Loading story…
Microsoft CEO Satya Nadella announced a senior leadership reorganization that elevates security execution and engineering quality under direct CEO oversight, positioning the changes as part of the company’s push to protect core systems as AI expands the enterprise attack surface. Nadella said Hayete Gallot will return to Microsoft as EVP of Security, while longtime security leader Charlie Bell will move into a new role focused on engineering quality, with both roles reporting directly to him.
Under the new structure, Microsoft’s security business is set to report to Gallot, consolidating responsibility for security product direction, execution, and delivery under a single accountable leader. The reorg also introduces a new security architecture role: Ales Holecek will become Chief Architect for Security, reporting to Gallot, with a mandate to better align security with Microsoft’s core platforms and agent infrastructure; Nadella also referenced internal initiatives including the Secure Future Initiative and a Quality Excellence Initiative intended to increase accountability and improve durable, high-quality experiences at global scale.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft separately confirmed a Windows update problem that prevents some PCs from shutting down or entering hibernation. The issue was disclosed alongside reporting on the company's broader security and engineering quality reorganization.
As part of the same security leadership overhaul, Microsoft said Ales Holecek will fill a new Chief Architect for Security role. The position is intended to better align security with Microsoft's core platforms and agent infrastructure.
Microsoft appointed Hayete Gallot as executive vice president responsible for security, returning from Google Cloud to take end-to-end accountability for Microsoft's security business and leadership organization. The restructuring places security and quality under closer CEO oversight and consolidates security reporting under Gallot.
Microsoft CEO Satya Nadella created a new role focused on engineering quality and appointed Charlie Bell, formerly the company's executive vice president for security, to lead it as part of a broader Quality Excellence Initiative. Bell will report directly to Nadella and work on accountability and engineering outcomes across Microsoft's systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AWS expanded **Security Hub** beyond its own cloud to add native visibility into **Microsoft Azure**, marking the service’s first direct monitoring of infrastructure outside AWS. The update lets Security Hub discover Azure virtual machines, container images, Function Apps, and identities, then evaluate them for misconfigurations, internet exposure, and vulnerable software. AWS said the Azure assessments align with the **CIS Microsoft Azure Foundations Benchmark**, giving organizations a standardized baseline for multicloud posture management. AWS also introduced new AI-focused security capabilities, including **GuardDuty AI Protection** for Amazon Bedrock and SageMaker and AI-powered investigations in Security Hub. The AI protections are designed to detect threats such as anomalous model use, prompt injection attempts, and cost-harvesting abuse tied to stolen credentials, while the investigations feature uses up to 90 days of related activity to generate confidence-scored findings, **MITRE ATT&CK** mappings, and remediation guidance. AWS said the expansion is aimed at unifying security operations across multicloud environments while improving visibility into both cloud infrastructure and AI assets.
Jul 14, 2026
Microsoft said Windows customers should expect more frequent security updates as the company expands AI-driven vulnerability discovery across its codebase. The effort centers on **MDASH**, a proprietary multi-model scanning system used by Microsoft's Autonomous Code Security team to scan critical Windows components, validate findings with multiple AI models, and reduce false positives through a Windows-specific validation pipeline. Microsoft said AI is also being used to analyze failures, suggest fixes, and locate similar flaws elsewhere in source code, while human engineers remain responsible for reviewing code changes and approving remediations. The company said MDASH has already contributed to the disclosure of **16 previously unknown Windows vulnerabilities**, including **four Critical remote code execution flaws** affecting the **TCP/IP kernel stack**, **IKEv2**, **Netlogon**, and the **DNS API library**, all patched in a May 2026 security release. Microsoft also tied the initiative to updates in its **Secure Development Lifecycle** to address AI-enabled attack techniques and introduce AI earlier in development, while reports noted that June 2026 Patch Tuesday fixed more than 200 vulnerabilities, underscoring how AI-assisted discovery is beginning to affect Microsoft's patching cadence and enterprise update workloads.
Jul 15, 2026
Microsoft has announced significant enhancements to its Sentinel Security Information and Event Management (SIEM) platform, introducing agentic AI capabilities designed to improve threat detection, investigation, and response. At the annual Microsoft Secure virtual event, the company previewed the new Sentinel security graph and the Model Context Protocol (MCP) server, both of which are intended to transform Sentinel from a traditional SIEM into a comprehensive security operations and management platform. The agentic AI functionality will empower Security Copilot agents to conduct more precise and rapid investigations, enabling security teams to respond to threats with greater speed and accuracy. The Sentinel MCP server is a key component, allowing for the integration of both pre-defined and custom agents, which can leverage AI-powered reasoning across unified security data. This extensibility is expected to help organizations move from reactive to predictive security postures, automating threat anticipation and response at scale. Microsoft’s approach aligns with broader industry trends, as competitors like Cisco, CrowdStrike, and Palo Alto Networks also expand their SIEM offerings into full-featured security operations platforms. The new features build upon the July launch of Microsoft Sentinel Data Lake, which provides scalable storage for log files and security data, further enhancing the platform’s analytical capabilities. The integration of agentic AI is positioned as a solution to the growing challenge of overwhelmed security teams, offering automation and intelligence to streamline operations. Microsoft’s security leadership, including corporate VP Vasu Jakkal, has emphasized the importance of these advancements in shifting the security paradigm. The company is also promoting educational resources and sessions, such as those highlighted in the Microsoft Ignite sessions catalog, to help organizations understand and secure agentic AI implementations. These sessions are designed to guide security professionals through the new capabilities and best practices for leveraging AI in security operations. The overall strategy reflects Microsoft’s commitment to providing a unified, extensible, and intelligent security platform for enterprise customers. By integrating agentic AI and expanding the Sentinel ecosystem, Microsoft aims to address both current and emerging cyber threats more effectively. The enhancements are expected to facilitate better collaboration between human analysts and AI agents, improving incident response times and reducing manual workloads. Organizations adopting these new features will benefit from increased automation, deeper insights, and a more proactive security posture. The announcement underscores the rapid evolution of security operations platforms and the central role of AI in modern cybersecurity defense.
Jun 29, 2026