Microsoft Threat Intelligence Podcast

This week we are taking you back to Black Hat USA 2026 and exploring two sides of the security landscape.  First, Microsoft incident response experts Adrian Hill and Terry Mee break down identity-based attacks, from compromised credentials and MFA bypasses to containment, logging, access controls, and the growing risks surrounding AI agents.  Then, members of Microsoft’s Defender Purple Team discuss how they recreate full attack chains, including emerging AI-driven techniques, to identify detection gaps, strengthen defenses, and use AI to accelerate security research while keeping human expertise in the loop.  In this episode you’ll learn:  Why identity is at the center of modern security incidents  How attackers can bypass MFA and maintain access through sessions, tokens, and other forms of persistence  Why logging and long-term data retention are critical during incident response  How purple teams recreate full attack chains to uncover gaps in detection and response  Where AI can accelerate security research, and where deterministic systems and human oversight still matter  Why AI agents introduce new risks around access, permissions, and trust  Some questions we ask:  What should organizations be logging and retaining for incident response?  Where do organizations underestimate SaaS, OAuth, and identity persistence risks?  When should defenders contain an attacker versus continue gathering intelligence?  How does attacking an AI-enabled system begin to look like traditional offensive security?  Where should security researchers trust AI, and where should they rely on deterministic systems?  What should security teams understand about the exposure and permissions of their AI agents?     Resources:   View Elliot Volkman on LinkedIn     Related Microsoft Podcasts:                    Afternoon Cyber Tea with Ann Johnson  The BlueHat Podcast  Uncovering Hidden Risks        Discover and follow other Microsoft podcasts at microsoft.com/podcasts     Get the latest threat intelligence insights and guidance at Microsoft Security Insider    The Microsoft Threat Intelligence Podcast is produced by Microsoft, Hangar Studios and distributed as part of N2K media network. 

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is joined by Zack Korman, CTO of cybersecurity startup Pistachio. They explore the reality of AI in security, cutting through hype to discuss where AI is both brilliant and flawed, how vendors AI-wash outdated tech, and why Zack believes AI won’t replace jobs but instead scale human creativity. They also dive into phishing simulations, human psychology behind social engineering, AI-powered attacks, jailbreak chaining between AI systems, and the future risks and opportunities AI introduces in cybersecurity. In this episode you’ll learn: How to evaluate whether a vendor is truly using AI in their product The psychology behind why people fall for phishing attacks Why human judgment will remain essential in the era of AI-driven security. Some questions we ask: How can AI unlock new capabilities in cybersecurity? What questions should people ask AI security vendors? Why do trained security professionals still fall for phishing attacks? Resources: View Zack Korman on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.

In this episode of the Microsoft Threat Intelligence Podcast, host⁠ ⁠⁠Sherrod DeGrippo is joined by Tori Murphy, Anna Seitz, and Chuong Dong to break down two threats: the modular backdoor PipeMagic and Medusa ransomware. They discuss how PipeMagic disguises itself as a ChatGPT desktop app to deliver malware, its sophisticated modular design, and what defenders can do to detect it. The team also explores Medusa’s evolution into a ransomware-as-a-service model, its use of double extortion tactics, and the broader threat landscape shaped by ransomware groups, social engineering, and the abuse of legitimate tools. In this episode you’ll learn: Why modular malware is harder to detect and defend against How attackers abuse vulnerable drivers to disable security tools Why leak sites play a central role in ransomware operations Some questions we ask: How did Microsoft researchers uncover PipeMagic in the wild? Why do ransomware groups often borrow names and themes from mythology? What initial access techniques are commonly associated with Medusa attacks? Resources: View Anna Seitz on LinkedIn View Chuong Dong on LinkedIn View Sherrod DeGrippo on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft and distributed as part of N2K media network.