November 5, 2026 – Leonard Volling from Lock Base Cyber returns to the show to discuss ISOC and what is going on with Microsoft Sentinel these days
WE’RE BACK. The late-summer/early-fall break is over. The crew returned October 22 and is rolling again with practical Microsoft security coverage, agent risks, and high-signal takeaways. October was Cybersecurity Awareness Month (“Securing the Next 250”). The focus remains just doing the basics well while the agentic surface expands and the patch window collapses.
Today’s episode features the return of Leonard Volling from Lock Base Cyber. He joins to break down ISOC (Integrated Security Operations Center) in Microsoft Defender and the current state of Microsoft Sentinel.
Podcast Rundowns
General / Microsoft Security
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths (Oct 30)
Inside a malicious Claude Code-branded extension and its persistent SSH backdoor (Oct 30)
AI Security
Tracking AI adoption in North Korean threat actor tradecraft (Oct 29)
Managing open-weight model risk in enterprise deployments (Microsoft + NVIDIA whitepaper)
3 lessons from frontier AI vulnerability research (FORGE Lab)
Oct 30: OpenAI’s Latest Discoveries Spark a Backlash + Help! My Kid Hates AI — OpenAI’s models cracked hard problems in math, CS, and physics. Scientists are pushing back on verification difficulty and handpicked reviewers. Humans-in-the-Loop mailbag covers kids who hate AI, rogue agent swarms, and changing a partner’s ChatGPT settings.
Transcripts/show notes: npr.org/machinegods
Agent365 / Agentic
Agents are your newest insiders. Security must move at their speed. (Project Perception expansions, Dynamic Agent Risk, Guardian Agents, Dynamic Permissions)
The CISO’s evolving role: Protecting and defending in the agentic era
Agent 365 GA and runtime protections continue to expand (Entra Agent ID, Purview, Defender integration).
Threat Intelligence
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (Storm-0940)
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
Microsoft Entra
Dynamic Conditional Access and Agent ID extensions for local and previously unknown agents; identity remains the control plane for both humans and agents.
Defender XDR & Sentinel
ISOC (Integrated Security Operations Center) in Defender; Sentinel data connectors and graph capabilities; more than 30 new alerts including AD CS ESC1/ESC8 and related paths. What’s New in Defender continues to emphasize agent posture risk and runtime protections.
Leonard Volling returns to discuss ISOC and the current direction of Microsoft Sentinel.
Purview – Compliance & Governance
Sensitivity labels, DLP, and auditing extended to agent interactions and data access.
Cybersecurity Awareness Month
October focus on “Securing the Next 250.” Practical actions: phishing-resistant MFA, patch prioritization by real exploitation signal, and treating agents as insiders.
Non-Microsoft Security News
Drawn from sources such as Talkin’ Bout Infosec News style coverage and broader industry reports on PHP2Shell exploitation waves, supply-chain events, and agent-driven incidents. October Patch Tuesday set a record with 1,400+ CVEs (including an exploited Windows Shell zero-day, CVE-2026-96951).
AI for the Masses
Practical agent hygiene, open-weight model risk management, and the reality that detection and containment now matter more than perfect patching speed.
Featured Resources
2026 Microsoft Digital Defense Report
Microsoft + NVIDIA open-weight model risk whitepaper
Project Perception / Guardian Agents documentation
Rod Trent Substack and related daily check-ins
What’s New in Defender
Agent posture risk assessment, threat detection for Agent 365 agents, real-time protection for tooling servers, ISOC availability, and expanded identity/AD CS detections.
Full archive and live links: www.microsoftsecurityinsights.com
