Cloud web apps: Review Microsoft threat matrix now

Review cloud web applications with Microsoft threat matrix

Microsoft has published a new threat matrix for cloud web applications. It maps attack techniques against web apps and serverless platforms to MITRE ATT&CK tactics and shows where defenders should connect visibility, hardening, and response. For smaller organizations, this matters now because many business applications run in Azure App Service, Functions, SaaS integrations, or similar … Read more

Defender XDR: Review identity coverage now

Defender XDR: Review identity coverage

In September 2026, Microsoft further consolidated identity security visibility in Microsoft Defender XDR: the “What’s new” page lists the Identity Security dashboard and “Coverage & Maturity” as generally available. The detailed documentation remains cautious and still refers to gradual rollout. For SMEs, this is still a good moment to review the new view because it … Read more

Defender for Identity: Review sensor v3.x now

Review Defender for Identity sensor v3.x

Microsoft expanded the documentation for Microsoft Defender for Identity in September 2026: sensor v3.x can now be planned not only for domain controllers, but also for identity servers running AD FS, AD CS, and Microsoft Entra Connect. Microsoft describes a preview path for activating the v3.x sensor on domain controllers without first onboarding them to … Read more

Defender: Review real-time protection for AI agents

Defender real-time protection for AI agents

Microsoft updated its documentation in September on how Microsoft Defender can monitor AI agents during runtime and block risky actions before they execute. For organizations testing agents in Copilot Studio, Agent 365, or on Windows endpoints, this is more than another portal setting. Agents can access data, call tools, and run commands. Teams should decide … Read more

Review AI-assisted invoice fraud with Defender

Warning symbol for AI-assisted invoice fraud

Microsoft describes an observed campaign using AI-assisted executive impersonation and fraudulent invoices. The attackers posed as internal leaders and as a known vendor, used convincing invoice content, and targeted finance teams. For small and midsize businesses, this matters now because these messages do not look like classic malware. They look like internal approval, a supplier … Read more