Back to updates

Incident Response - 1

2026 (6)

March (3)

security: Case study: How predictive shielding in Defender stopped GPO-based ransomware before it started

Microsoft Security Blog

2026-03-23

Microsoft Defender blocked a human-operated ransomware attack that used Group Policy Objects (GPOs) to disable defenses and deploy encryption at scale. Predictive shielding hardened 700 devices in time, preventing any GPO-based encryptions and blocking most of the attempted impact.

security: Help on the line: How a Microsoft Teams support call led to compromise

Microsoft Security Blog

2026-03-16

Microsoft describes a DART investigation into a Teams voice-phishing attack that used deception and trusted Microsoft tools to enable an identity-led intrusion. The post focuses on how the compromise happened and how to prevent similar attacks.

azure: [Launched] Generally Available: Azure SRE Agent with new capabilities

Azure Updates

2026-03-11

Azure SRE Agent is now generally available. The GA release adds new capabilities focused on incident diagnosis, automated response workflows, and improving uptime while reducing operational toil.

February (1)

github: Enterprise-wide credential management tools for incident response

GitHub

2026-02-17

GitHub Enterprise Cloud adds enterprise-wide credential management actions for enterprise owners to use during high-impact security incident response.

January (2)

security: Turning threat reports into detection insights with AI

Microsoft Security Blog

2026-01-29

The Microsoft Security Blog describes an AI-assisted workflow that converts lengthy incident reports and threat writeups into actionable detections by automatically extracting TTPs, mapping them to existing detection coverage, and flagging gaps — completing in minutes instead of days while preserving human expert review.

security: Explore the latest Microsoft Incident Response proactive services for enhanced resilience

Microsoft Security Blog

2026-01-07

Microsoft Incident Response has introduced new proactive services that use expert‑led preparation and advanced intelligence to convert security uncertainty into operational readiness and improved organizational resilience.

2025 (6)

December (3)

security: From awareness to action: Building a security-first culture for the agentic AI era

Microsoft Security Blog

2025-12-10

Microsoft emphasizes that insights from Cybersecurity Awareness Month and Microsoft Ignite 2025 show security remains a top business priority. The article calls for moving from awareness to concrete action by building a security-first culture suited to the risks and opportunities of agentic (autonomous) AI, combining leadership commitment, policy and governance, workforce training, and technical controls.

security: Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack

Microsoft Security Blog

2025-12-09

Shai‑Hulud 2.0 is a large-scale supply chain attack in which adversaries maliciously modified hundreds of public packages to compromise developer environments, CI/CD pipelines, and cloud workloads in order to harvest credentials and configuration secrets. Microsoft published guidance to detect, investigate, and defend against these compromises across development toolchains, build systems, and cloud assets.

security: Stronger together: New Beazley collaboration enhances cyber resilience

Microsoft Security Blog

2025-12-08

Microsoft announced a new collaboration with Beazley naming them an incident response partner to strengthen cyber resilience by aligning with ecosystem partners and improving security for customers.

October (2)

security: The CISO imperative: Building resilience in an era of accelerated cyberthreats

Microsoft Security Blog

2025-10-22

Microsoft's Digital Defense Report 2025 highlights a changing cyberthreat landscape with a rise in financially motivated attacks and ongoing nation-state risks. The article argues that CISOs must focus on organizational response, adaptation, and resilience-building to meet accelerating threats.

security: Inside Microsoft Threat Intelligence: Calm in the chaos

Microsoft Security Blog

2025-10-06

Microsoft’s Incident Response team works effectively amid the disorder caused by fast-moving threat actors, treating compromised environments, missing data, and shaken confidence as the starting point for investigations, as described in the Microsoft Security Blog post "Inside Microsoft Threat Intelligence: Calm in the chaos."

September (1)

security: Retail at risk: How one alert uncovered a persistent cyberthreat​​

Microsoft Security Blog

2025-09-24

Microsoft's Cyberattack Series examines a retail incident where a single security alert exposed a persistent cyberthreat. Attackers exploited unpatched SharePoint vulnerabilities and compromised identities to infiltrate networks, causing widespread operational risk—echoed by industry statistics (60% operational disruptions, 43% breaches). Microsoft’s Detection and Response Team (DART) provided forensic analysis and actionable remediation guidance; the full report offers detailed findings and defensive recommendations.