https://cybertoolchain.io/tools/microsoft-defender New releases and features in Microsoft Defender, tracked by The Cyber Toolchain. en Thu, 30 Jul 2026 16:00:00 GMT https://www.microsoft.com/en-us/security/blog/2026/07/30/whats-new-in-microsoft-security-july-2026/ https://www.microsoft.com/en-us/security/blog/2026/07/30/whats-new-in-microsoft-security-july-2026/ Thu, 30 Jul 2026 16:00:00 GMT Microsoft Defender adds agentic SOC workflows, prompt injection email protection, and unified cloud-agent posture in July 2026. • Introduces Project Perception, a multi-agent autonomous defense system combining red, blue, and green team agents for continuous end-to-end security workflows. • New prompt injection protection (preview) identifies and isolates emails containing malicious AI instructions before delivery. • Unified posture and runtime protection for cloud agents across Microsoft Foundry, Microsoft Copilot Studio, and third-party agents in Microsoft Agent 365. • Microsoft Defender Threat Intelligence convergence and an enhanced Threat Intelligence Agent bring additional out-of-the-box intelligence and automation into the unified SecOps workflow. • New interconnected experiences between Defender and Microsoft Entra enable SOC teams to disable compromised identities directly via an RBAC mode enforcing least privilege. • Microsoft Defender Experts Threat Intelligence delivers human-led, curated threat insight tailored to each organization. • Microsoft Defender Experts MDR extends expert-run detection and response to third-party and multicloud signals via Microsoft Sentinel. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-defender https://blogs.microsoft.com/blog/2026/07/27/rethinking-security-for-the-age-of-ai/ https://blogs.microsoft.com/blog/2026/07/27/rethinking-security-for-the-age-of-ai/ Mon, 27 Jul 2026 16:40:00 GMT Microsoft Defender's Project Perception launches public preview with coordinated red/blue/green AI agents for closed-loop autonomous defense. • Introduces Project Perception, a continuously learning defense system that coordinates three classes of specialized AI agents — red team (attack path discovery), blue team (investigation and risk reasoning), and green team (corrective action and hardening) — operating in a closed-loop across identities, endpoints, applications, data, clouds, and AI systems. • Launches software vulnerability management as the first Project Perception scenario, integrating MAI-Cyber-1-Flash into MDASH (software vulnerability multi-model agent team) for automated vulnerability discovery and prioritization. • MDASH with MAI-Cyber-1-Flash achieves 96% on the CyberGym benchmark (+12 points above the previous Mythos configuration) while delivering ~50% cost reduction versus the current production MDASH configuration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-defender https://www.microsoft.com/en-us/security/blog/2026/07/17/microsoft-at-black-hat-usa-2026-defending-trust-in-the-age-of-ai-and-supply-chain-attacks/ https://www.microsoft.com/en-us/security/blog/2026/07/17/microsoft-at-black-hat-usa-2026-defending-trust-in-the-age-of-ai-and-supply-chain-attacks/ Fri, 17 Jul 2026 16:00:00 GMT • New Microsoft Defender Experts Threat Intelligence service delivers continuous, curated, expert-led intelligence tailored to an organization. • Microsoft Defender Experts MDR extended with third-party and multicloud coverage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-defender https://www.microsoft.com/en-us/security/blog/2026/07/15/turning-threat-intelligence-into-decisive-action-with-defender-experts/ https://www.microsoft.com/en-us/security/blog/2026/07/15/turning-threat-intelligence-into-decisive-action-with-defender-experts/ Wed, 15 Jul 2026 16:00:35 GMT Microsoft launches Defender Experts Threat Intelligence service and expands MDR to multi-cloud/third-party coverage via Sentinel. • New Microsoft Defender Experts Threat Intelligence service delivers curated, expert-interpreted threat intelligence tailored to your industry, geography, and environment — including early-warning campaign alerts, evolution updates, and recurring expert briefings. • Microsoft Defender Threat Intelligence (MDTI) capabilities are now fully converged into the Defender portal, making intelligence available in real-time across detection, investigation, response, hunting, and automation without context switching. • Microsoft Defender Experts MDR (formerly Defender Experts for XDR) adds a new Plan 2 tier with third-party and multi-cloud coverage powered by Microsoft Sentinel, enabling expert-led monitoring and response across non-Microsoft cloud, identity, email, network, and endpoint sources. • Defender Experts MDR Plan 2 provides cross-platform threat analysis correlating Microsoft and non-Microsoft signals into a single incident narrative with vendor-aware guidance. Breaking changes: • Microsoft Defender Experts for XDR is renamed to Microsoft Defender Experts MDR (existing capabilities carry forward as Plan 1). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/microsoft-defender