecosystem to protect against threat actors like Octo Tempest.
July 14

7 min read

Improving IT efficiency with Microsoft Security Copilot in Microsoft Intune and Microsoft Entra

Announcing the general availability of Microsoft Security Copilot capabilities for IT with Microsoft Intune and Microsoft Entra, offering AI-powered efficiency and enhanced security for your operations.
July 7

4 min read

Learn how to build an AI-powered, unified SOC in new Microsoft e-book

Read Coordinated Defense: Building an AI-powered, unified SOC, the new e-book on how organizations can unify security operations to better meet the challenges of today’s cyberthreat landscape.
May 29

9 min read

How to deploy AI safely

Microsoft Deputy CISO Yonatan Zunger shares tips and guidance for safely and efficiently implementing AI in your organization.
May 27

5 min read

The future of AI agents—and why OAuth must evolve

Our industry needs to continue working together on identity standards for agent access across systems.

View all AI and machine learning

Modernize your security operations center

Confidently secure your multicloud, multiplatform environment with Microsoft Sentinel – a cloud-native security information and event management (SIEM) solution.

Learn more about Microsoft Sentinel

Latest posts

August 5

4 min read

Elevate your protection with expanded Microsoft Defender Experts coverage

Defender Experts now offers 24/7, expert-driven protection for cloud workloads, beginning with hybrid and multicloud servers in Microsoft Defender for Cloud.
July 31

5 min read

Modernize your identity defense with Microsoft Identity Threat Detection and Response

Microsoft’s Identity Threat Detection and Response solution integrates identity and security operations to provide proactive, real-time protection against sophisticated identity-based cyberthreats.
July 18

5 min read

Microsoft at Black Hat USA 2025: A unified approach to modern cyber defense

Microsoft will spotlight its AI-first, end-to-end security platform at Black Hat USA 2025.
July 17

5 min read

Transparency on Microsoft Defender for Office 365 email security effectiveness

Microsoft believes in transparently sharing performance data from Microsoft Defender for Office 365, and other ecosystem providers, to help customers evaluate email security solutions and make decisions to layer for defense in depth.
July 16

5 min read

Microsoft is named a Leader in the 2025 Gartner® Magic Quadrant™ for Endpoint Protection Platforms

We are honored to be recognized once again as a Leader in the 2025 Gartner® Magic Quadrant™ for Endpoint Protection Platforms—our sixth consecutive time.
July 10

4 min read

Forrester names Microsoft a Leader in the 2025 Zero Trust Platforms Wave™ report

Employing a Zero Trust strategy is an effective way to modernize security infrastructure to protect against ever evolving security challenges.