AI-enabled attackers are changing the way everyone thinks about cyber security, and the big vendors are retooling fast to keep up. Microsoft is one of the most interesting to watch right now, because the way it is bringing its security products together could change what a SIEM and SOC looks like for organisations of every size.
In our latest RoboShadow video, Terry Lewis talks through what Microsoft is doing with Sentinel and the Defender portal, why its new AI pen test agents in Project Perception could become table stakes for everyone, and what all of this means for vendors like RoboShadow and the organisations we look after.
Terry covers new topics like this every week, so if you find this useful, subscribe to RoboShadow on YouTube to catch the next one.
For a long time, Microsoft Sentinel lived in Azure, and for many organisations it felt expensive. There were a lot of logs involved, and the cost of ingesting them was often enough to make people think, "You know what? Let's just go to CrowdStrike or SentinelOne instead."
Terry thinks Microsoft has done a really good job here. Much of that Sentinel workflow now sits inside the Microsoft Defender portal, which brings detection and response into the same place many Microsoft 365 teams already work.
You still pay for the logs you ingest. The difference is that if you know what you are doing, you can tailor those logs so the cost becomes much more palatable. That means you can bring SIEM and SOC capability into your own Microsoft universe without the bill getting out of hand.
If you would like a hand working out which logs you really need, our team is always happy to walk you through it.
Talk to our team about tuning your Defender log ingest âž¡ï¸
The really important shift is that Microsoft is moving into SOAR, the security orchestration side of things. In plain terms, that means it can actually fix stuff, not just tell you about it. Get your ingest right in the Defender portal and you can run your own SIEM and SOC capability quite cost-effectively.
Not every organisation has the skills in-house to run a SOC, and plenty of MSPs do not want to build one. For them, one of the biggest benefits is that AI can now take action on its own when something goes wrong out of hours.
If a device has been compromised in the middle of the night, AI can take it off the network straight away, rather than waiting for someone to wake up and log in.
It can also block IP addresses that are trying to enumerate your accounts, shutting down that kind of probing before it turns into something worse.
Terry expects this to kick off an arms race across the industry, with other vendors coalescing around the same approach and the cost of SIEM and SOC capability coming down as a result. As he keeps saying on the channel, that is exactly what we need to fight AI with AI: detect the signature, realise something is up to no good, and shut it down.
This is why we have built our own integration for this within RoboShadow, and it is now out in early beta. We know Microsoft has to get its money for its new products, and we know it is not going to be cheap.
What we try to do at RoboShadow is bring enterprise-class technology to every organisation, including charities, schools, SMBs and smaller teams. Our flavour of this harnesses the benefits of Sentinel in the Microsoft Defender portal, but brings it to a level that is cost-effective and can be used by just about everyone.
Apply for early access to RoboShadow's AI SIEM and SOC âž¡ï¸
Here is where it gets a little bit spicy. If you have not come across it yet, Project Perception is Microsoft's new multi-agent security system, which includes red team agents that act like an attacker to find your gaps. Think of it as Microsoft's AI pen test bot.
Microsoft will "Microsoft it", as Terry puts it, but he still sees this as a game changer. The ability to hack yourself with AI, to confirm you are not going to be hacked by bad AI, is going to become table stakes for everyone.
That raises the bar for the whole industry. RoboShadow and all of our peers will need to out-innovate Microsoft, bringing solutions that are more comprehensive and cheaper to run. It is a really interesting thing to watch at an industry level.
See the attack paths your vulnerabilities open up with AI Pentest Simulation âž¡ï¸
AI pen test agents are becoming really exciting, but nobody quite knows how this will play out. The big frontier models are now pretty much locking up if you even use the words "pen test". Vendors like RoboShadow, Microsoft and our peers can apply for specific subscriptions, but they are still quite restrictive.
The frontier labs are in a tough spot. Do they restrict pen testing to limit the havoc we are seeing in the world, and risk that business going to open-weight models with far fewer guardrails? Or do they allow it under licence, in which case who gets that licence, and would every customer of a company like RoboShadow need to be vetted? Only time will tell.
What gives Terry more comfort is that the frontier labs now have competition from Western-based teams, some of whom have come out of those very labs. Their open-weight models could offer a safer alternative: operational enough for automated AI pen testing, without giving up on safety altogether.
There is a lot moving quickly, with updates every week, and we will keep bringing them to you on the channel. For more on how the AI giants are handling all of this, take a look at our recent post, Why are AI giants begging for regulation?
RoboShadow is a cyber security platform that helps businesses and MSPs identify, prioritise and remediate vulnerabilities across their IT environments. It combines internal and external vulnerability scanning, device security, Microsoft 365 integrations and automated remediation, helping teams manage cyber security continuously while reducing cost, complexity and manual work.
You do not need an enterprise budget to fight AI with AI. Here are three easy ways to take the next step today:
As always, thank you for your ongoing support and feedback. If you have any questions, please don't hesitate to reach out to us at hello@roboshadow.com or get in touch with our team. We are always more than happy to walk through things with you.
Watch more from RoboShadow on our YouTube channel.