Sebastian

Microsoft’s October Entra blog introduces additional device signals for Universal Continuous Access Evaluation (CAE) in Global Secure Access. The extension is marked as public preview. Deleting or disabling a device used for access, or detecting that it is no longer compliant, can trigger reauthentication. For businesses with 10 to 250 workplaces already using Global Secure … Read more

On October 14, 2026, Microsoft described a phishing ecosystem: Storm-3119 supplies compromised or fraudulently created cloud environments, while Storm-2990 develops phishing kits. The report connects stolen credentials, abused Microsoft 365 resources, and downstream attacks. For businesses with 10 to 250 employees, the task is to review internal email protection and secure privileged identities. Microsoft does … Read more

Microsoft published CVE-2026-108448 for Microsoft Office Outlook on 15 October 2026. The Microsoft Security Update Guide describes it as a remote code execution vulnerability in Outlook, and explicitly confirms that the Preview Pane is an attack vector. For organizations using Microsoft 365 Apps, this matters because email remains a daily work channel and Outlook is … Read more

Microsoft has changed how Microsoft Purview Data Loss Prevention appears in Microsoft Defender XDR. Since early October 2026, a built-in alert tuning rule treats DLP signals as behaviors. As a result, they no longer generate alerts in Defender XDR by default or appear automatically in the incident queue. For small and midsize businesses this is … Read more

Microsoft is proposing an additional way to look at large security update releases: risk cohorts. These are provisional groups of CVEs that raise the same question about your own environment: which systems are exposed, which users open untrusted content, and which trust boundaries are affected? For small and midsize organizations, this is not a replacement … Read more