ISOC in Microsoft Defender: Review the preview

Review ISOC in Microsoft Defender

On 23 September 2026, Microsoft announced the Integrated Security Operations Center (ISOC) in Microsoft Defender as a public preview. For small and midsized Microsoft 365 environments, this is not a reason for licence advice, but it is a concrete operations checkpoint: if Defender signals, incidents, automation, and reporting are handled in separate places today, administrators … Read more

Storm-3168: Review service principals now

Storm-3168 - Review service principals in Azure

Microsoft Threat Intelligence describes Storm-3168 activity involving compromised service principals in Azure. The Microsoft Security Blog from 25 September 2026 links the activity to JADEPUFFER and reports Azure-focused resource destruction, reconnaissance, and credential collection. For small and midsized organizations, this matters whenever applications, automations, or backups rely on long-lived secrets: according to Microsoft, a disclosed … Read more

Storm-2570: Review ransomware activity now

Storm-2570 - Review ransomware signals in Defender

Microsoft Threat Intelligence describes Storm-2570 as a ransomware affiliate tracked since April 2025 across several ransomware ecosystems. The Microsoft Security Blog from 24 September 2026 names deployments involving Qilin, DragonForce, Anubis, and BERT, and stresses that the key defensive question is not only which ransomware payload appears at the end. The useful signals are the … Read more

Defender: Review Linux desktops now

Review Defender for Endpoint on Linux desktops

Microsoft updated the Defender for Endpoint documentation in September 2026: Microsoft Defender for Endpoint now supports Linux desktops in Public Preview. Until now, many organizations read the Linux guidance mainly through a server lens. For companies with 10 to 250 users, the change matters when developers, administrators, engineering teams, or specialist departments use Linux workstations. … Read more

Microsoft Purview DLP: measure detection assurance

Microsoft Purview DLP – measure detection assurance

Microsoft has introduced the Data Security Workbench as an open starting point for reviewing Microsoft Purview DLP alerts not only as tickets to clear, but as evidence for measurable detection quality. The TechCommunity article from 15 September 2026 describes a closed loop of observing, explaining, improving, and proving DLP behaviour. For smaller organizations, this matters … Read more