The AI & Security Insights Show·Nov 6, 2026·1h 1m

The AI & Security Insights Show - Episode 299 - Sentinel and ISOC

Download audio Show notes Apple Podcasts

Show notes

November 5, 2026 – Leonard Volling from Lock Base Cyber returns to the show to discuss ISOC and what is going on with Microsoft Sentinel these daysWE’RE BACK. The late-summer/early-fall break is over. The crew returned October 22 and is rolling again with practical Microsoft security coverage, agent risks, and high-signal takeaways. October was Cybersecurity Awareness Month (“Securing the Next 250”). The focus remains just doing the basics well while the agentic surface expands and the patch window collapses.

Today’s episode features the return of Leonard Volling from Lock Base Cyber. He joins to break down ISOC (Integrated Security Operations Center) in Microsoft Defender and the current state of Microsoft Sentinel.

* Podcast Rundowns

General / Microsoft Security

* From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths (Oct 30)

* Inside a malicious Claude Code-branded extension and its persistent SSH backdoor (Oct 30)

* IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor Assessment (Oct 29)

* Insights from the 2026 Microsoft Digital Defense Report

AI Security

* Tracking AI adoption in North Korean threat actor tradecraft (Oct 29)

* Managing open-weight model risk in enterprise deployments (Microsoft + NVIDIA whitepaper)

* 3 lessons from frontier AI vulnerability research (FORGE Lab)

* Oct 30: OpenAI’s Latest Discoveries Spark a Backlash + Help! My Kid Hates AI — OpenAI’s models cracked hard problems in math, CS, and physics. Scientists are pushing back on verification difficulty and handpicked reviewers. Humans-in-the-Loop mailbag covers kids who hate AI, rogue agent swarms, and changing a partner’s ChatGPT settings.Transcripts/show notes: npr.org/machinegods

Agent365 / Agentic

* Agents are your newest insiders. Security must move at their speed. (Project Perception expansions, Dynamic Agent Risk, Guardian Agents, Dynamic Permissions)

* The CISO’s evolving role: Protecting and defending in the agentic era

* Agent 365 GA and runtime protections continue to expand (Entra Agent ID, Purview, Defender integration).

Threat Intelligence

* AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (Storm-0940)

* Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks

* The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

Microsoft Entra

Dynamic Conditional Access and Agent ID extensions for local and previously unknown agents; identity remains the control plane for both humans and agents.

Defender XDR & Sentinel

ISOC (Integrated Security Operations Center) in Defender; Sentinel data connectors and graph capabilities; more than 30 new alerts including AD CS ESC1/ESC8 and related paths. What’s New in Defender continues to emphasize agent posture risk and runtime protections.

Leonard Volling returns to discuss ISOC and the current direction of Microsoft Sentinel.

Purview – Compliance & Governance

Sensitivity labels, DLP, and auditing extended to agent interactions and data access.

Cybersecurity Awareness Month

October focus on “Securing the Next 250.” Practical actions: phishing-resistant MFA, patch prioritization by real exploitation signal, and treating agents as insiders.

Non-Microsoft Security News

Drawn from sources such as Talkin’ Bout Infosec News style coverage and broader industry reports on PHP2Shell exploitation waves, supply-chain events, and agent-driven incidents. October Patch Tuesday set a record with 1,400+ CVEs (including an exploited Windows Shell zero-day, CVE-2026-96951).

AI for the Masses

Practical agent hygiene, open-weight model risk management, and the reality that detection and containment now matter more than perfect patching speed.

Featured Resources

* 2026 Microsoft Digital Defense Report

* Microsoft + NVIDIA open-weight model risk whitepaper

* Project Perception / Guardian Agents documentation

* Rod Trent Substack and related daily check-ins

What’s New in Defender

Agent posture risk assessment, threat detection for Agent 365 agents, real-time protection for tooling servers, ISOC availability, and expanded identity/AD CS detections.

* Full archive and live links: www.microsoftsecurityinsights.com

This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.microsoftsecurityinsights.com

← Previous

Episode 000- Kickstart the cool months! Security Insights - Foresight - Hindsight

November 5, 2026 – Leonard Volling from Lock Base Cyber returns to the show to discuss ISOC and what is going on with Microsoft Sentinel these days WE’RE BACK. The late-summer/early-fall break is over. The crew returned October 22 and is rolling again with practical Microsoft security coverage, agent risks, and high-signal takeaways. October was Cybersecurity Awareness Month (“Securing the Next 250”). The focus remains just doing the basics well while the agentic surface expands and the patch window collapses. Today’s episode features the return of Leonard Volling from Lock Base Cyber. He joins to break down ISOC (Integrated Security Operations Center) in Microsoft Defender and the current state of Microsoft Sentinel. * Podcast Rundowns General / Microsoft Security * From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths (Oct 30) * Inside a malicious Claude Code-branded extension and its persistent SSH backdoor (Oct 30) * IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor Assessment (Oct 29) * Insights from the 2026 Microsoft Digital Defense Report AI Security * Tracking AI adoption in North Korean threat actor tradecraft (Oct 29) * Managing open-weight model risk in enterprise deployments (Microsoft + NVIDIA whitepaper) * 3 lessons from frontier AI vulnerability research (FORGE Lab) * Oct 30: OpenAI’s Latest Discoveries Spark a Backlash + Help! My Kid Hates AI — OpenAI’s models cracked hard problems in math, CS, and physics. Scientists are pushing back on verification difficulty and handpicked reviewers. Humans-in-the-Loop mailbag covers kids who hate AI, rogue agent swarms, and changing a partner’s ChatGPT settings.Transcripts/show notes: npr.org/machinegods Agent365 / Agentic * Agents are your newest insiders. Security must move at their speed. (Project Perception expansions, Dynamic Agent Risk, Guardian Agents, Dynamic Permissions) * The CISO’s evolving role: Protecting and defending in the agentic era * Agent 365 GA and runtime protections continue to expand (Entra Agent ID, Purview, Defender integration). Threat Intelligence * AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (Storm-0940) * Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks * The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime Microsoft Entra Dynamic Conditional Access and Agent ID extensions for local and previously unknown agents; identity remains the control plane for both humans and agents. Defender XDR & Sentinel ISOC (Integrated Security Operations Center) in Defender; Sentinel data connectors and graph capabilities; more than 30 new alerts including AD CS ESC1/ESC8 and related paths. What’s New in Defender continues to emphasize agent posture risk and runtime protections. Leonard Volling returns to discuss ISOC and the current direction of Microsoft Sentinel. Purview – Compliance & Governance Sensitivity labels, DLP, and auditing extended to agent interactions and data access. Cybersecurity Awareness Month October focus on “Securing the Next 250.” Practical actions: phishing-resistant MFA, patch prioritization by real exploitation signal, and treating agents as insiders. Non-Microsoft Security News Drawn from sources such as Talkin’ Bout Infosec News style coverage and broader industry reports on PHP2Shell exploitation waves, supply-chain events, and agent-driven incidents. October Patch Tuesday set a record with 1,400+ CVEs (including an exploited Windows Shell zero-day, CVE-2026-96951). AI for the Masses Practical agent hygiene, open-weight model risk management, and the reality that detection and containment now matter more than perfect patching speed. Featured Resources * 2026 Microsoft Digital Defense Report * Microsoft + NVIDIA open-weight model risk whitepaper * Project Perception / Guardian Agents documentation * Rod Trent Substack and related daily check-ins What’s New in Defender Agent posture risk assessment, threat detection for Agent 365 agents, real-time protection for tooling servers, ISOC availability, and expanded identity/AD CS detections. * Full archive and live links: www.microsoftsecurityinsights.com This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit www.microsoftsecurityinsights.com