Subvolts take Microsoft integrates security tools to let humans and AI agents work together faster. Sep 23, 2026 - Developers
- This provides a unified platform for building and deploying AI agents within security operations, simplifying integration.
- Business
- Enterprises can enhance their security posture by enabling faster threat detection and response through human-AI collaboration.
This integrates security operations and protection into one system, allowing faster response to AI-driven threats.
Microsoft introduces a new approach to security operations built for AI agents
Cyberattackers are using agents to automate execution at unprecedented scale. What once required entire teams now requires a single operator and an agent framework.
That shift has exposed a hard truth: security cannot operate at AI speed when protection and operations are built as separate systems. Every handoff, integration, and boundary slows defenders down. Agents inherit that complexity.
For agentic security to work, the industry needs a different model. It needs a modern cyber stack with the breadth to see across the environment and the depth to investigate and act. Security operations and native protection must function as one system. This is the integrated security operations center (ISOC).
Today we are announcing ISOC in Microsoft Defender: a foundation built for agentic security that brings leading solutions for security information and event management (SIEM) and threat protection together. It gives people and agents a shared foundation to see, understand, and act across the environment, without the complexity of operating separate systems.…
Opening of the original on Microsoft Source From Subvolts
Summary and analysis by Subvolts editorial, AI-assisted.
Microsoft introduces the integrated security operations center (ISOC) in Microsoft Defender. This new foundation merges security information and event management with threat protection, enabling human operators and AI agents to work as a single system. ISOC aims to accelerate security operations to match AI-driven cyberattacks by providing unified visibility, context, and action across environments without the complexity of separate tools.
Cybercriminals now use AI agents to launch attacks quickly. Microsoft's new system, ISOC, combines security tools so human defenders and AI agents can work together seamlessly. This helps security teams keep up with fast, AI-powered threats.
This move redefines the Security Operations Center (SOC) for the age of AI agents. By integrating SIEM and threat protection, Microsoft Defender aims to close the speed gap with attackers who use agents for automated attacks. This affects enterprise security teams, allowing them to leverage agents for scale while humans provide judgment. The focus is on a unified system for perception, reasoning, and action, a critical evolution as AI threat actors become more sophisticated.
- Product: ISOC in Microsoft Defender
- Availability: Preview
- Date Announced: September 23, 2026
- Core Functionality: Merges SIEM and threat protection for human-AI agent collaboration
- SIEM
- Security Information and Event Management: A system that collects and analyzes security logs from various sources to detect threats.
- A system that gathers and studies security data from many places to find threats.
- Agentic security
- Security operations leveraging autonomous AI agents to perform tasks at scale.
- Security that uses smart AI programs to do jobs automatically and quickly.
- Telemetry
- Data collected from systems and devices to provide insights into their performance and security.
- Information gathered from devices and systems to understand how they are working and if they are secure.
The Playbook: reusable how-tos, prompts, configs and tips pulled out of the news. From the Playbook, matched to the product and topics of this item.
- Model pickUse Claude Opus 5 for complex multi-step work in Microsoft 365 CopilotClaude Opus 5 is now available in Microsoft 365 Copilot for complex, multi-step tasks. · 5 min
- Anti-patternRelying solely on chat for complex agentic workflowsChat becomes a long scroll of buried instructions, logs, and corrections, making work hard to track and audit. · 5 min
- Setting tipEnable agentic autofix for code scanning alertsTurn on Copilot's automated code fix suggestions for security alerts. · 5 min
- ToolGitHub Agentic autofix for code scanning alertsAutomated AI-powered remediation of code scanning security alerts. · 10 min
Questions people ask
- What is ISOC in Microsoft Defender?
- ISOC stands for Integrated Security Operations Center. It is a foundation within Microsoft Defender that unifies security information and event management (SIEM) and threat protection capabilities.
- When is ISOC in Microsoft Defender available?
- ISOC in Microsoft Defender is available in preview today.
More from Microsoft Source 60 more
Page generated Oct 19, 2026. Summaries are Subvolts' own; the story belongs to Microsoft Source.