IDC MarketScape names Microsoft a leader in endpoint security
The September 2026 assessment cites Defender attack disruption, generally available Security Copilot, and cross-platform coverage.
1
Stories per day · 30 days
2 RSS
Relatedai-agents1endpoint-security1idc1insider-threat1microsoft1project-perception1ransomware1security-copilot1
25 stories, newest first · one card per story
Stories tagged #microsoft-defender
Microsoft expands Project Perception to contain anomalous AI agents
New capabilities discover agents, assign identity and permissions, score risk, and can cut off access.
1
'BigDiskBuster' Leaves Microsoft Defender Running While Blocking Updates
BigDiskBuster proof of concept keeps Microsoft Defender running while blocking updates and opening a detection gap.
Hackers Abuse Microsoft Defender Exclusions to Hide Malware From Antivirus Scans
Huntress details how attackers abuse Microsoft Defender path and extension exclusions to hide malware while leaving antivirus scans appearing active.
2
Hackers Hide Microsoft Defender Exclusions From Admins to Evade Antivirus Scans
Huntress warns attackers hide Microsoft Defender exclusions so malware stays unscanned and invisible to admins.
2
Defender Exclusion Abuse: How Attackers Hide Malware from MDAV
Huntress details how attackers abuse Microsoft Defender exclusions to hide malware from scans.
9
Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates
Researcher publishes unpatched BigDiskBuster PoC that can block Microsoft Defender signature and platform updates.
3
Unmasking EvilTokens: Getting to the root of device code phishing
Microsoft details the EvilTokens/Storm-2992 device-code phishing operation and shares Defender detections after disrupting the AI-powered platform.
5
BigDiskBuster Windows Defender DoS Vulnerability Blocks Platform and Signature Updates
Unverified GitHub proof-of-concept BigDiskBuster blocks Microsoft Defender platform and signature updates, potentially leaving Windows endpoints with outdated anti-malware protection.
1
A Framework to Quantify the Probability of Future Cyber Loss Events
LEFSA estimates future cyber-loss probabilities from Defender telemetry, with XGBoost reaching 0.90 mean AUC across 23 organizations.
Microsoft fixes bug behind ‘Defender Antivirus is turned off’ alerts
Microsoft's Defender Antivirus update 4.18.26080.4 fixes false 'Defender Antivirus is turned off' alerts affecting all supported Windows client and server versions.
4
Detect and disrupt AI-themed attacks with Microsoft Defender
Microsoft Threat Intelligence reports criminal campaigns impersonating ChatGPT, Copilot, Claude, and DeepSeek in phishing, AiTM, and malvertising attacks reaching 100,000 emails daily.
4
ShieldCrash PoC: Microsoft Defender Fix Bypass
A ShieldCrash proof-of-concept bypasses Microsoft's patch for CVE-2026-69414, a high-severity elevation-of-privilege flaw in the Microsoft Malware Protection Engine.
New Windows Defender ShieldCrash 0-Day Bypasses Microsoft Patch to Read Files as SYSTEM
Researcher's ShieldCrash PoC claims Microsoft Defender still allows arbitrary file reads as SYSTEM on patched Windows, bypassing the CVE-2026-69414 fix.
1
Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEM
Unpatched Windows Defender zero-day 'ShieldCrash' PoC lets local attackers read arbitrary files as SYSTEM, apparently bypassing the CVE-2026-69414 patch.
The 12 Best Extended Detection & Response (XDR) Platforms, Compared and Priced
Buyer's guide compares 12 XDR platforms, favoring Microsoft Defender XDR, Stellar Cyber and CrowdStrike, and warns ingestion pricing inflates costs.
8
Chaotic Eclipse Released ShieldCrash, A PoC For Microsoft Defender Zero-Day
Researcher Chaotic Eclipse released ShieldCrash, a PoC showing Microsoft Defender's CVE-2026-69414 patch is incomplete, enabling arbitrary file reads as SYSTEM.
2
The 12 Best Endpoint Detection & Response (EDR) Solutions, Compared and Priced
An editorial scorecard ranks 12 EDR platforms, with CrowdStrike and SentinelOne tied at 8.6/10 and telemetry retention identified as the hidden cost driver.
9
New Microsoft Defender 'ShieldCrash' zero-day grants SYSTEM access
Researcher Nightmare Eclipse released 'ShieldCrash', a zero-day exploit for Microsoft Defender that grants attackers SYSTEM-level access.
Once popular for attacking AI, ASCII smuggling is embraced by spammers
Spammers adopt ASCII smuggling—invisible Unicode tag characters—to evade email filters, with Microsoft Defender detections spiking to 2.5 million per day.
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Check Point revealed BTR Reforged, a technique weaponizing Microsoft Defender's built-in BTR.sys driver to delete security software at boot without exploiting any vulnerability.
ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM
Hacker News ThreatsDay roundup: Defender BTR.sys driver abuse, DoJ charges 17 Mabna Institute members over IRGC-linked intrusions, Grandoreiro sideloading, OpenAI monitoring.
BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive
Check Point shows attackers can abuse Microsoft Defender's signed remediation driver for arbitrary Ring 0 file and registry operations without exploiting any vulnerability.
ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access
Researcher Chaotic Eclipse released ShieldBreak PoC, a claimed patch bypass for Microsoft Defender flaw CVE-2026-50656, now tracked as CVE-2026-69414.
2