Defender Weekly

Microsoft Defender @ Microsoft Ignite 2026

Fabian Bader — Thu, 12 Nov 2026 16:04:30 GMT

👋 Hi folks, Fabian here with a special Microsoft Ignite edition of Defender News!

This post lists all the Microsoft Defender sessions at Microsoft Ignite 2026 in one place.

Register for a free digital Microsoft Ignite pass, add these sessions to your schedule, and be the first to catch all the new Microsoft Defender announcements happening Nov 17–20.

Please advised: I’m not responsible for any buzzword bingo in the following session titles or descriptions.

🎙️ Breakout sessions

Project Perception Roadmap: New Capabilities, Use Cases & What’s Next

How must security operations evolve when AI can act? Explore Microsoft’s agentic security vision and roadmap and learn how people, AI agents, and trusted controls can work together to accelerate defense across the security lifecycle.

Speakers: Hari Pulapaka (Microsoft), David Finkelstein (St. Luke’s University Health Network), Will Pocknell (Insight Enterprises)

The Alert Is Dead. The Blueprint for the Agentic SOC

What replaces alert-centric operations? In this session, we’ll map the blueprint of the Agentic SOC and show how the integrated security operations center (ISOC) provides the foundation for outcome-driven defense. Learn how leading teams are shifting from triage to continuous attack disruption, how humans and AI divide responsibilities, and the architectural changes required to unify protection, operations, and AI into a single security system.

Speakers: Rob Lefferts (Microsoft), Jon Kuhn (Microsoft)

Winning the Race Against Time with Autonomous Protection

AI is changing the economics of cyberattacks, compressing the gap between discovery and exploitation. Learn how Microsoft is rethinking autonomous protection for an era where exposure evolves faster than traditional defenses can keep pace.

Speakers: Noam Hadash (Microsoft), Raviv Tamir (Microsoft), Ken Robb (EY)

Agentic Security Unfiltered with Allie Mellen: Hype vs. Reality

Explore the real-time architectural breakdown of what happens when agentic AI hits production IT environments. Together, Forrester principal analyst Allie Mellen and two Microsoft executives will tear down a modern SOC architecture live on stage—mapping out where agents safely automate outcomes, where non-deterministic AI breaks IT change controls, and how to design guardrails that CISOs and IT Directors can actually trust.

Speakers: Tanmay Ganacharya (Microsoft), Raviv Tamir (Microsoft), Allie Mellen (Forrester)

Project Perception: How Agentic Security Works

Stay ahead of evolving threats with Project Perception, Microsoft’s new agentic security system. See how specialized red, blue, and green team agents work together with shared security context to expose weaknesses, investigate threats, prioritize risk, and strengthen defenses. Learn how coordinated multi-agent defense helps your team move from reactive security to continuous protection, while keeping people in control of critical decisions.

Speakers: Naama Ben Dov (Microsoft), Corina Feuerstein (Microsoft)

Threat Intelligence reimagined: From signals to protection at AI speed

Go beyond static threat intelligence feeds. See how Microsoft combines industry-leading visibility, expert-led research, and AI automation to turn intelligence into action. Explore demos and practical strategies to defend against today’s top threats.

Speakers: Tanmay Ganacharya (Microsoft), Yoni Nave (Microsoft)

Accelerate your security services at machine speed

Security teams need faster, simpler operations without abandoning existing investments. See how Microsoft Sentinel capabilities are coming into the Microsoft Defender experience and what the integrated SOC means for new and established customers. Identify opportunities across assessment, migration, deployment, adoption, optimization, and managed services.

Speakers: Cat Daniels (Microsoft), Saggie Haim (Microsoft), Alex Luig (Ontinue)

Identity Knows What Your SOC Doesn’t: Stop Threats Faster Together

Identity attacks move fast. Your teams need to move faster. See how Microsoft Entra and Microsoft Defender bring identity context and risk signals into SOC investigations, helping IAM and security teams detect, investigate, and disrupt threats faster with unified visibility and automation.

Speakers: Etan Basseri (Microsoft), Martin Schvartzman (Microsoft), Yair Tor (Microsoft)

What the Frontlines Reveal About Modern Security

What threats and challenges are Microsoft experts seeing on the frontlines of cyber defense? Hear directly from frontline experts and explore practical guidance for making threat intelligence actionable, operationalizing AI agents, and building cyber resilience.

Speakers: Troy Lainhoff (Microsoft), Vlad Suarez (Microsoft)

See and reduce exposure across your digital estate

Your teams are drowning in findings while attackers need one path. See the new Microsoft Security Exposure Management experience map frontline threat intelligence to your exposures, validate what’s real, and produce an agent-assisted, risk-ranked plan of action.

Speakers: Nuno Costa (Microsoft), Alex Klausner (Microsoft), Catherine Pidgeon (Microsoft), Greg Schellenberg (KPMG)

A Zero Trust approach to securing AI runtime with Microsoft Defender

AI agents are the next attack surface. Learn how Microsoft Defender helps apply Zero Trust, reduce agent risk, and defend against AI attacks such as prompt injection, tool misuse, and identity abuse, with guidance mapped to OWASP and MITRE.

Speakers: James Brotsos (Microsoft), Krishna Sunkavalli (Microsoft)

Protect applications across code, cloud, and runtime

Modern applications span cloud resources, identities, data, containers, and networks. Learn how Microsoft Defender and Azure Firewall and DDoS protection help uncover attack paths, detect runtime threats, and respond to multi-stage attacks.

Speakers: James Brotsos (Microsoft), Ashish Jain (Microsoft)

From threat intelligence to protection across your estate

See how Defender Security Research turns real-world attacks into coordinated protection. Learn how the unified security graph connects signals and threat intelligence to power detection, prevention, attack disruption and built-in agents.

Speakers: Caroline Lee (Microsoft), Shachaf Levy (Microsoft)

Modern Phishing Doesn’t End at the Click

Attackers don’t need to steal your password to compromise your identity or account. See how AI-powered phishing, impersonation, compromised accounts, and identity-based attacks are changing the game, and how identity, email and collaboration security help defenders detect and disrupt threats before they spread.

Speakers: Cristian Craioveanu (Microsoft), Ankur Patel (Microsoft)

Prioritize and remediate your riskiest agents at machine speed

AI agent risk is not static. As agents gain new permissions, access additional data, use new tools, and take autonomous actions, their risk profile can change over time. Learn how Microsoft helps security teams continuously understand, investigate, and respond to evolving risk across their AI agent ecosystem.

Speakers: Kristina Hotz (Microsoft), Joanne Marone (Microsoft), Ankur Patel (Microsoft)

Evolving your security business in the world of AI

Attackers are operating at machine speed, forcing security providers to rethink how they protect customers and grow their businesses. Hear how Microsoft’s emerging agentic security innovations could reshape security operations, then connect new industry research to advisory, implementation, and managed-services opportunities.

Speakers: Gabriela Perez Arredondo (Microsoft), Naadia Sayed (Microsoft), Ken Robb (EY)

Defend Against External Threats in Teams

AI-generated threats are becoming more convincing and disruptive. Discover how Microsoft Teams helps protect users with built-in detection for impersonation, voice phishing, and suspicious external activity across meetings, calls, and messaging. Learn how external collaboration protections and certified security partner integrations help identify untrusted participants, malicious content, and AI-powered threats before they become incidents.

Speakers: Maryam Ahmad (Microsoft), Srisudha Mahadevan (Microsoft), Eric Sansom (Microsoft)

From partners and the community

Assume the breach: Build readiness for the modern threat era

Cyber resilience starts long before an incident occurs. Join Jeremy Nelson, CISO at Insight, to explore how leading organizations are shifting from a response-first mindset to a readiness-first strategy. Learn how greater visibility across assets, identities, and software, risk-based patching, managed SOC services, and well-defined response plans can help your organization reduce risk, accelerate recovery, and create the resilience needed to thrive in today’s evolving threat landscape.

Speaker: Jeremy Nelson (Insight)

👩‍💻 Lab sessions

Hands-on labs for in-person attendees in San Francisco.

Secure local AI agents with end-to-end threat protection

A local AI agent has been compromised. Learn how to hunt threats, investigate attacks, and respond to incidents with Microsoft Defender. Leave with practical skills to uncover attacker techniques, trace attack paths, and secure AI agents. Add this session to your schedule to reserve your seat, as capacity is limited. Please arrive at least 5 minutes early; unclaimed seats may be released to standby attendees. If this session is full, please check the schedule for additional in-person deliveries.

Wed, Nov 18 · 8:30 AM PT

Speakers: Josh Bregman (Microsoft), Abed Sau (Microsoft)

Turn signal into real-time protections with Project Perception

Get hands-on with Project Perception and see how agentic security helps teams understand risk faster and turn insights into protection. Learn how Red team, Blue team, and Green team agents work together to defend at machine speed. Add this session to your schedule to reserve your seat, as capacity is limited. Please arrive at least 5 minutes early; unclaimed seats may be released to standby attendees. If this session is full, please check the schedule for additional in-person deliveries.

Wed, Nov 18 · 12:00 PM PT

Speakers: Beckie Neumann (Microsoft), Yaniv Shasha (Microsoft)

Strengthen endpoint protection from onboarding to offboarding

Bring IT and Security together to establish and maintain endpoint protection. In this hands-on lab, onboard devices and validate successful onboarding through reporting, configure and target security policies to manage protection settings, and complete device offboarding. Leave with practical experience using Microsoft Intune and Defender to connect IT and Security workflows across onboarding, policy management, and offboarding. Add this session to your schedule to reserve your seat, as capacity is limited. Please arrive at least 5 minutes early; unclaimed seats may be released to standby attendees. If this session is full, please check the schedule for additional in-person deliveries.

Thu, Nov 19 · 1:00 PM PT

Speakers: Swapna Medi (Microsoft), Lorena Mora (Microsoft)

📼 On-demand sessions

Pre-recorded sessions you can watch any time.

From concept to containment, see the agentic SOC in practice

Explore the evolution from traditional MDR to an agentic SOC through three simulated security incidents of increasing severity. Learn how machine-speed investigation and response, combined with security context, pre-authorized actions, and granular governance, enable faster threat containment without sacrificing control. Gain practical guidance for evaluating modern security providers based on speed, decision quality, policy integration, and auditability.

Speakers: Ouafae Hannaoui, Craig Jones (Ontinue), Vijay Viswanathan (Ontinue)

Manage your AI risks and outcomes across your security operations

Managing AI risk requires connecting governance, compliance, exposure management, and security operations. Learn how to protect agents, identities, data, endpoints, and infrastructure while maintaining human accountability. See how CyberMSI AI Trust, built on Microsoft’s Unified Security Operations platform, combines AI-driven protection, 24x7 MDR, and analyst-on-the-loop oversight to help organizations manage AI risk.

Speaker: Fawaad Khan (CyberMSI)

🎫 In-person sessions

If you are attending Ignite in person in San Francisco, check out these additional sessions.

🎙️ In-person breakouts

You can’t defend an AI-powered enterprise with yesterday’s SOC

AI is expanding the attack surface. Agents, autonomous workflows and human-AI collaboration are creating risks traditional SOC models were never designed to address. Join Accenture and Avanade to explore how security leaders are evolving from reactive operations to adaptive defense using AI to defend AI. Learn how Accenture Adaptive MxDR and Microsoft Security technologies help organizations secure agents, govern non-human identities and build trust in the agentic enterprise.

Thu, Nov 19 · 11:30 AM PT · Partner session

Secure the enterprise with cyber resiliency in the AI era

In the AI era, cyber resiliency is no longer just about prevention. Discover how Lenovo Security Services, powered by Microsoft Security technologies, helps organizations build a resilient security posture through continuous monitoring, threat detection and response, identity protection, vulnerability management, and proactive risk reduction. Walk away with a practical framework to secure the modern enterprise while enabling innovation, productivity, and trust at scale.

Thu, Nov 19 · 11:30 AM PT · Partner session

Speaker: Gaurav Mishra (Lenovo)

🌟 Theater sessions

Get ready for AI with the E5 you already own

Most organizations with Microsoft 365 E5 own more security capability than they use. See how E5 already helps you stop attacks, control access, protect data, and reduce risk, all within the same license. Then, discover what’s new with ISOC and expanded SIEM capabilities and see them in action in a live demo. Leave with a clearer view of your E5 security capabilities and three concrete steps to get more from what you already own.

Tue, Nov 17 · 4:05 PM PT

Speaker: Matt Egen (Microsoft)

Duke health reduces risk and strengthens resilience with Azure

Learn how Duke Health modernized disaster recovery with Epic on Azure. In this session you’ll discover how Duke Health improved resilience and strengthened security with Microsoft Defender - resulting in reduced downtime risk and lowered costs, while enabling future AI readiness.

Wed, Nov 18 · 3:45 PM PT

Speaker: Greg Holland (Microsoft)

From partners and the community

Your Windows 365 Cloud PC Is Compromised. Now What?

What happens when the endpoint at risk is a Windows 365 Cloud PC? In this demo-led session, watch a healthy Cloud PC encounter a simulated threat and follow the resulting Defender risk, Intune compliance, and Entra Conditional Access signals. YouÆll see how Cloud PCs fit into a Zero Trust security model and leave with a practical pattern for detecting, containing, and recovering cloud-hosted Windows endpoints.

Wed, Nov 18 · 3:45 PM PT

Speaker: Sucheta Gawade (Microsoft MVP | Quorum Health)

Get a clean signal, faster answers with Cribl and Microsoft Sentinel

Security teams face noisy, growing telemetry volumes, a challenge accelerated by AI workloads, increasing data-ingestion costs and slowing investigations. See how Cribl Stream filters and enriches security data in motion, sending only clean, high-value signals to Microsoft Sentinel. Then learn how AI-powered investigations with Cribl Search connect to Microsoft Copilot, giving analysts a faster, more complete path from signal to answer.

Thu, Nov 19 · 3:45 PM PT · Partner session

Speaker: Jack Coates (Cribl)

Defend against vibe-coded Microsoft 365 attacks

Cyber threats are evolving as AI reshapes adversary tradecraft. Through the lens of Phishing-as-a-Service, explore the shift from legacy tools to emerging vibe-coded adversary-in-the-middle (AiTM) platforms. Huntress research on Knight Office reveals how these toolkits bypass MFA and hijack Microsoft 365 session tokens. Learn from real-world incident data how organizations can improve resilience and how Huntress and Microsoft work together to help protect Microsoft 365 environments.

Wed, Nov 18 · 1:40 PM PT · Partner session

Speaker: Ben Bernstein (Huntress)

Protect your software supply chain from agents of chaos

AI agents are changing how software is developed and introducing new considerations for software supply chain security. Security and engineering leaders need visibility into what enters their software supply chain and whether it can be trusted. See why scan-and-patch approaches can fall short and how trusted open source and Microsoft Defender for Cloud can help teams strengthen security on Azure Kubernetes Service (AKS).

Thu, Nov 19 · 10:10 AM PT · Partner session

Speaker: Chuck Freedman (Chainguard)

Trusting Your AI Workforce: Securing and Governing Enterprise Agents

Discover how Microsoft helps organisations securely deploy and govern AI agents using familiar security, identity, and compliance controls. Through demonstrations and customer scenarios, you’ll see how Microsoft Entra, Microsoft Purview, Microsoft Defender, and Copilot Studio work together to provide visibility, governance, and security for AI-powered agents. Join us to learn the essential practices every organisation should adopt before scaling AI agents across the enterprise.

Thu, Nov 19 · 1:05 PM PT

Speaker: Sasha Kranjac (Kloudatech)

Layer KnowBe4 behavioral AI and threat intelligence onto Microsoft

Build on Microsoft’s essential security foundation with a layered approach to zero-payload threats and outbound data leaks, one that understands user communication behaviors, automates with explainable verdict evidence, and calculates a unified Risk Score to measure security program effectiveness. Join to see why Microsoft selected KnowBe4 as an inaugural ICES Vendor Ecosystem partner and ranked KnowBe4 Defend #1 across every reported uplift metric in the 2026 email security benchmark report.

Thu, Nov 19 · 2:50 PM PT · Partner session

Speaker: Stuart Clark (KnowBe4)

Secure Workplace in the AI Era: An End-to-End Live Demo

Built on practical experience and proven best practices gathered since the early days of Microsoft 365, this end-to-end live demo shows how Microsoft Entra, Intune, Defender XDR, Purview, and Copilot security controls work together to create a productive and secure workplace. Gain a practical birdÆs-eye view of the Microsoft security ecosystem and understand how its technologies complement each other rather than operate as isolated products.

Thu, Nov 19 · 4:55 PM PT

Speaker: Andrej Orlov (Snomann)

⚡ Lightning talks

Defend your business-critical container apps from code to runtime

Modern applications rely on containers. Microsoft Defender for Cloud helps security teams detect runtime threats, understand container activity, and investigate attacks using container and cloud context to respond faster and reduce incident impact.

Wed, Nov 18 · 11:00 AM PT

Speaker: James Brotsos (Microsoft)

Fuel the agentic SOC with comprehensive security data

AI is only as effective as the security data it can access. Learn from experts on how Microsoft Sentinel can help you expand visibility across your Microsoft and third-party environments with a broad connector ecosystem. We’ll explore how richer security data improves detection, investigation, automation, and AI-powered workflows, enabling analysts and agents to work from a shared foundation of signals and context.

Wed, Nov 18 · 12:15 PM PT

Speaker: Jeff Chin (Microsoft)

Project Perception Live: From Exposure to Protection

Watch a live demo of Project Perception as Red, Blue, and Green Team agents help identify risk, investigate threats, and accelerate protection.

Thu, Nov 19 · 11:00 AM PT

Speaker: Naama Ben Dov (Microsoft)

Why Every SOC Needs attack disruption

Modern attacks move faster than human response. Join Microsoft security experts to learn how attack disruption helps stop attacks in progress, automatically containing threats and limiting attacker movement before damage occurs. Discover why autonomous defense is quickly becoming a core requirement for modern security operations.

Thu, Nov 19 · 2:10 PM PT

Speaker: Noam Hadash (Microsoft)

Threat Intelligence reimagined: Expert Q&A and Deep Dive

Have questions about Microsoft Threat Intelligence? Join an interactive discussion with product experts. Dive deeper into architecture, capabilities, and use cases. Bring your toughest questions and we’ll answer them live with demos and real examples.

Thu, Nov 19 · 4:15 PM PT

Speaker: Yoni Nave (Microsoft)

Dive into new intent-based playbooks that accelerate agent risk defense

Securing your riskiest agents is now as simple as choosing an outcome. Discover new intent-based playbooks that help security teams protect, govern, investigate, and remediate agents through a simple, guided experience. See how Dynamic Agent Risk continuously evaluates agent risks, permissions, exposure, and impact to prioritize what matters most and intelligently recommends your next best actions.

Thu, Nov 19 · 9:00 AM PT

Speakers: Kristina Hotz (Microsoft), Shravana Mukherjee (Microsoft)

Improve posture with agents

In this session we will walk through two scenarios that leverage agents to prioritize and remediate posture in Project Perception.

Thu, Nov 19 · 3:25 PM PT

Speaker: Gal Fenigshtein Fenigshtein (Microsoft)

From partners and the community

Security Copilot Blueprint: Activate, Measure, and Scale

Security Copilot is reaching more teams, but successful adoption takes more than turning it on. In this demo-led session, follow a practical blueprint to activate the right experiences, measure real usage and SCU consumption, and decide when and how to scale. See how prompts, embedded experiences, and agents fit together, and leave with a repeatable approach for growing Security Copilot without losing visibility or control.

Tue, Nov 17 · 3:15 PM PT

Speaker: Ugur Koc (UgurLabs)

Boosting Your SOC with Microsoft Sentinel Data Lake & Security Copilot

Based on real-world Microsoft Sentinel deployments and day-to-day SOC operations, this session explores how Microsoft Sentinel Data Lake, AI capabilities, and Security Copilot can transform detection, investigation, and response workflows. Whether you are planning your Sentinel Data Lake strategy or already operating a mature SOC, this session provides practical lessons learned, architectural guidance, and real operational experiences.

Wed, Nov 18 · 2:35 PM PT

Speaker: Thomas Kurth (baseVISION AG)

Zero Trust objectives with Defender for Cloud CSPM and Defender EASM

In addition to a SIEM, which is reactive, every shop needs insight into misconfiguration issues and compliance risks in the cloud--a logical extension of Zero Trust policies. Learn how the multi-cloud features of Defender for Cloud integrated with Defender XDR continuously monitors cloud infrastructure including DevOps platforms for gaps in security policy enforcement across all clouds and all platforms. Leverage agentless vulnerability scanning, secrets scanning, and Security Copilot plug-ins.

Thu, Nov 19 · 4:15 PM PT

Speaker: John Joyner (Corsica Technologies)

👥 Table talks

Small-group conversations with the product teams and community experts.

Practical lessons from building an Agentic SOC

AI agents are reshaping security operations. Join peers to discuss practical lessons, workflow designs, and trade-offs in operationalizing agents across the SOC. Seating for this session is first-come, first-served. Add it to your schedule to plan your day and arrive early to secure a spot.

Tue, Nov 17 · 2:00 PM PT

Speaker: Brian Hooper (Microsoft)

Winning the Race Against Time with Autonomous Protection

AI is changing the economics of cyberattacks, compressing the gap between discovery and exploitation. Join Microsoft for a discussion on the future of autonomous protection as exposure evolves faster than traditional defenses can keep pace. Seating for this session is first-come, first-served. Add it to your schedule to plan your day and arrive early to secure a spot.

Tue, Nov 17 · 4:10 PM PT

Speaker: Noam Hadash (Microsoft)

Protecting AI in real time: Ask the experts

Effective governance requires visibility. Learn how Microsoft Purview, Defender, and Entra help organizations track agent activity, understand data access, support investigations, and maintain the auditability and evidence needed to satisfy compliance requirements. Seating for this session is first-come, first-served. Add it to your schedule to plan your day and arrive early to secure a spot.

Wed, Nov 18 · 1:20 PM PT

Speaker: Safeena Begum Lepakshi (Microsoft)

Securing AI Agents: A candid conversation with the experts

AI agents are transforming how work gets done while introducing new security risks as they gain access to data, identities, tools, and enterprise resources. Join Microsoft experts for a candid discussion on understanding agent risk, investigating emerging threats, and strengthening protection across the AI ecosystem. Explore practical approaches to data protection, identity, runtime security, incident response, and governance while enabling secure AI innovation. Seating for this session is first-come, first-served. Add it to your schedule to plan your day and arrive early to secure a spot.

Wed, Nov 18 · 2:25 PM PT

Speakers: Kristina Hotz (Microsoft), Ankur Patel (Microsoft)

From partners and the community

Boosting Your SOC with Microsoft Sentinel Data Lake & Security Copilot

Join a small-group SOC discussion on balancing Sentinel Data Lake log-storage costs with detection and investigation value. Building on real Sentinel, AI, and Security Copilot scenarios, compare adoption lessons, architecture decisions, operational constraints, and practical trade-offs for improving detection and response workflows. Seating for this session is first-come, first-served. Add it to your schedule to plan your day and arrive early to secure a spot.

Thu, Nov 19 · 12:15 PM PT

Speaker: Thomas Kurth (baseVISION AG)

Security Copilot Blueprint | Activate, Measure, and Scale

Join a small-group peer discussion on adopting and scaling Security Copilot responsibly. Compare which use cases to enable first, when to use standalone prompts, embedded experiences, or agents, how to measure useful adoption, what SCU and agent usage patterns mean for capacity, who owns governance and cost, and what signals show readiness to expand. Seating for this session is first-come, first-served. Add it to your schedule to plan your day and arrive early to secure a spot.

Thu, Nov 19 · 12:15 PM PT

Speaker: Ugur Koc (UgurLabs)

Zero Trust objectives with Defender for Cloud CSPM and Defender EASM

Join a small-group discussion on extending Zero Trust beyond identity with Defender for Cloud CSPM and Defender EASM. Compare how to protect code supply chains from poor security practices and exposed secrets, how to detect cloud misconfiguration that creates vulnerable attack paths, and why CSPM, EASM, agentless scanning, and Security Copilot plug-ins are often underused. Seating for this session is first-come, first-served. Add it to your schedule to plan your day and arrive early to secure a spot.

Thu, Nov 19 · 1:20 PM PT

Speaker: John Joyner (Corsica Technologies)

Who Let the Agents Out? Taming Shadow AI and Agent Sprawl

Your organization already has agents you don’t know about | coding agents, desktop AI apps, local MCP servers. In this demo-heavy session, see how Microsoft Agent 365’s Agent Registry, powered by Defender, Entra, and Intune, discovers 20+ types of managed and unmanaged local agents and brings them under control | assign Entra Agent ID identities, apply Conditional Access & Intune runtime policies, and hunt agent activity with Defender. Leave with a discovery-to-governance playbook for your estate. Seating for this session is first-come, first-served. Add it to your schedule to plan your day and arrive early to secure a spot.

Thu, Nov 19 · 12:15 PM PT

Speaker: David Okeyode (CharisCloud Ltd.)

Defender News #2 → This week in Microsoft Defender

Fabian Bader — Fri, 06 Nov 2026 01:01:37 GMT

⚡️ Microsoft

The latest from Microsoft on Defender.

🛡️ Microsoft Defender XDR

What’s new in Microsoft Security: November 2026 • Alym Rayani

💻 Microsoft Defender for Endpoint

Now generally available: Discover local AI agents with Microsoft Defender • JoshBregman
Defending Linux in the age of AI-operated attacks • tejaskashyap

📧 Microsoft Defender for Office 365

Email threat landscape: Q3 2026 trends and insights • Microsoft Threat Intelligence, Microsoft Defender Security Research Team and Microsoft Threat Intelligence, Microsoft Defender Security Research Team

🩹 Microsoft Defender Vulnerability Management

What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks • Microsoft Security Research

🕵️ Microsoft Defender Threat Intelligence

Inside a malicious Claude Code-branded extension and its persistent SSH backdoor • Microsoft Security Research
Tracking AI adoption in North Korean threat actor tradecraft • Microsoft Threat Intelligence

🌍 From the community

Hand-picked from MVPs and Defender subject-matter experts around the globe.

🛡️ Microsoft Defender XDR

How to Connect Grok Bot to Microsoft 365 Securely • Robert Crane
Defender XDR custom detection lookback and eventGroupingKind • Truls Dahlsveen
Exploring Defender XDR tenant governance • Nicola Suter
CloudKeyVaultEvents: Azure Key Vault Logs, Schema and KQL Hunting • Bert-Jan Pals

🪪 Microsoft Defender for Identity

What a Compromised Account Can See in Your Microsoft 365 Tenant • Derek Morgan and Derek M.

🧩 Microsoft Defender for Cloud Apps

A second look at AuthCodeFix (ConsentFix) • Christopher Brumm

🔭 Microsoft Sentinel

Your agents don’t have badges. Your SOC pays for it. • Mona Ghadiri

🎛️ Microsoft Unified SecOps Platform

What is ISOC in Microsoft Defender? • Nicola Suter

Want to get featured on Defender News? → Submit your content 😎

🪃 Acknowledgement of Country

Defender Weekly is written between Hamburg and Melbourne. Part of this work is created on Wurundjeri land, and we acknowledge the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. We pay our respect to them and their cultures and to elders both past and present.

Defender News #1 → This week in Microsoft Defender

Fabian Bader — Thu, 29 Oct 2026 15:31:03 GMT

👋 Hi, and welcome to the first issue of the weekly Microsoft Defender News. In the future this is the place where you find the roundup of the latest news on Microsoft Defender from around the globe 🌍. This week includes a few links that are not exactly from this week as the first issue has to catch up.

Enjoy!