The Security Insights Show

Purview is a thing or so we heard…or as my cat says it …Purrrrrr-view.Words of Wisdom:“Take the stairs.”Security Insights - Foresight - Hindsight 08/27/2026General* What’s new in Microsoft Security: August 2026 | Microsoft Security Blog* The patch window is collapsing: Why security needs a new control plane | Microsoft Security Blog (Aug 25)* Rethinking security for the age of AI – Project Perception | Microsoft BlogAI Security* When AI infrastructure becomes the target: Securing gateways and control points | Microsoft Security Blog (Aug 26) — LiteLLM gateway exploitation, credential harvesting, persistence, and cryptomining* OpenAI autonomous agent incident affecting Hugging Face and additional services | Hugging Face + OpenAI disclosureAgent365 / Agentic Security – Project Perception* What is Project Perception? | Microsoft Learn (Limited Public Preview)* Get started with Project Perception | Microsoft Learn* Project Perception product page | Microsoft Security* Introducing MAI-Cyber-1-Flash inside MDASH | Microsoft AIProject Perception snapshot (as of late August)Microsoft documents Perception as a Limited Public Preview — invitation-only for a defined window before broader availability. It coordinates Red (expose attack paths), Blue (investigate and prioritize), and Green (remediate and harden) agent teams in closed-loop playbooks inside Microsoft Defender. High-impact actions stay under human control.Azure Security & Defender for Cloud News* Microsoft named a Leader in Frost Radar 2026: Cloud Workload Protection Platforms | Microsoft Security Blog* What’s new in Defender for Cloud | Microsoft LearnThreat Intelligence* Hunting MacSync Stealer infrastructure through behavioral pivots | Microsoft Security Blog (Aug 18)* Email threat landscape: Q2 2026 | Microsoft Security BlogMicrosoft Entra* Entra Tenant Governance and identity foundations for the AI era | Microsoft Security Blog* Entra ID CVE-2026-69836 was patched server-side; Microsoft later clarified it was not exploited in the wildDevice Management & Protection (Intune)* Windows Autopilot device association + Unattended Support with Remote Sign-In | Microsoft Security Blog* What’s new in Microsoft Intune | Microsoft LearnDefender XDR & Sentinel* Monthly news – August 2026 | Microsoft Defender XDR Blog* What’s new in Microsoft Defender XDR | Microsoft Learn* What’s new in Microsoft Sentinel | Microsoft Learn — new UEBA sources (Fortinet FortiGate behaviors) and anomalies on behaviors* Defender Experts MDR P2 now covers third-party data ingested through Sentinel (Palo Alto, AWS, Okta, and more)Copilot for Security* Security Copilot overview | Microsoft LearnPurview – Compliance & Governance* Purview data protection for AI agents | Microsoft Learn* Secure Now guidance for agentic containment in Microsoft Security Exposure ManagementNon Microsoft Security News* August Patch Tuesday: very large release including exploited WinSock/afd.sys elevation of privilege (CVE-2026-68820)* CISA added additional KEV entries this week (including NetScaler and other actively exploited flaws)AI for the Masses* LiteLLM / AI gateway attacks (Microsoft Threat Intelligence, Aug 26)* Open-weight model and agent-harness risk discussions* Agent pentesting and safety-rail bypass trendsFeatured Resources & Deep Dives* Defender XDR deployment guide* Advanced hunting best practices* Sentinel best practices* Security for AI solutions hubWhat’s New in Defender (August 2026)* What’s new in Microsoft Defender XDR | Microsoft Learn* AI agent posture risk + Agent 365 runtime/threat detection* Project Perception Limited Public Preview — Red / Blue / Green agent teams in Defender* MAI-Cyber-1-Flash inside MDASH* Defender Experts MDR P2 third-party coverage via Sentinel* Linux AV audit mode (preview) and Linux offboarding API (GA)Daily Defender Dispatch – August 27, 2026Daily Defender Dispatch: August Security Recap, AI Gateways Under Fire, Perception Preview1. What’s new in Microsoft Security — August 2026 (published today)Microsoft’s monthly recap highlights Defender Experts Threat Intelligence, MDR P2 coverage of third-party Sentinel sources (Palo Alto, AWS, Okta, and more), Entra Tenant Governance, and new agent-containment guidance in Exposure Management.→ Read it2. AI infrastructure is now a primary targetMicrosoft Threat Intelligence published a deep dive on attacks against exposed AI workloads — including LiteLLM gateway exploitation, credential harvesting, persistence, and cryptomining. Treat AI gateways as production control planes, not side projects.→ Read it3. Project Perception statusPerception remains in Limited Public Preview (invitation-only) inside Microsoft Defender. Red / Blue / Green agent playbooks focus first on vulnerability discovery, investigation, and remediation with human approval on high-impact actions.→ Overview | Get started | Announcement | MAI-Cyber-1-Flash + MDASH4. Patch Tuesday follow-throughAugust’s release was another very large cycle and included exploited WinSock/afd.sys EoP (CVE-2026-68820). Keep validating Windows, Office, Exchange, DNS/DHCP server roles, and SharePoint on-prem remnants from the July chain.Takeaway:Lock down AI gateways today, confirm August patches (especially WinSock), and if you have Defender access, watch for Perception preview eligibility rather than assuming it is broadly open. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.microsoftsecurityinsights.com

More talk and Perspective about Project Perception or is that “Inception” (see what we did there) from Mona Ghadiri - a Microsoft MVP, Capgemini Distinguished Cyber Engineer | Zero To Hero Board Member | MSFarsi Leader | MGCI Regional LeadWe will ask her to give us her “highly opinioned” facts on the OpenAI Agent “mishap” involving Hugging Face and the evolving world of Cyber-AI-Security.Words of Wisdom:“You will be judged on how well you treat those who can do nothing for you.”Security Insights - Foresight - Hindsight – August 2026 EditionGeneral* Lots of free tech training - Explore events at Microsoft * Rethinking security for the age of AI – Introducing Project Perception | Microsoft Blog* What’s new in Microsoft Security: July 2026 | Microsoft Security Blog* Securing our future: July 2026 Secure Future Initiative progress report | Microsoft Security BlogAI Security* OpenAI autonomous agent escape and Hugging Face incident | Hugging Face + OpenAI disclosure* Enhancing AI security through global AI red teaming | Microsoft Security BlogAgent365 / Agentic Security – Project Perception Deep Dive* What is Project Perception? | Microsoft Learn* Get started with Project Perception | Microsoft Learn* Project Perception product page | Microsoft Security* Rethinking security for the age of AI | Microsoft Blog* Introducing MAI-Cyber-1-Flash inside MDASH | Microsoft AIKey Project Perception DetailsProject Perception is Microsoft’s new multi-agent security system that coordinates specialized AI agents across three roles:* Red team agents – continuously map attack paths and probe for weaknesses before adversaries can exploit them* Blue team agents – investigate signals, correlate context, and prioritize real risk* Green team agents – remediate findings and harden the environmentIt runs as a closed-loop system that reasons over Microsoft security signals, organizational context, and threat intelligence. High-impact actions remain under human control. Public preview began August 3, 2026, initially inside the Microsoft Defender portal, with plans to expand across the Microsoft Security portfolio. Pricing uses Security Compute Units (SCUs).Azure Security & Defender for Cloud News* What’s new in Defender for Cloud | Microsoft LearnThreat Intelligence* CaptiveCrunch: Midnight Blizzard targeting travelers | Microsoft Security Blog* Email threat landscape: Q2 2026 trends | Microsoft Security BlogMicrosoft Entra* Microsoft Entra ID security updates – Passkeys as default | Microsoft Security BlogDevice Management & Protection (Intune)* What’s new in Microsoft Intune | Microsoft LearnDefender XDR & Sentinel* Monthly news – July/August 2026 | Microsoft Defender XDR Blog* Sentinel Graph tools + custom detection as code | Microsoft Learn* Defender XDR + Sentinel unified operations | Microsoft LearnCopilot for Security* Security Copilot agentic capabilities | Microsoft LearnPurview – Compliance & Governance* Purview data protection for AI agents | Microsoft Learn* Purview for Agent 365 | Microsoft LearnNon Microsoft Security News* OpenAI agent sandbox escape that compromised Hugging Face and additional third-party accounts → Hugging Face report + OpenAI statementAI for the Masses* LiteLLM and open-weight model risks* Model ablation / safety-rail bypass techniques* Embedding space attacks* Agent pentesting and bug-bounty trendsFeatured Resources & Deep Dives* Defender XDR deployment guide* Advanced hunting best practices* Sentinel best practices* Secure Copilot foundation* Security for AI solutions hubWhat’s New in Defender (August 2026)* What’s new in Microsoft Defender XDR | Microsoft Learn* Project Perception public preview (Red / Blue / Green agent teams for attack simulation, investigation & remediation) – available in Microsoft Defender starting August 3* MAI-Cyber-1-Flash integrated with MDASH – specialized cybersecurity model delivering ~96% on CyberGym at roughly half the previous cost by handling ~90% of routine tasksDaily Defender Dispatch – August 13, 2026Daily Defender Dispatch: Project Perception Public Preview Live + MAI-Cyber-1-Flash1. Project Perception Public Preview is LiveMicrosoft’s new multi-agent security system entered public preview on August 3 inside the Microsoft Defender portal.It coordinates three specialized agent teams:* Red – continuous attack-path mapping and proactive probing* Blue – investigation, prioritization, and detection engineering* Green – remediation and hardeningHumans retain final control over high-impact actions. Access it via the Perception blade in the Defender portal.→ Announcement | Learn overview | Get started2. MAI-Cyber-1-Flash + MDASHMicrosoft’s first in-house cybersecurity model (MAI-Cyber-1-Flash) is now powering the MDASH multi-agent vulnerability harness. It handles the majority of routine tasks and escalates only the hardest work to larger models (e.g., GPT-5.4), delivering top-tier CyberGym performance at significantly lower cost.→ MAI-Cyber-1-Flash announcement3. Why This MattersProject Perception represents Microsoft’s clearest move yet from “AI that assists” (Security Copilot) to “AI that acts” under human oversight. Early adopters should evaluate it for vulnerability management playbooks first, then expand to threat-intel driven investigations.Takeaway for defenders:If you already have Defender XDR, log into the portal today and explore the new Perception experience. Start with low-risk playbooks and keep human approval gates enabled. This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.microsoftsecurityinsights.com

Join our hosts December 18th, 2025, as they dive into the electrifying world of Microsoft Security’s latest breakthroughs. This episode unpacks real-world triumphs in thwarting sophisticated AI-driven phishing swarms, and debates the hottest zero-day exploits shaking the headlines. Packed with insider tips this is your must-listen guide to staying light-years ahead in the cyber arms race.This episode, we welcome back Alistair Pugin to talk Agent security.Show Notes/Links* Alistair Pugin on LinkedIn: https://www.linkedin.com/in/alistairpugin/* Learn about Data Security Posture Management for AI: https://learn.microsoft.com/en-us/purview/dspm-for-aiList of AI sites supported by * Microsoft Purview Data Security Posture Management (DSPM) and DSPM for AI: https://learn.microsoft.com/en-us/purview/ai-microsoft-purview-supported-sites* Permissions for Data Security Posture Management for AI: https://learn.microsoft.com/en-us/purview/ai-microsoft-purview-permissions* MITRE ATLAS: https://atlas.mitre.org/ This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.microsoftsecurityinsights.com

As the Thanksgiving turkey roasts and the family gathers, cybercriminals are lurking in the digital shadows, ready to crash your holiday feast. In Episode 280 of THE Security Insights Show, hosts serve up a timely platter of cybersecurity wisdom to keep your “gravy secrets”—those juicy credentials, financial data, and personal info—safe from opportunistic hackers.Dive into the rising tide of “Turkey-Day Trojans”: sneaky malware disguised as festive deals, phishing emails from “Aunt Edna” demanding urgent wire transfers, and smart home devices turned into spy cams by unsecured Wi-Fi. We’ll unpack real-world holiday hacks, from ransomware gobbling up your shopping carts to social engineering tricks exploiting family chit-chat. Plus, get actionable Microsoft Security tips—like leveraging Defender for endpoint protection, Entra ID for secure guest access during virtual toasts, and Copilot-powered threat hunting to spot the bad stuffing before it sours the meal.Whether you’re a CISO stress-testing your perimeter or just a home user dodging Black Friday bait, this episode arms you with the tools to feast worry-free. Tune in now on YouTube, Apple Podcasts, Spotify, or your favorite platform—because nothing ruins a holiday like a data breach on dessert. Don’t forget to subscribe for more bites of security insight!This episode of “THE Security Insights Show” covers a range of topics, starting with personal updates and discussions about cybersecurity certifications. The hosts delve into the role of Artificial Intelligence (AI) in cybersecurity, specifically debating the necessity of learning KQL (Kusto Query Language) from scratch given the advent of natural language to KQL models (16:01). They discuss the importance of understanding underlying data and language nuances even with AI assistance (18:56).The conversation then pivots to key announcements from Microsoft Ignite, including:* Work IQ: An intelligent layer that enhances productivity by connecting organizational and personal data, enabling AI-driven insights and recommendations within Microsoft 365 applications (31:31).* Proactive Attack Disruption and Predictive Shielding: Microsoft’s new capabilities to anticipate attacker moves during ongoing attacks, dynamically hardening targets in real-time (35:59).* Expanded Automatic Attack Disruption: This feature extends to work across third-party services like AWS, Okta, and Proofpoint, allowing Microsoft Defender to take decisive actions on external systems even if the threat originates from a non-Microsoft system (39:06).* Rebranding of Defender XDR to Borg XDR: Indicating a consolidation of more Defender for Cloud functionality and assimilation of Sentinel into the unified Defender portal (42:00).* Native Sysmon in Windows 11: A significant announcement for security professionals (42:35). This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.microsoftsecurityinsights.com

Picture this: It’s the witching hour of cybersecurity, where jack-o’-lanterns glow with malevolent code and candy corn conceals keyloggers. In this spine-tingling episode of The Security Insights Show, we dive headfirst into the ghoulish guts of seasonal phishing scams – those crafty creeps who lure you in with “Free Zombie Apocalypse Prep Kits” emails, only to carve up your credentials like a deranged pie maker at a harvest festival. Join our hosts as they unmask the tricks-or-treats of spear-phishing spooks, ransomware pumpkins that explode in your inbox, and why your two-factor auth is the garlic necklace against digital Dracula. We’ll roast real-world horror stories – like the exec who traded his soul (and SSO login) for a “haunted house discount” – and arm you with tricks to keep your data from doing the monster mash. This episode of “THE Security Insights Show” discusses the risks and security challenges associated with artificial intelligence (AI), particularly concerning phishing scams during the Halloween season (0:21). The hosts, Rodney and Franklin, touch on various aspects of AI, its adoption, and the evolving landscape of cybersecurity.Key discussion points include:* The hosts’ return and show changes: Rodney and Franklin discuss their return to the show after a summer break, moving to a bi-weekly Thursday schedule to allow more time for content creation and guest planning (1:02-6:54).* October as Cybersecurity Awareness Month: They emphasize the importance of cybersecurity awareness, noting a lack of guest speakers this year compared to previous years (4:17-4:33).* Artificial Intelligence (AI) and its security implications: A significant portion of the discussion revolves around AI, specifically the challenges of securing and governing it (7:47). They highlight the increasing use of AI in creating sophisticated phishing campaigns and the alarming potential for “non-human entities” or “agentic offerings” to be compromised or act as “double agents” in an environment (10:10-10:57).* Understanding AI architecture and threats: Franklin argues that securing AI is fundamentally about securing compute, identity, data, and networks, with the Large Language Model (LLM) being a new threat (11:31-12:29). They discuss the role of the MCP (Microsoft Collaboration Protocol) server in providing context between chatbots and data sources, acknowledging that generative AI can sometimes provide inaccurate responses (13:03-15:41).* Challenges in AI security and training: The hosts express concern about the lack of fundamental understanding of AI among security professionals and the trend of training courses merely adding “with AI” to existing content without real value (28:41-31:21). They also discuss the emergence of highly specialized roles in AI security, like the “Chief Artificial Intelligence Risk Officer (CAIRO),” and the potential for a “corporate fear of missing out” driving quick, potentially insecure, AI adoption (36:06-38:29).* The CISO’s role and application expectations: Franklin suggests that CISOs have the necessary tools for AI security, viewing it as another application to secure, while Rodney believes many are unprepared due to rapid adoption and an “outnumbered” feeling in defense (37:42-43:52). This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.microsoftsecurityinsights.com

Hello podcast listeners and supporters. Today we announced that we will start our late summer | early fall show slow down. After five years of producing the show, we are taking the months of August and September off to recharge, do some back-office updates and re-invent.We look forward to having fresh energy and lots of dad jokes upon our return. Keep an eye on the discord channel and website for tips and tidbits until we return.thanksBrodie, Edward, Frank, RodWatch the live replay This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.microsoftsecurityinsights.com