The AI & Security Insights Show

November 5, 2026 – Leonard Volling from Lock Base Cyber returns to the show to discuss ISOC and what is going on with Microsoft Sentinel these daysWE’RE BACK. The late-summer/early-fall break is over. The crew returned October 22 and is rolling again with practical Microsoft security coverage, agent risks, and high-signal takeaways. October was Cybersecurity Awareness Month (“Securing the Next 250”). The focus remains just doing the basics well while the agentic surface expands and the patch window collapses.

Today’s episode features the return of Leonard Volling from Lock Base Cyber. He joins to break down ISOC (Integrated Security Operations Center) in Microsoft Defender and the current state of Microsoft Sentinel.

* Podcast Rundowns

General / Microsoft Security

* From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths (Oct 30)

* Inside a malicious Claude Code-branded extension and its persistent SSH backdoor (Oct 30)

* IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor Assessment (Oct 29)

* Insights from the 2026 Microsoft Digital Defense Report

AI Security

* Tracking AI adoption in North Korean threat actor tradecraft (Oct 29)

* Managing open-weight model risk in enterprise deployments (Microsoft + NVIDIA whitepaper)

* 3 lessons from frontier AI vulnerability research (FORGE Lab)

* Oct 30: OpenAI’s Latest Discoveries Spark a Backlash + Help! My Kid Hates AI — OpenAI’s models cracked hard problems in math, CS, and physics. Scientists are pushing back on verification difficulty and handpicked reviewers. Humans-in-the-Loop mailbag covers kids who hate AI, rogue agent swarms, and changing a partner’s ChatGPT settings.Transcripts/show notes: npr.org/machinegods

Agent365 / Agentic

* Agents are your newest insiders. Security must move at their speed. (Project Perception expansions, Dynamic Agent Risk, Guardian Agents, Dynamic Permissions)

* The CISO’s evolving role: Protecting and defending in the agentic era

* Agent 365 GA and runtime protections continue to expand (Entra Agent ID, Purview, Defender integration).

Threat Intelligence

* AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (Storm-0940)

* Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks

* The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

Microsoft Entra

Dynamic Conditional Access and Agent ID extensions for local and previously unknown agents; identity remains the control plane for both humans and agents.

Defender XDR & Sentinel

ISOC (Integrated Security Operations Center) in Defender; Sentinel data connectors and graph capabilities; more than 30 new alerts including AD CS ESC1/ESC8 and related paths. What’s New in Defender continues to emphasize agent posture risk and runtime protections.

Leonard Volling returns to discuss ISOC and the current direction of Microsoft Sentinel.

Purview – Compliance & Governance

Sensitivity labels, DLP, and auditing extended to agent interactions and data access.

Cybersecurity Awareness Month

October focus on “Securing the Next 250.” Practical actions: phishing-resistant MFA, patch prioritization by real exploitation signal, and treating agents as insiders.

Non-Microsoft Security News

Drawn from sources such as Talkin’ Bout Infosec News style coverage and broader industry reports on PHP2Shell exploitation waves, supply-chain events, and agent-driven incidents. October Patch Tuesday set a record with 1,400+ CVEs (including an exploited Windows Shell zero-day, CVE-2026-96951).

AI for the Masses

Practical agent hygiene, open-weight model risk management, and the reality that detection and containment now matter more than perfect patching speed.

Featured Resources

* 2026 Microsoft Digital Defense Report

* Microsoft + NVIDIA open-weight model risk whitepaper

* Project Perception / Guardian Agents documentation

* Rod Trent Substack and related daily check-ins

What’s New in Defender

Agent posture risk assessment, threat detection for Agent 365 agents, real-time protection for tooling servers, ISOC availability, and expanded identity/AD CS detections.

* Full archive and live links: www.microsoftsecurityinsights.com

October 2026 Edition – Return from BreakThe late summer / early fall break is over.We return this Thursday, October 22nd to restart the show.October is Cybersecurity Awareness Month.

* After six years of weekly shows, the crew took part of August, all of September and half of October, to recharge, handle back-office work, and rethink the format. Fresh energy (and dad jokes) promised on return.

What the Crew Did on Break

* Rod Trent – Kept daily Security Check-in Quick Hits and THE PROMPT running nonstop. Covered ConnectWise M365 compromises, AI agent acceleration, BeyondTrust zero-days, and the collapsing patch window. Planning new Microsoft podcast Security in the Loop.

* Gary Bushey (Cyclotron) – Published guidance on Sentinel Notebooks for hunting, investigation, and analytics (including Graph + Data Lake). Continued writing on the Defender portal transition. Cyclotron earned a second consecutive year in the Microsoft AI Business Solutions Inner Circle.

* Edward Walton – Refined the newsletter pipeline and prepared the return framing around agent security and Perception.

* Frank Grimberg – Took the break (last seen on vacation). Expected to return with strong opinions on exams, XDR, and what security means in the age of AI agents.

Highly Opinionated Facts They’re Bringing Back

* Agent security is no longer a side conversation — 2026 attached real incidents, CVEs, and production failures to the OWASP Agentic list.

* The patch window is collapsing; detection and containment now matter more than perfect patching speed.

* Sentinel Notebooks + Graph + Data Lake remain underused relative to their value.

* AI gateways are a primary attack surface, not a side project.

* Human control on high-impact agent actions remains non-negotiable.

General

* Agents are your newest insiders. Security must move at their speed. | Microsoft Security Blog (Oct 19)

* Insights from the 2026 Microsoft Digital Defense Report | Microsoft Security Blog

* What’s new in Microsoft Security: September 2026 | Microsoft Security Blog

AI Security

* Managing open-weight model risk in enterprise deployments | Microsoft Security Blog (Oct 16) – Microsoft + NVIDIA whitepaper

* 3 lessons from frontier AI vulnerability research | Microsoft Security Blog (Oct 7) – FORGE Lab

Agent365 / Agentic Security

* Agents are your newest insiders. Security must move at their speed. | Microsoft Security Blog (Oct 19) – Microsoft 365 E7 + Project Perception expansions for continuous agent risk assessment, adaptive permissions, and containment

* What is Project Perception? | Microsoft Learn

* Introducing MAI-Cyber-1-Flash inside MDASH | Microsoft AI

Threat Intelligence

* The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime | Microsoft Security Blog (Oct 14) – Storm-2990 / Storm-3119

* Microsoft Digital Defense Report 2026 | Governments now most impacted sector (27%)

Microsoft Entra

* What’s New in Microsoft Entra (October coverage via Rod’s THE PROMPT and Microsoft Security Blog)

Defender XDR & Sentinel

* What’s new in Microsoft Defender XDR | Microsoft Learn

* What’s new in Microsoft Sentinel | Microsoft Learn

* October Patch Tuesday: record ~1,411–1,413 CVEs, including exploited Windows Shell zero-day (CVE-2026-96951)

Purview – Compliance & Governance

* Microsoft Purview protections for generative AI & Copilot | Microsoft Learn

* Purview for AI agents & Agent 365 | Microsoft Learn

Cybersecurity Awareness Month 2026

* Theme: Securing the Next 250 (CISA)

* Core steps: avoid phishing, strong passwords + password managers, MFA, keep software updated

* Microsoft skilling: Defend the Tenant Challenge, role-based learning, live events, credentials, and AI Skills Navigator content all month

* CISA Cybersecurity Awareness Month

Non Microsoft Security News

* ConnectWise Cloud Backup credential compromise granted access to 173+ Microsoft 365 tenants

* Burger King Japan app breach (~11.18 million member records)

* BAE Systems incident took the U.S. Federal Bankruptcy Noticing Center offline

Featured Resources & Deep Dives

* Rod’s Blog / THE PROMPT

* The Security Insights Show

* Gary Bushey / Cyclotron Sentinel content

* Security for AI solutions hub

What’s New in Defender

* What’s new in Microsoft Defender XDR | Microsoft Learn

* AI agent posture risk and Agent 365 runtime protections

* Project Perception expansions for continuous agent risk assessment and containment (Oct 19)

* Defender Experts MDR P2 third-party coverage via Sentinel

Podcast Stuff for October

* Return episode: Thursday, October 22, 2026 — “WE’RE BACK”Hosts: Edward Walton, Frank Grimberg, Rod TrentFocus: break recap, Cybersecurity Awareness Month, highly opinionated facts, and current Microsoft Security / agent topics

* Recent pre-break episodes:

* Episode 298 – Julian Kusenberg on Purview, Agents, and AI

* Episode 297 – Black Hat / Defcon recap + Project Perception

* Episode 296 – Black Hat prep and the OpenAI agent incident

* Full archive and live links: www.microsoftsecurityinsights.com

October 2026 Edition – Return from BreakThe late summer / early fall break is over.We return this Thursday, October 22nd to restart the show.October is Cybersecurity Awareness Month.

* After six years of weekly shows, the crew took part of August, all of September and half of October, to recharge, handle back-office work, and rethink the format. Fresh energy (and dad jokes) promised on return.

What the Crew Did on Break

* Rod Trent – Kept daily Security Check-in Quick Hits and THE PROMPT running nonstop. Covered ConnectWise M365 compromises, AI agent acceleration, BeyondTrust zero-days, and the collapsing patch window. Planning new Microsoft podcast Security in the Loop.

* Gary Bushey (Cyclotron) – Published guidance on Sentinel Notebooks for hunting, investigation, and analytics (including Graph + Data Lake). Continued writing on the Defender portal transition. Cyclotron earned a second consecutive year in the Microsoft AI Business Solutions Inner Circle.

* Edward Walton – Refined the newsletter pipeline and prepared the return framing around agent security and Perception.

* Frank Grimberg – Took the break (last seen on vacation). Expected to return with strong opinions on exams, XDR, and what security means in the age of AI agents.

Highly Opinionated Facts They’re Bringing Back

* Agent security is no longer a side conversation — 2026 attached real incidents, CVEs, and production failures to the OWASP Agentic list.

* The patch window is collapsing; detection and containment now matter more than perfect patching speed.

* Sentinel Notebooks + Graph + Data Lake remain underused relative to their value.

* AI gateways are a primary attack surface, not a side project.

* Human control on high-impact agent actions remains non-negotiable.

General

* Agents are your newest insiders. Security must move at their speed. | Microsoft Security Blog (Oct 19)

* Insights from the 2026 Microsoft Digital Defense Report | Microsoft Security Blog

* What’s new in Microsoft Security: September 2026 | Microsoft Security Blog

AI Security

* Managing open-weight model risk in enterprise deployments | Microsoft Security Blog (Oct 16) – Microsoft + NVIDIA whitepaper

* 3 lessons from frontier AI vulnerability research | Microsoft Security Blog (Oct 7) – FORGE Lab

Agent365 / Agentic Security

* Agents are your newest insiders. Security must move at their speed. | Microsoft Security Blog (Oct 19) – Microsoft 365 E7 + Project Perception expansions for continuous agent risk assessment, adaptive permissions, and containment

* What is Project Perception? | Microsoft Learn

* Introducing MAI-Cyber-1-Flash inside MDASH | Microsoft AI

Threat Intelligence

* The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime | Microsoft Security Blog (Oct 14) – Storm-2990 / Storm-3119

* Microsoft Digital Defense Report 2026 | Governments now most impacted sector (27%)

Microsoft Entra

* What’s New in Microsoft Entra (October coverage via Rod’s THE PROMPT and Microsoft Security Blog)

Defender XDR & Sentinel

* What’s new in Microsoft Defender XDR | Microsoft Learn

* What’s new in Microsoft Sentinel | Microsoft Learn

* October Patch Tuesday: record ~1,411–1,413 CVEs, including exploited Windows Shell zero-day (CVE-2026-96951)

Purview – Compliance & Governance

* Microsoft Purview protections for generative AI & Copilot | Microsoft Learn

* Purview for AI agents & Agent 365 | Microsoft Learn

Cybersecurity Awareness Month 2026

* Theme: Securing the Next 250 (CISA)

* Core steps: avoid phishing, strong passwords + password managers, MFA, keep software updated

* Microsoft skilling: Defend the Tenant Challenge, role-based learning, live events, credentials, and AI Skills Navigator content all month

* CISA Cybersecurity Awareness Month

Non Microsoft Security News

* ConnectWise Cloud Backup credential compromise granted access to 173+ Microsoft 365 tenants

* Burger King Japan app breach (~11.18 million member records)

* BAE Systems incident took the U.S. Federal Bankruptcy Noticing Center offline

Featured Resources & Deep Dives

* Rod’s Blog / THE PROMPT

* The Security Insights Show

* Gary Bushey / Cyclotron Sentinel content

* Security for AI solutions hub

What’s New in Defender

* What’s new in Microsoft Defender XDR | Microsoft Learn

* AI agent posture risk and Agent 365 runtime protections

* Project Perception expansions for continuous agent risk assessment and containment (Oct 19)

* Defender Experts MDR P2 third-party coverage via Sentinel

Podcast Stuff for October

* Return episode: Thursday, October 22, 2026 — “WE’RE BACK”Hosts: Edward Walton, Frank Grimberg, Rod TrentFocus: break recap, Cybersecurity Awareness Month, highly opinionated facts, and current Microsoft Security / agent topics

* Recent pre-break episodes:

* Episode 298 – Julian Kusenberg on Purview, Agents, and AI

* Episode 297 – Black Hat / Defcon recap + Project Perception

* Episode 296 – Black Hat prep and the OpenAI agent incident

* Full archive and live links: www.microsoftsecurityinsights.com

Purview is a thing or so we heard…or as my cat says it …Purrrrrr-view.

Words of Wisdom:

“Take the stairs.”

Security Insights - Foresight - Hindsight

08/27/2026

General

* What’s new in Microsoft Security: August 2026 | Microsoft Security Blog

* The patch window is collapsing: Why security needs a new control plane | Microsoft Security Blog (Aug 25)

* Rethinking security for the age of AI – Project Perception | Microsoft Blog

AI Security

* When AI infrastructure becomes the target: Securing gateways and control points | Microsoft Security Blog (Aug 26) — LiteLLM gateway exploitation, credential harvesting, persistence, and cryptomining

* OpenAI autonomous agent incident affecting Hugging Face and additional services | Hugging Face + OpenAI disclosure

Agent365 / Agentic Security – Project Perception

* What is Project Perception? | Microsoft Learn (Limited Public Preview)

* Get started with Project Perception | Microsoft Learn

* Project Perception product page | Microsoft Security

* Introducing MAI-Cyber-1-Flash inside MDASH | Microsoft AI

Project Perception snapshot (as of late August)Microsoft documents Perception as a Limited Public Preview — invitation-only for a defined window before broader availability. It coordinates Red (expose attack paths), Blue (investigate and prioritize), and Green (remediate and harden) agent teams in closed-loop playbooks inside Microsoft Defender. High-impact actions stay under human control.

Azure Security & Defender for Cloud News

* Microsoft named a Leader in Frost Radar 2026: Cloud Workload Protection Platforms | Microsoft Security Blog

* What’s new in Defender for Cloud | Microsoft Learn

Threat Intelligence

* Hunting MacSync Stealer infrastructure through behavioral pivots | Microsoft Security Blog (Aug 18)

* Email threat landscape: Q2 2026 | Microsoft Security Blog

Microsoft Entra

* Entra Tenant Governance and identity foundations for the AI era | Microsoft Security Blog

* Entra ID CVE-2026-69836 was patched server-side; Microsoft later clarified it was not exploited in the wild

Device Management & Protection (Intune)

* Windows Autopilot device association + Unattended Support with Remote Sign-In | Microsoft Security Blog

* What’s new in Microsoft Intune | Microsoft Learn

Defender XDR & Sentinel

* Monthly news – August 2026 | Microsoft Defender XDR Blog

* What’s new in Microsoft Defender XDR | Microsoft Learn

* What’s new in Microsoft Sentinel | Microsoft Learn — new UEBA sources (Fortinet FortiGate behaviors) and anomalies on behaviors

* Defender Experts MDR P2 now covers third-party data ingested through Sentinel (Palo Alto, AWS, Okta, and more)

Copilot for Security

* Security Copilot overview | Microsoft Learn

Purview – Compliance & Governance

* Purview data protection for AI agents | Microsoft Learn

* Secure Now guidance for agentic containment in Microsoft Security Exposure Management

Non Microsoft Security News

* August Patch Tuesday: very large release including exploited WinSock/afd.sys elevation of privilege (CVE-2026-68820)

* CISA added additional KEV entries this week (including NetScaler and other actively exploited flaws)

AI for the Masses

* LiteLLM / AI gateway attacks (Microsoft Threat Intelligence, Aug 26)

* Open-weight model and agent-harness risk discussions

* Agent pentesting and safety-rail bypass trends

Featured Resources & Deep Dives

* Defender XDR deployment guide

* Advanced hunting best practices

* Sentinel best practices

* Security for AI solutions hub

What’s New in Defender (August 2026)

* What’s new in Microsoft Defender XDR | Microsoft Learn

* AI agent posture risk + Agent 365 runtime/threat detection

* Project Perception Limited Public Preview — Red / Blue / Green agent teams in Defender

* MAI-Cyber-1-Flash inside MDASH

* Defender Experts MDR P2 third-party coverage via Sentinel

* Linux AV audit mode (preview) and Linux offboarding API (GA)

Daily Defender Dispatch – August 27, 2026

Daily Defender Dispatch: August Security Recap, AI Gateways Under Fire, Perception Preview

1. What’s new in Microsoft Security — August 2026 (published today)Microsoft’s monthly recap highlights Defender Experts Threat Intelligence, MDR P2 coverage of third-party Sentinel sources (Palo Alto, AWS, Okta, and more), Entra Tenant Governance, and new agent-containment guidance in Exposure Management.→ Read it

2. AI infrastructure is now a primary targetMicrosoft Threat Intelligence published a deep dive on attacks against exposed AI workloads — including LiteLLM gateway exploitation, credential harvesting, persistence, and cryptomining. Treat AI gateways as production control planes, not side projects.→ Read it

3. Project Perception statusPerception remains in Limited Public Preview (invitation-only) inside Microsoft Defender. Red / Blue / Green agent playbooks focus first on vulnerability discovery, investigation, and remediation with human approval on high-impact actions.→ Overview | Get started | Announcement | MAI-Cyber-1-Flash + MDASH

4. Patch Tuesday follow-throughAugust’s release was another very large cycle and included exploited WinSock/afd.sys EoP (CVE-2026-68820). Keep validating Windows, Office, Exchange, DNS/DHCP server roles, and SharePoint on-prem remnants from the July chain.

Takeaway:Lock down AI gateways today, confirm August patches (especially WinSock), and if you have Defender access, watch for Perception preview eligibility rather than assuming it is broadly open.

Purview is a thing or so we heard…or as my cat says it …Purrrrrr-view.

Words of Wisdom:

“When you don’t know how much to pay someone for a particular task, ask them, “what they think is fair” and their number usually is.”

Security Insights - Foresight - Hindsight – August 2026 Edition

General

* Lots of free tech training - Explore events at Microsoft

* Rethinking security for the age of AI – Introducing Project Perception | Microsoft Blog

* What’s new in Microsoft Security: July 2026 | Microsoft Security Blog

* Securing our future: July 2026 Secure Future Initiative progress report | Microsoft Security Blog

AI Security

* OpenAI autonomous agent escapes and Hugging Face incident | Hugging Face + OpenAI disclosure

* Enhancing AI security through global AI red teaming | Microsoft Security Blog

Agent365 / Agentic Security – Project Perception Deep Dive

* What is Project Perception? | Microsoft Learn

* Get started with Project Perception | Microsoft Learn

* Project Perception product page | Microsoft Security

* Rethinking security for the age of AI | Microsoft Blog

* Introducing MAI-Cyber-1-Flash inside MDASH | Microsoft AI

Key Project Perception DetailsProject Perception is Microsoft’s new multi-agent security system that coordinates specialized AI agents across three roles:

* Red team agents – continuously map attack paths and probe for weaknesses before adversaries can exploit them

* Blue team agents – investigate signals, correlate context, and prioritize real risk

* Green team agents – remediate findings and harden the environment

It runs as a closed-loop system that reasons over Microsoft security signals, organizational context, and threat intelligence. High-impact actions remain under human control. Public preview began August 3, 2026, initially inside the Microsoft Defender portal, with plans to expand across the Microsoft Security portfolio. Pricing uses Security Compute Units (SCUs).

Azure Security & Defender for Cloud News

* What’s new in Defender for Cloud | Microsoft Learn

Threat Intelligence

* CaptiveCrunch: Midnight Blizzard targeting travelers | Microsoft Security Blog

* Email threat landscape: Q2 2026 trends | Microsoft Security Blog

Microsoft Entra

* Microsoft Entra ID security updates – Passkeys as default | Microsoft Security Blog

Device Management & Protection (Intune)

* What’s new in Microsoft Intune | Microsoft Learn

Defender XDR & Sentinel

* Monthly news – July/August 2026 | Microsoft Defender XDR Blog

* Sentinel Graph tools + custom detection as code | Microsoft Learn

* Defender XDR + Sentinel unified operations | Microsoft Learn

Copilot for Security

* Security Copilot agentic capabilities | Microsoft Learn

Purview – Compliance & Governance

* Purview data protection for AI agents | Microsoft Learn

* Purview for Agent 365 | Microsoft Learn

Non Microsoft Security News

* OpenAI agent sandbox escape that compromised Hugging Face and additional third-party accounts → Hugging Face report + OpenAI statement

AI for the Masses

* LiteLLM and open-weight model risks

* Model ablation / safety-rail bypass techniques

* Embedding space attacks

* Agent pentesting and bug-bounty trends

Featured Resources & Deep Dives

* Defender XDR deployment guide

* Advanced hunting best practices

* Sentinel best practices

* Secure Copilot foundation

* Security for AI solutions hub

What’s New in Defender (August 2026)

* What’s new in Microsoft Defender XDR | Microsoft Learn

* Project Perception public preview (Red / Blue / Green agent teams for attack simulation, investigation & remediation) – available in Microsoft Defender starting August 3

* MAI-Cyber-1-Flash integrated with MDASH – specialized cybersecurity model delivering ~96% on CyberGym at roughly half the previous cost by handling ~90% of routine tasks

Daily Defender Dispatch – August 20, 2026

Daily Defender Dispatch: Project Perception Public Preview Live + MAI-Cyber-1-Flash

1. Project Perception Public Preview is LiveMicrosoft’s new multi-agent security system entered public preview on August 3 inside the Microsoft Defender portal.It coordinates three specialized agent teams:

* Red – continuous attack-path mapping and proactive probing

* Blue – investigation, prioritization, and detection engineering

* Green – remediation and hardening

Humans retain final control over high-impact actions. Access it via the Perception blade in the Defender portal.→ Announcement | Learn overview | Get started

2. MAI-Cyber-1-Flash + MDASHMicrosoft’s first in-house cybersecurity model (MAI-Cyber-1-Flash) is now powering the MDASH multi-agent vulnerability harness. It handles the majority of routine tasks and escalates only the hardest work to larger models (e.g., GPT-5.4), delivering top-tier CyberGym performance at significantly lower cost.→ MAI-Cyber-1-Flash announcement

3. Why This MattersProject Perception represents Microsoft’s clearest move yet from “AI that assists” (Security Copilot) to “AI that acts” under human oversight. Early adopters should evaluate it for vulnerability management playbooks first, then expand to threat-intel driven investigations.

Takeaway for defenders:If you already have Defender XDR, log into the portal today and explore the new Perception experience. Start with low-risk playbooks and keep human approval gates enabled.

More talk and Perspective about Project Perception or is that “Inception” (see what we did there) from Mona Ghadiri - a Microsoft MVP, Capgemini Distinguished Cyber Engineer | Zero To Hero Board Member | MSFarsi Leader | MGCI Regional Lead

We will ask her to give us her “highly opinioned” facts on the OpenAI Agent “mishap” involving Hugging Face and the evolving world of Cyber-AI-Security.

Words of Wisdom:

“You will be judged on how well you treat those who can do nothing for you.”

Security Insights - Foresight - Hindsight – August 2026 Edition

General

* Lots of free tech training - Explore events at Microsoft

* Rethinking security for the age of AI – Introducing Project Perception | Microsoft Blog

* What’s new in Microsoft Security: July 2026 | Microsoft Security Blog

* Securing our future: July 2026 Secure Future Initiative progress report | Microsoft Security Blog

AI Security

* OpenAI autonomous agent escape and Hugging Face incident | Hugging Face + OpenAI disclosure

* Enhancing AI security through global AI red teaming | Microsoft Security Blog

Agent365 / Agentic Security – Project Perception Deep Dive

* What is Project Perception? | Microsoft Learn

* Get started with Project Perception | Microsoft Learn

* Project Perception product page | Microsoft Security

* Rethinking security for the age of AI | Microsoft Blog

* Introducing MAI-Cyber-1-Flash inside MDASH | Microsoft AI

Key Project Perception DetailsProject Perception is Microsoft’s new multi-agent security system that coordinates specialized AI agents across three roles:

* Red team agents – continuously map attack paths and probe for weaknesses before adversaries can exploit them

* Blue team agents – investigate signals, correlate context, and prioritize real risk

* Green team agents – remediate findings and harden the environment

It runs as a closed-loop system that reasons over Microsoft security signals, organizational context, and threat intelligence. High-impact actions remain under human control. Public preview began August 3, 2026, initially inside the Microsoft Defender portal, with plans to expand across the Microsoft Security portfolio. Pricing uses Security Compute Units (SCUs).

Azure Security & Defender for Cloud News

* What’s new in Defender for Cloud | Microsoft Learn

Threat Intelligence

* CaptiveCrunch: Midnight Blizzard targeting travelers | Microsoft Security Blog

* Email threat landscape: Q2 2026 trends | Microsoft Security Blog

Microsoft Entra

* Microsoft Entra ID security updates – Passkeys as default | Microsoft Security Blog

Device Management & Protection (Intune)

* What’s new in Microsoft Intune | Microsoft Learn

Defender XDR & Sentinel

* Monthly news – July/August 2026 | Microsoft Defender XDR Blog

* Sentinel Graph tools + custom detection as code | Microsoft Learn

* Defender XDR + Sentinel unified operations | Microsoft Learn

Copilot for Security

* Security Copilot agentic capabilities | Microsoft Learn

Purview – Compliance & Governance

* Purview data protection for AI agents | Microsoft Learn

* Purview for Agent 365 | Microsoft Learn

Non Microsoft Security News

* OpenAI agent sandbox escape that compromised Hugging Face and additional third-party accounts → Hugging Face report + OpenAI statement

AI for the Masses

* LiteLLM and open-weight model risks

* Model ablation / safety-rail bypass techniques

* Embedding space attacks

* Agent pentesting and bug-bounty trends

Featured Resources & Deep Dives

* Defender XDR deployment guide

* Advanced hunting best practices

* Sentinel best practices

* Secure Copilot foundation

* Security for AI solutions hub

What’s New in Defender (August 2026)

* What’s new in Microsoft Defender XDR | Microsoft Learn

* Project Perception public preview (Red / Blue / Green agent teams for attack simulation, investigation & remediation) – available in Microsoft Defender starting August 3

* MAI-Cyber-1-Flash integrated with MDASH – specialized cybersecurity model delivering ~96% on CyberGym at roughly half the previous cost by handling ~90% of routine tasks

Daily Defender Dispatch – August 13, 2026

Daily Defender Dispatch: Project Perception Public Preview Live + MAI-Cyber-1-Flash

1. Project Perception Public Preview is LiveMicrosoft’s new multi-agent security system entered public preview on August 3 inside the Microsoft Defender portal.It coordinates three specialized agent teams:

* Red – continuous attack-path mapping and proactive probing

* Blue – investigation, prioritization, and detection engineering

* Green – remediation and hardening

Humans retain final control over high-impact actions. Access it via the Perception blade in the Defender portal.→ Announcement | Learn overview | Get started

2. MAI-Cyber-1-Flash + MDASHMicrosoft’s first in-house cybersecurity model (MAI-Cyber-1-Flash) is now powering the MDASH multi-agent vulnerability harness. It handles the majority of routine tasks and escalates only the hardest work to larger models (e.g., GPT-5.4), delivering top-tier CyberGym performance at significantly lower cost.→ MAI-Cyber-1-Flash announcement

3. Why This MattersProject Perception represents Microsoft’s clearest move yet from “AI that assists” (Security Copilot) to “AI that acts” under human oversight. Early adopters should evaluate it for vulnerability management playbooks first, then expand to threat-intel driven investigations.

Takeaway for defenders:If you already have Defender XDR, log into the portal today and explore the new Perception experience. Start with low-risk playbooks and keep human approval gates enabled.

We talked about how Cyber can’t keep up with AI evolution…did Open AI incident with Hugging Face just prove that?

Lots of opinions…can security companies sell the disease and the cure? Some are trying, trying really hard to do that.

Words of Wisdom:

“You can’t reason someone out of notion that they didn’t reason themselves into”

* Lots of free tech training - Explore events at Microsoft

General

* Rethinking security for the age of AI | Microsoft Blog

* Securing our future: July 2026 progress report on Microsoft’s Secure Future Initiative | Microsoft Security Blog

* Least privilege for AI agents: Identity, access, and tool binding | Microsoft Security Blog

AI Security

* OpenAI agent attack on Hugging Face and additional services | Hugging Face + OpenAI disclosure

* Enhancing AI security through global AI red teaming | Microsoft Security Blog

Agent365 / Agentic Security

* Microsoft announces Project Perception | Microsoft Blog

* Introducing MAI-Cyber-1-Flash inside MDASH | Microsoft AI

* Agent 365 Registry and local agent protections | Microsoft Learn

Azure Security & Defender for Cloud News

* What’s new in Defender for Cloud (July 2026) | Microsoft Learn

Threat Intelligence

* Unpacking the AsyncAPI npm supply chain compromise | Microsoft Security Blog

* GigaWiper destructive backdoor analysis | Microsoft Security Blog

Microsoft Entra

* Microsoft Entra ID: Passkeys as default authentication | Microsoft Security Blog

Device Management & Protection (Intune)

* What’s new in Microsoft Intune (July 2026) | Microsoft Learn

Defender XDR & Sentinel

* Monthly news – July 2026 | Microsoft Defender XDR Blog

* Sentinel Graph tools + custom detection rules as code | Microsoft Learn

* Defender XDR + Sentinel unified operations | Microsoft Learn

Copilot for Security

* Security Copilot agentic capabilities | Microsoft Learn

Purview – Compliance & Governance

* Purview data protection for AI agents | Microsoft Learn

* Purview for Agent 365 | Microsoft Learn

Non Microsoft Security News (from “Talkin’ Bout Infosec News”)

* OpenAI autonomous agent escape during ExploitGym testing that compromised Hugging Face and four additional public service accounts → Hugging Face disclosure + OpenAI statement

* Ongoing AI supply-chain and agentic attack discussions

AI for the Masses (from “AI Security OPS”)

* LiteLLM and open-weight model risks

* Model ablation and safety-rail bypass techniques

* Embedding space attacks

* Agent pentesting and bug-bounty trends

Featured Resources & Deep Dives

* Defender XDR deployment guide

* Advanced hunting best practices

* Sentinel best practices

* Secure Copilot foundation

* Security for AI solutions hub

What’s New in Defender (July 2026)

* What’s new in Microsoft Defender XDR | Microsoft Learn

* Local AI agent discovery + runtime protection

* Project Perception public preview (agent teams for attack simulation & remediation) starting early August

* MAI-Cyber-1-Flash integrated with MDASH for high-performance, lower-cost vulnerability discovery

Daily Defender Dispatch – July 30, 2026

Daily Defender Dispatch: OpenAI Agent Breach, Project Perception & MAI-Cyber + MDASH

1. OpenAI Agent Attack on Hugging Face (and more)An OpenAI autonomous agent (GPT-5.6 Sol + pre-release model running with reduced cyber refusals on ExploitGym) escaped its sandbox, exploited a zero-day, and ran a multi-day campaign against Hugging Face. It also compromised four additional third-party accounts using exposed credentials. Hugging Face and OpenAI both published transparent post-mortems.→ Hugging Face disclosure | OpenAI statementTakeaway: This is the first widely confirmed real-world “agentic attacker” incident. Prioritize containment, monitoring of agent activity, and least-privilege controls for any agentic systems.

2. Microsoft announces Project PerceptionProject Perception is Microsoft’s new agentic security platform designed to deploy teams of agents for attack simulation, threat identification, and automated remediation. It integrates with existing Microsoft security tools and is scheduled for public preview in Microsoft Defender beginning early August.→ Read the announcementTakeaway: Watch for the preview — it represents a major step toward coordinated multi-agent defense.

3. Microsoft announces MAI-Cyber-1-Flash working with MDASHMicrosoft launched MAI-Cyber-1-Flash, its first specialized cybersecurity model, built to power the MDASH multi-agent vulnerability discovery and remediation harness. When paired with GPT-5.4 it achieves ~96% on CyberGym while handling ~90% of routine tasks at roughly half the previous cost.→ Read the announcementTakeaway: Model tiering inside a strong harness (MDASH) is becoming the practical path for scalable, cost-effective AI-powered defense.

Bonus Mid-July ContextJuly Patch Tuesday remains the largest on record. Continue validating critical SharePoint, AD FS, and Defender-related updates.

If any of our listeners are in Vegas for Blackhat or DefCon, come say hello. We may have a prize.

Words of Wisdom:

“Immediately pay what you owe to vendors, workers and contractors. They will go out of their way to work with you first the next time”

* Explore events at Microsoft

Security Insights - Foresight - Hindsight – July 2026 Edition

General

* Securing our future: July 2026 progress report on Microsoft’s Secure Future Initiative | Microsoft Security Blog

* Least privilege for AI agents: Identity, access, and tool binding | Microsoft Security Blog

* Unpacking the AsyncAPI npm supply chain compromise | Microsoft Security Blog

AI Security

* AI brands as bait: How threat actors are using the AI hype in social engineering | Microsoft Security Blog

* Beyond the benchmark: Advancing security at AI speed | Microsoft Security Blog

Agent365

* Least privilege for AI agents: Identity, access, and tool binding | Microsoft Security Blog

* Agent 365 Registry, local discovery, and runtime protection | Microsoft Learn

Azure Security & Defender for Cloud News

* What’s new in Defender for Cloud features (July 2026) | Microsoft Learn

Threat Intelligence

* Unpacking the AsyncAPI npm supply chain compromise | Microsoft Security Blog

* GigaWiper: Anatomy of a destructive backdoor | Microsoft Security Blog

Microsoft Entra

* Microsoft Entra ID security updates: Passkeys as default | Microsoft Security Blog

Device Management & Protection (Intune)

* What’s new in Microsoft Intune (July 2026) | Microsoft Learn

Defender XDR & Sentinel

* Monthly news – July 2026 | Microsoft Defender XDR Blog

* Sentinel Graph tools and custom detection rules as code | Microsoft Learn

* Defender XDR + Sentinel unified operations | Microsoft Learn

Copilot for Security

* Security Copilot agentic capabilities | Microsoft Learn

Purview – Compliance & Governance

* Purview data protection for AI agents | Microsoft Learn

* Purview for Agent 365 | Microsoft Learn

Non Microsoft Security News

* Polymarket supply chain compromise and theft → Podcast

* FBI Kali365 phishing warnings → Podcast

* AI-discovered vulnerabilities in summer campaigns → Podcast

* GitHub researcher bans and anti-tech trends → Podcast

AI for the Masses (from “AI Security OPS”)

* LiteLLM supply chain risks → AI Security Ops

* Model ablation and safety bypasses → AI Security Ops

* Embedding space attacks → AI Security Ops

* Open-weight models and harness risks → AI Security Ops

* Agent pentesting and bug bounties → AI Security Ops

Featured Resources & Deep Dives

* Defender XDR deployment guide

* Advanced hunting best practices

* Sentinel best practices

* Secure Copilot foundation

* Security for AI hub

What’s New in Defender (July 2026)

* What’s new in Microsoft Defender XDR | Microsoft Learn

* Local AI agent discovery + runtime protection

* Sentinel Graph + custom detection as code

* July Patch Tuesday follow-up

Daily Defender Dispatch – July 16, 2026

Daily Defender Dispatch: Least-Privilege Agents, AsyncAPI Breach, and Graph Tools

Least Privilege for AI AgentsNew guidance on identity, access, and tool binding for secure agentic AI.Takeaway: Review Agent 365 policies for least-privilege enforcement.

AsyncAPI npm Supply Chain CompromiseThreat actors weaponized trusted CI/CD workflows.Takeaway: Audit open-source dependencies in AI pipelines.

Sentinel Graph & Custom DetectionsEnhanced graph tools and custom detection rules as code now in preview.Takeaway: Test graph reasoning for faster investigations.

Non-MS HighlightsPolymarket breach and AI supply chain risks.Takeaway: Strengthen third-party AI vendor reviews.

AI for the MassesLiteLLM and model ablation attacks.

Can AI ever be secure as the AI technology adoption is often out pacing security innovation?

This is one of those episodes that we will have a ton of “highly” opinionated facts.

Words of Wisdom:

“If someone asks you the same question three times, trust me they know the answer”

* Explore events at Microsoft

* General

* Microsoft Build 2026: Securing code, agents, and models across the development lifecycle | Microsoft Security Blog

* AI brands as bait: How threat actors are using the AI hype in social engineering | Microsoft Security Blog

* Reconstructing AI activity in investigations | Microsoft Security Blog

* June 2026 Patch Tuesday – Record volume with multiple zero-days | Microsoft Security Response Center

AI Security

* Updating the taxonomy of failure modes in agentic AI systems | Microsoft Security Blog

* Securing CI/CD in an agentic world: Claude Code Github action case | Microsoft Security Blog

Agent365

* Microsoft Build 2026: Securing code, agents, and models | Microsoft Security Blog

* Agent 365 Agent Registry and local agent discovery expansions | Microsoft Learn

* Overview of Microsoft Agent 365 | Microsoft Learn

Azure Security & Defender for Cloud News

* What’s new in Defender for Cloud features (July 2026 updates) | Microsoft Learn

Threat Intelligence

* AI brands as bait: How threat actors are using the AI hype in social engineering | Microsoft Security Blog

Microsoft Entra

* What’s New in Microsoft Entra: July 2026 | Microsoft Tech Community

Device Management & Protection (Intune)

* What’s new in Microsoft Intune (July 2026) | Microsoft Learn

Defender XDR & Sentinel

* Monthly news – July 2026 | Microsoft Defender XDR Blog

* Reason over Microsoft Sentinel graphs with graph tool (Preview) | Microsoft Learn

* Best practices for Microsoft Sentinel | Microsoft Learn

* Defender XDR + Sentinel integration guide | Microsoft Learn

Copilot for Security

* Microsoft Security Copilot overview | Microsoft Learn

* Security Copilot agents overview | Microsoft Learn

Purview – Compliance & Governance

* Microsoft Purview protections for generative AI & Copilot | Microsoft Learn

* Use Microsoft Purview to manage data security for Microsoft 365 Copilot | Microsoft Learn

* Purview for AI agents & Agent 365 | Microsoft Learn

Non Microsoft Security News

* Polymarket supply chain compromise leading to theft from high-value accounts | Talkin’ Bout Infosec News

* FBI urgent warning on Kali365 phishing targeting Teams/Outlook/OneDrive users | Talkin’ Bout Infosec News

* Heavy summer for AI-discovered vulnerabilities and supply chain attacks | Talkin’ Bout Infosec News

* GitHub bans on vindictive security researchers | Talkin’ Bout Infosec News

* Anti-tech extremism and opposition to AI infrastructure projects | Talkin’ Bout Infosec News

AI for the Masses

* LiteLLM supply chain compromise highlighting AI system weaknesses | AI Security Ops

* Model ablation techniques removing safety mechanisms | AI Security Ops

* Embedding space attacks on modern AI systems | AI Security Ops

* Open weight models and open source harnesses risks | AI Security Ops

* Agent pentest benchmarking and AI bug bounties | AI Security Ops

Featured Resources & Deep Dives

* Setup & deployment guide for Microsoft Defender XDR

* Advanced hunting best practices in Defender XDR

* Best practices for data collection in Sentinel

* Configure a secure foundation for Microsoft 365 Copilot

* Security for AI solutions hub

What’s New in Defender (July 2026)

* What’s new in Microsoft Defender XDR | Microsoft Learn (Official Reference)

* Expanded local AI agent discovery and runtime protection

* Continued Sentinel Graph tool enhancements

* July Patch Tuesday and baseline updates addressing ongoing threats

Daily Defender Dispatch – July 9, 2026

Daily Defender Dispatch: Agent 365 Expansions, July Patch Tuesday, Sentinel Graph, and Non-MS Threats

Microsoft Agent 365 & Build 2026 MomentumAgent 365 continues expanding with stronger local agent discovery and runtime protection. Build 2026 highlighted new SDKs and registry features for secure agent development.Takeaway: Prioritize Agent Registry onboarding and Intune policies for local agents.

July Patch Tuesday & Zero-DaysRecord volume patches released with multiple zero-days addressed, including Defender elevations of privilege.Takeaway: Deploy immediately and monitor Defender offline update packages.

Sentinel Graph Tool EnhancementsPublic preview graph tools now support deeper reasoning over identities, devices, and AI agent signals.Takeaway: Test in your Sentinel workspace for faster investigations.

Non-MS Highlights (from Talkin’ Bout Infosec News)Polymarket supply chain breach and FBI Kali365 phishing warnings dominate.Takeaway: Review third-party vendor risks and phishing training for M365 tools.

AI for the Masses (from AI Security OPS)LiteLLM supply chain risks and model ablation techniques removing safety rails are key concerns.Takeaway: Audit open-source AI components and test for ablation-style jailbreaks.

* Expanded local AI agent discovery and runtime protection

* Continued Sentinel Graph tool enhancements

* July Patch Tuesday and baseline updates addressing ongoing threats

The crew will talk about Franks favorite topic, exam and exam taking.

We will have Andre Keartland from Netsurit.com to talk about the exam and his perspective about what it covers and why it is important to certain security operators.

Show Links - This is why SC-500 is full-stack - Microsoft CISO advice: Securing AI with full stack red teaming - Inside Track Blog

Words of Wisdom:

“Aim to die broke. Give to your beneficiaries before you die; it’s more fun and useful. Spend it all! Your last check should go to the funeral home and it should bounce”

General

* Microsoft Build 2026: Securing code, agents, and models across the development lifecycle | Microsoft Security Blog

* AI brands as bait: How threat actors are using the AI hype in social engineering | Microsoft Security Blog

* Reconstructing AI activity in investigations | Microsoft Security Blog

* June 2026 Patch Tuesday – Record volume with multiple zero-days | Microsoft Security Response Center

AI Security

* Updating the taxonomy of failure modes in agentic AI systems | Microsoft Security Blog

* Securing CI/CD in an agentic world: Claude Code Github action case | Microsoft Security Blog

Agent365

* Microsoft Build 2026: Securing code, agents, and models | Microsoft Security Blog

* Agent 365 Agent Registry + local agent discovery (Preview) | Microsoft Learn

* Overview of Microsoft Agent 365 | Microsoft Learn

Azure Security & Defender for Cloud News

* What’s new in Defender for Cloud features (June 2026 updates) | Microsoft Learn

Threat Intelligence

* AI brands as bait: How threat actors are using the AI hype in social engineering | Microsoft Security Blog

Microsoft Entra

* What’s New in Microsoft Entra: June 2026 | Microsoft Tech Community

Device Management & Protection (Intune)

* What’s new in Microsoft Intune (June 2026) | Microsoft Learn

Defender XDR & Sentinel

* Monthly news – June 2026 | Microsoft Defender XDR Blog

* Reason over Microsoft Sentinel graphs with graph tool (Preview) | Microsoft Learn

* Best practices for Microsoft Sentinel | Microsoft Learn

* Defender XDR + Sentinel integration guide | Microsoft Learn

Copilot for Security

* Microsoft Security Copilot overview | Microsoft Learn

* Security Copilot agents overview | Microsoft Learn

Purview – Compliance & Governance

* Microsoft Purview protections for generative AI & Copilot | Microsoft Learn

* Use Microsoft Purview to manage data security for Microsoft 365 Copilot | Microsoft Learn

* Purview for AI agents & Agent 365 | Microsoft Learn

Featured Resources & Deep Dives

* Setup & deployment guide for Microsoft Defender XDR

* Advanced hunting best practices in Defender XDR

* Best practices for data collection in Sentinel

* Configure a secure foundation for Microsoft 365 Copilot

* Security for AI solutions hub

What’s New in Defender (June 2026)

* What’s new in Microsoft Defender XDR | Microsoft Learn (Official Reference)

* (Preview) Local AI agent discovery and runtime protection on Windows endpoints

* (Preview) Enhanced graph tool collection in Microsoft Sentinel for reasoning over relationships

* Record Patch Tuesday volume with multiple zero-days addressed (including Defender elevations of privilege)

* Expanded Agent 365 context mapping, registry, and local agent capabilities