Microsoft Defender

No entries match these filters. Clear filters

1. changelog Oct 19, 2026 · issue 116
   • New supported platform Expanded local agent discovery to 35 additional agent types
2. changelog Sep 24, 2026 · issue 085

   Microsoft Defender adds AI-generated email detonation summaries via Microsoft Security Copilot for faster SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. investigations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
3. changelog Aug 27, 2026 · issue 058

   Defender Experts MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. now covers third-party data sources via Microsoft Sentinel, including Palo Alto Networks, AWS, and Okta.

   ⤢
   • Microsoft Defender Experts MDR now extends managed detection and responsemanaged detection and responseManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. and threat hunting to third-party data sources ingested through Microsoft Sentinel — including Palo Alto Networks, AWS, and Okta — available under the MDR P2 tier.
   • New Microsoft Defender Experts Threat Intelligence service delivers expert-led threat intelligence and actionable insights tailored to geography, industry, and risk profile.

   2 details in Everything

4. changelog Jul 30, 2026 · issue 031

   Microsoft Defender adds agentic SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. workflows, prompt injectionprompt injectionAn attack where text the model reads, such as a web page, file or tool result, carries instructions that override the user's. It is the main security risk for agents with tools. email protection, and unified cloud-agent posture in July 2026.

   ⤢ ⤢
   • Introduces Project Perception, a multi-agent autonomous defense system combining red, blue, and green team agents for continuous end-to-end security workflows.
   • New prompt injection protection (preview) identifies and isolates emails containing malicious AI instructions before delivery.
   • Unified posture and runtime protection for cloud agents across Microsoft Foundry, Microsoft Copilot Studio, and third-party agents in Microsoft Agent 365.
   • Microsoft Defender Threat Intelligence convergence and an enhanced Threat Intelligence Agent bring additional out-of-the-box intelligence and automation into the unified SecOpsSecOpsThe practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. workflow.
   • New interconnected experiences between Defender and Microsoft Entra enable SOC teams to disable compromised identities directly via an RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. mode enforcing least privilege.

   +2 more show less

   • Microsoft Defender Experts Threat Intelligence delivers human-led, curated threat insight tailored to each organization.
   • Microsoft Defender Experts MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. extends expert-run detection and response to third-party and multicloud signals via Microsoft Sentinel.

   7 details in Everything

5. changelog Jul 27, 2026 · issue 028

   Microsoft Defender's Project Perception launches public preview with coordinated red/blue/green AI agents for closed-loop autonomous defense.

   ⤢ ⤢ ⤢
   • Introduces Project Perception, a continuously learning defense system that coordinates three classes of specialized AI agents — red team (attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. discovery), blue team (investigation and risk reasoning), and green team (corrective action and hardening) — operating in a closed-loop across identities, endpoints, applications, data, clouds, and AI systems.
   • Launches software vulnerability management as the first Project Perception scenario, integrating MAI-Cyber-1-Flash into MDASH (software vulnerability multi-model agent team) for automated vulnerability discovery and prioritization.
   • MDASH with MAI-Cyber-1-Flash achieves 96% on the CyberGym benchmark (+12 points above the previous Mythos configuration) while delivering ~50% cost reduction versus the current production MDASH configuration.

   3 details in Everything

6. changelog Jul 17, 2026 · issue 019
   • New Microsoft Defender Experts Threat Intelligence service delivers continuous, curated, expert-led intelligence tailored to an organization.
   • Microsoft Defender Experts MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. extended with third-party and multicloud coverage.
7. changelog Jul 15, 2026 · issue 017

   Microsoft launches Defender Experts Threat Intelligence service and expands MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. to multi-cloud/third-party coverage via Sentinel.

   • New Microsoft Defender Experts Threat Intelligence service delivers curated, expert-interpreted threat intelligence tailored to your industry, geography, and environment — including early-warning campaign alerts, evolution updates, and recurring expert briefings.
   • Microsoft Defender Threat Intelligence (MDTI) capabilities are now fully converged into the Defender portal, making intelligence available in real-time across detection, investigation, response, hunting, and automation without context switching.
   • Microsoft Defender Experts MDR (formerly Defender Experts for XDRXDRExtended detection and response, combining signals and investigation across endpoints, networks, identities or cloud services. It helps analysts connect activity that separate tools might miss.) adds a new Plan 2 tier with third-party and multi-cloud coverage powered by Microsoft Sentinel, enabling expert-led monitoring and response across non-Microsoft cloud, identity, email, network, and endpoint sources.
   • Defender Experts MDR Plan 2 provides cross-platform threat analysis correlating Microsoft and non-Microsoft signals into a single incident narrative with vendor-aware guidance.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Microsoft Defender Experts for XDR is renamed to Microsoft Defender Experts MDR (existing capabilities carry forward as Plan 1).