In its Security Blog post from 17 September 2026, Microsoft connects recent threat examples with Secure Now in Microsoft Security Exposure Management. The central point is that identities, endpoints, cloud resources, applications, and AI systems should not be reviewed in isolation, because Microsoft says attackers move across those surfaces. For organizations with 10 to 250 users, this is practical rather than abstract. Small security teams usually do not need another broad risk workshop. They need a ranked view of which weakness touches critical systems, which recommendation reduces several attack paths, and which change should be handled first this week.
What Microsoft highlighted on 17 September 2026
The blog states that AI has changed the operating environment for cybersecurity: attackers test more paths, adapt techniques faster, and move across digital environments with greater persistence. The weaknesses they exploit remain familiar, including excessive permissions, unprotected authentication flows, unpatched systems, exposed execution paths, and gaps between controls. Microsoft presents Secure Now within Security Exposure Management as a place where recent threats, focused initiatives, and recommended controls are brought together.
- Microsoft says Secure Now was introduced in Microsoft Security Exposure Management in May 2026.
- The guidance is intended to strengthen the security fundamentals needed for AI adoption.
- Recommendations focus on areas where autonomous attacks can create outsized exposure.
Which signals are brought together
Microsoft Learn describes Security Exposure Management as a solution that provides a unified view across endpoints, cloud resources, and external attack surfaces. With the Defender for Cloud integration in the Defender portal, the documentation says signals from Azure, AWS, and GCP are aggregated alongside traditional on-premises signals in an exposure graph. For Microsoft Defender environments, the important point is that recommendations do not stop at single devices. They can also relate to identities, cloud assets, SaaS, and data areas. That makes it easier to see whether a change only fixes a symptom or interrupts an attack path toward critical systems.
Why this matters for SMBs
In smaller organizations, risk often appears at the seams: an old administrator account, an incompletely managed device, an exposed cloud service, or an application with more permissions than it needs. Microsoft points to current examples involving agent boundaries, device-code phishing through legitimate sign-in flows, and support impersonation over Teams. That matches many SMB environments: Microsoft 365 capabilities are already present, but ownership, prioritization, and follow-up are scarce. Security Exposure Management is not a strategy decision and it is not licensing advice. It can help turn technical work into security initiatives that can be reviewed, assigned, and measured.
Deadlines, data freshness, and limits
Microsoft does not name a retirement deadline for Secure Now. Microsoft Learn does provide operating values that matter for planning: supported Microsoft product data is currently ingested and made available in the enterprise exposure graph and related Security Exposure Management experiences within 72 hours of being produced at the source product. Microsoft product data is retained for no less than 14 days, and only the latest data snapshot received from Microsoft products is kept. Teams should therefore not treat the first view as real-time completeness. The safer approach is to use it as a working list and then validate important items against the Defender portal, Microsoft Entra ID, and cloud configuration.
Practical next steps
- Open Secure Now in the Defender portal and map the listed current threats to your own identity, endpoint, and cloud surfaces.
- In Exposure Insights, review initiatives with their 14-day trend, target score, affected critical assets, and associated recommendations.
- Refine critical asset tagging so domain controllers, privileged roles, file servers, databases, and business-critical cloud resources are marked correctly.
- Group attack paths by entry point, target, criticality, and choke points so one remediation can reduce several paths where possible.
- Document recommendations first, then implement changes such as Conditional Access rules, patching, or tighter remote-support restrictions in a controlled sequence.
Official Microsoft sources
- Microsoft Security Blog: From guidance to action
- Microsoft Learn: What is Microsoft Security Exposure Management?
- Microsoft Learn: Exposure insights overview
- Microsoft Learn: Review security initiatives
- Microsoft Learn: Work with attack paths
Whether Secure Now, Exposure Insights, and attack paths fit your environment, and which remediations should come first, is something we review as part of a Microsoft Security Assessment – get in touch.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
