CIA Brief 20261003

image

Security

  • Insights from the 2026 Microsoft Digital Defense Report

    Microsoft’s 2026 Digital Defense Report, introduced by Terrell Cox, looks across an environment where threats span infrastructure, identities, applications, cloud, and software supply chains. The post says threat actors are using AI in reconnaissance, social engineering, malware and exploit development, and post-compromise work, while agents that reach enterprise data and tools need identity, access, and monitoring controls. It also covers AI-assisted vulnerability discovery and why defenders get more from connecting signals across systems than from any single source.

    Insider Threat Mitigation Guide

  • CISA’s Insider Threat Mitigation Guide is written for critical infrastructure stakeholders on what insider threats are, the forms they take, and how to build or improve a mitigation program. The 2026 edition updates case studies, statistics, and interactive features from the 2020 edition, and adds material on hybrid and remote work and on Super Intelligence. The guide covers intentional and unintentional threats, detection, assessment, threat management, and steps to stand up a program.

    Phishing Abuses RMM Tools for Persistent Access

  • Microsoft Defender Experts describes July 2026 phishing that delivered a legitimate MSP360 remote-management installer under deceptive names, using lures such as meeting invitations, PDF themes, and software-update prompts. After installation, the MSP360 agent was used to download and silently install a ConnectWise ScreenConnect client, giving a second remote-access channel; Microsoft says it did not see ScreenConnect itself exploited. Follow-on activity included credential access and local data collection, and a similar pattern was also seen with Faronics Deploy. Microsoft has not attributed the campaigns to a named threat actor.

    Star Blizzard refines phishing and malware delivery with the RedFlick technique

  • Since January 2026, Microsoft has seen the Russian state actor Star Blizzard move toward larger phishing campaigns, accounts on compromised websites, and a delivery technique it tracks as RedFlick. RedFlick uses scheduled tasks to deploy the CosmicPulse backdoor after a single user interaction, a shift from earlier ClickFix chains that needed several victim steps. Campaigns have targeted Ukrainian individuals and institutions and international NGOs, think tanks, governments, and financial organisations linked to Ukraine policy, with Microsoft reporting impact on over 100 organisations, mainly in the United States and the United Kingdom.

    NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

  • Microsoft Threat Intelligence describes NeedyMantis, a modular post-compromise malware family seen in a limited set of targeted intrusions against telecommunications organisations, universities, medical nonprofits, intergovernmental organisations, and government contractors. Activity dates to at least October 2025 and was found while following indicators from the DAEMON Tools supply-chain compromise; Microsoft associates at least some use with Storm-3069 and with operators it links to China, without attributing every case to one actor. The malware is typically deployed after access already exists, and uses DLL sideloading, custom encrypted archives, and loadable modules for longer-term access.

    Storm-3168: Agentic-driven cloud attacks using compromised service principals

  • Microsoft Security Research reports Azure activity it tracks as Storm-3168, expanding on the JADEPUFFER agentic ransomware operation Sysdig described in July 2026. In one tenant, compromised service principals enumerated resources and then, in a short destructive sequence, deleted many storage accounts plus a Key Vault, Function App, and App Service plan, while SQL database deletions failed because of an unsupported API version. The same identity later listed storage account keys. Microsoft did not see a ransom note or confirm data theft in the activity described, and notes a client secret for one principal had earlier been exposed in a public GitHub issue, though it could not confirm that secret was the one used.

    Product announcements

  • Action Required: Upgrade ExchangeOnlineManagement PowerShell Module to Version 3.10.1 or Newer

    Microsoft says ExchangeOnlineManagement 3.10.1 and newer add security changes to Exchange Online PowerShell authentication, and it plans stricter logon enforcement from 31 March 2027. After that date, versions older than 3.10.1 may fail in some interactive sign-in scenarios, while 3.10.1 and later should keep working. People most likely to be affected are those on older module versions, PowerShell 7, and interactive authentication with Web Account Manager disabled; certificate-based authentication is not expected to be affected, but Microsoft still recommends the upgrade.

    EWS Deprecation Is Here – What This Means To You

  • Exchange Web Services deprecation in Exchange Online starts with this post, dated 1 October 2026. From early October 2026, setting EWSEnabled to True is no longer enough on its own: an EWSAllowedAppIDs allow list is required for apps that should still use EWS. Microsoft will record affected worldwide tenants at the end of 2 October (Pacific Time), populate allow lists on 8–9 October from the previous 60 days of use, and turn on the requirement from 10 October, with a later phase for tenants that never changed EWSEnabled and never created an allow list.

    An IT pro’s guide to Windows 11, version 26H2

  • Windows 11, version 26H2 is generally available as the next annual feature update, delivered as an enablement package for devices already on version 25H2 or 24H2. The post groups what it turns on across security (including administrator protection, built-in Sysmon, Smart App Control without a clean install, and post-quantum cryptography APIs), management and deployment, and everyday Windows experiences such as File Explorer, Search, Start, and Task Manager. Support resets to 24 months for Home and Pro and 36 months for Enterprise and Education. The first monthly security update for 26H2 is slated for 13 October 2026.

    Now in public preview: Microsoft 365 SharePoint Storage and OneDrive Storage

  • Microsoft 365 SharePoint Storage and Microsoft 365 OneDrive Storage are in public preview for eligible commercial customers, using pay-as-you-go billing tied to an Azure subscription. They add capacity when a tenant goes past included SharePoint quota or a user goes past their OneDrive licensed quota, without a fixed extra storage subscription. Admins can cap extra OneDrive storage per user, and the post explains how active SharePoint storage can be billed together with Microsoft 365 Archive at a lower blended rate. While a tenant is enrolled in SharePoint Storage, quota warning email and admin-center banners are suppressed.

    AI and Copilot

  • Available today: OpenAI’s GPT-6.1 Sol and Claude Sonnet 5.5 in Microsoft Copilot

    Microsoft is adding GPT-6.1 Sol and Claude Sonnet 5.5 to Copilot model choice, after Claude Opus 5.5 and GPT-6 Sol earlier in the month. Both new models start rolling out with usage-based billing in Copilot Cowork and Copilot Studio. They also begin a phased rollout over the coming week in Word, Excel, PowerPoint, and Chat under the user subscription licence, with limits that Microsoft says most people are not expected to hit; users are warned as they approach a limit and can switch to Auto or another model. The post says Work IQ grounds responses in the organisation’s files, meetings, chats, and business data within existing permissions.

    What’s New in Microsoft Copilot | September 2026

  • The September roundup points back to the new Copilot with Home, Code, and Autopilot, then lists other changes for users and admins. User items include a refreshed Copilot Chat in Teams and Outlook, inline agents and skills, a Teams Phone agent, citations and image editing in Word, skills and connectors in PowerPoint, and general availability for Copilot in SharePoint and OneDrive. Admin items include authoritative sources for Copilot Search in the Microsoft 365 admin center (up to 100 SharePoint sites) and targeted Pulse surveys from the Copilot Dashboard. Several items are called out as rolling out in October, including the Edge new-tab Copilot experience and long-running PowerPoint tasks.

    Work IQ: Business and workplace intelligence in the flow of work

  • Work IQ now grounds Copilot and agents in Dynamics 365 and Power Platform business data, in preview from 30 September 2026 with rollout continuing through October 2026. The post describes a shared semantic model, reusable business skills, and governed actions so Copilot can answer business questions and update source records within the user’s permissions, with Dataverse as the store behind the model and skills. Dynamics 365 Finance and Operations support is noted as rolling out in late October 2026. Governance stays split across the Microsoft 365 admin center, Power Platform admin, and makers, under Microsoft Agent 365.

    Microsoft releases Copilot update: Here’s what you need to know

  • This CNBC Television segment, titled on YouTube as in the Teams post, covers Microsoft’s Copilot update as it competes with other work agents. The report describes one app that brings together work, coding, and an Autopilot mode for background tasks and custom agents, instead of keeping Office Copilot separate from GitHub Copilot. It also says users can switch among OpenAI, Anthropic, and Microsoft models, and that charging for some of these tools is moving from a flat subscription toward usage-based pricing.

    The new Copilot is here: The opportunity for Microsoft partners

  • One post shares the Microsoft Partner Blog article under this title. A later post in the same channel, headed “Cowork will be enabled by default with CSP”, quotes the 25 September 2026 partner announcement: starting 2 November 2026, usage-based billing will be enabled by default for new Microsoft 365 Copilot Business licences purchased through CSP, and says that makes it easier to activate eligible experiences such as Copilot Cowork. Both posts use the same partner article URL.

    After hours

    How do Graphics Cards Work? Exploring GPU Architecture – https://www.youtube.com/watch?v=h9Z4oGN89MU

    Editorial

    If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

    If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

    Watch out for the next CIA Brief next week

Nobody Applauds the Work They Cannot See Yet

image

I have noticed something uncomfortable about progress. People are interested in the result, but rarely in the long stretch before it. They notice the successful launch, the growing business, the confident presentation, or the polished product. They usually do not notice the quiet months spent learning, correcting mistakes, rebuilding plans, and wondering whether any of it will work.

I do not think that makes people cruel. I think it makes them busy. Everyone has their own problems, deadlines, clients, and doubts. I cannot expect an audience to gather around every early idea simply because it matters to me.

The beginning is usually a private commitment

When I start something new, I am often asking others to see a future that does not exist yet. That is a difficult request. An unfinished idea has no evidence behind it. A new service has no track record. A half-built process looks more like extra work than progress.

I have seen this with Microsoft 365 Copilot adoption. Someone inside a business becomes excited, runs a few prompts, and expects the rest of the team to share the enthusiasm. Then the response is muted. The idea has not failed. It simply has not produced a result that matters to everyone else yet.

Instead of selling the vision harder, I would prove it quietly. I might use Copilot in Outlook to summarise a cluttered email thread, identify the unresolved question, and draft a clear response. I would check the output, improve it, and record what changed. If that saves confusion during a client conversation, I now have something more useful than enthusiasm. I have evidence.

Results make the backstory visible

Once something works, people suddenly become curious about how it happened. The early mornings become discipline. The failed attempts become lessons. The decision to continue becomes conviction.

Before the result, those same actions can look pointless from the outside.

That is why I try not to depend on recognition while I am building. Applause is unreliable fuel. If I need constant encouragement to keep moving, I give other people control over work they may not yet understand.

I would rather build a small body of proof. For an MSP, that could be an internal Copilot workflow that turns Teams meeting notes into a checked action list in Planner. It does not need a launch campaign. It needs to work repeatedly, protect client information, and remove a real bottleneck. Once technicians stop losing follow-up tasks and clients receive clearer updates, the story earns attention naturally.

Winning is not only the headline moment

I also think we define winning too narrowly. It does not have to mean becoming famous, selling a company, or standing on a stage. I can win by solving one stubborn problem properly. I can win by becoming dependable. I can win by continuing long enough to become useful.

The danger is turning the lack of attention into bitterness. I do not want to spend my energy resenting people for missing the early chapters. They were not responsible for carrying my belief. That was my job.

So I keep the story, but I do not lead with it. I lead with the outcome. I show what improved, who was helped, what became easier, and what I learned. Then, if people want to know how I got there, the difficult chapters finally have context.

I cannot control when others become interested. I can control whether I keep doing the work before they are.

Most Problems Do Not Need a Brilliant Fix

image

I have watched businesses spend months searching for a clever answer to a problem that was mostly caused by irregular effort.

The sales pipeline is weak, so the team looks for a new CRM. Documentation is poor, so someone proposes a knowledge-management project. Copilot usage is patchy, so the conclusion is that the technology has not delivered. Yet when I look closer, the real issue is often much simpler. The useful activity happened for a week, then stopped.

I do not think most organisations have an ideas problem. I think they have a follow-through problem.

Repetition turns good intentions into a system

The value appears when the same useful behaviour happens again tomorrow, next week and next month.

I see this with Microsoft 365 Copilot adoption. Someone runs an impressive demonstration, people try a few prompts, and enthusiasm rises. Two weeks later, everyone is back to old habits. Nothing was technically wrong. There was simply no rhythm around the new behaviour.

I would rather see a team choose one recurring task and improve it every day. For example, before replying to a complicated customer email, I might ask Copilot in Outlook to summarise the thread, identify unanswered questions and draft a response. The important part is that I use the same workflow repeatedly until it becomes normal.

That modest habit will usually produce more value than another broad training session filled with possibilities nobody applies.

Small routines expose the real problems

Consistency does more than produce output. It creates evidence.

If I review overdue work in Planner every Monday morning, I quickly learn whether tasks are unclear, ownership is missing or priorities keep changing. If a service team records recurring fixes in a SharePoint knowledge base after each incident, gaps become visible. If I ask Copilot in Teams to recap a regular meeting and compare decisions with open actions, I can see where commitments are slipping.

Without repetition, every failure looks like an exception. With repetition, patterns become hard to ignore.

They buy a tool, restructure a meeting or create another policy. Sometimes those changes are needed. But a steady routine gives me enough information to distinguish a genuine system problem from a discipline problem.

I cannot improve what I only do occasionally.

Make the useful action easier to repeat

I do not rely on motivation. Motivation is helpful, but it is unreliable. I try to reduce the number of decisions required to begin.

That might mean pinning a standard prompt in a Teams channel, using a Loop component for the weekly agenda, or placing the client-review template where everyone already works. I want the next correct action to be obvious and close at hand.

The routine also needs to be small enough to survive a busy week. A ten-minute review completed regularly is better than a two-hour process everyone avoids. Once the habit is stable, I can expand it. Starting with a grand process usually creates a grand abandonment.

This is why I am sceptical when someone says they need a more advanced tool before they can move forward. Often they need a simpler commitment, repeated long enough to reveal what actually deserves attention.

I do not believe steady effort solves every problem. Some issues require money, expertise, authority or a difficult decision. But I have found that reliable habits remove a surprising amount of noise. They strengthen the basics, expose the exceptions and make the harder problems easier to recognise.

Before I search for a dramatic fix, I ask a more useful question: what worthwhile action have I not repeated often enough?

Building Your Own Path Changes What Work Means

image

I have noticed something uncomfortable about people who spend years building their own business, product or audience. They do not simply collect a different set of skills. They slowly lose their tolerance for waiting to be told what matters.

That can make a conventional job harder to return to. Not because they have become incapable, arrogant or unmanageable. It is because building something of their own has changed the way they see work.

Ownership changes the questions

When I am responsible for the outcome, I cannot hide behind activity. I have to ask whether the work solved the problem, helped the customer or moved the business forward. A full calendar is not proof of progress. Neither is a polished presentation, a long email chain or another internal meeting.

Once I learn to think that way, it is difficult to switch it off.

I begin noticing decisions that take three meetings but could have taken one conversation. I see reports being produced because they were produced last month. I hear people defending a process long after anyone remembers why it exists.

That does not make employment bad. It means I have become used to a different relationship with consequence. In my own business, a poor decision eventually arrives at my desk wearing a bill. A good decision creates breathing room. The feedback is direct.

Tools amplify the difference

Copilot makes this contrast even sharper for me. If I can ask Copilot in Outlook to summarise a long thread, draft a clear reply and identify the unresolved question, I no longer accept inbox administration as the work itself. If Copilot in Teams can pull the decisions and actions from a meeting, I want the team spending its energy on judgement, not transcription.

The important shift is not speed. It is agency.

I can move from an idea to a working draft in Word, test the numbers in Excel, capture the next actions in Planner and share the context in Teams without waiting for several people to hand the work from one queue to another. The tools reduce the distance between deciding and doing.

For someone building a business, that distance matters. Every delay is felt personally. Every unnecessary dependency becomes visible. I start designing work around outcomes because I cannot afford to design it around organisational comfort.

The risk is real

There is a downside. I can become impatient. I can underestimate why larger organisations need controls, specialist roles and deliberate review. I can mistake freedom for universal good practice. Sometimes structure protects customers, employees and the business itself.

So I do not think the lesson is that founders are better than employees. I think the lesson is that prolonged ownership rewires expectations. I become accustomed to choosing priorities, carrying uncertainty and seeing the whole problem rather than one assigned piece.

If I ever return to a traditional role, the title will matter less than the room available to think and act. I will need meaningful ownership, clear consequences and permission to improve the system rather than merely operate it.

Building my own thing may narrow the jobs that still fit me. But it also clarifies the work I am willing to do. I no longer want to rent out hours and call that contribution. I want to own a problem, make a decision and remain close enough to learn from what happens next.

That may make me a difficult fit for some employers. It may also make me exactly the person another organisation needs.

GPT 6.1 Sol is our new champ

image

Another week, another new model. This time it is GPT Sol 6.1 arriving, so I’ve put it to the test against the current champion GPT Astra 6 and found:

GPT Sol 6.1 beats Astra 6 – https://github.com/directorcia/general/blob/master/Copilot/Comparisons/20260930-Cowork-GPT61Sol-Grok-eval.md

but it is more expensive than Astra 6:

Opus 5.5 = 23,494 credits

GPTSol 6.1 = 10,173 Credits

GPT Astra 6 = 6,067 credits

Fable 5.1 = 3,453 credits

Fable 5 (Preview) = 3,387 credits [Model no longer shown]
Fable 5 (Copilot)(Preview) = 3,373.8 credits [Model no longer shown]

GPT 5.6 Sol = 2,800.50 credits [Model no longer shown]
Sonnet 5 = 2,509.3 credits [Model no longer shown]
Opus 4.8 = 2,487 credits [Model no longer shown]

GPT Sol 6 = 2,243 credits [Model no longer shown]

Opus 5 = 2,240 credits [Model no longer shown]

GPT 5.5 = 1,200 credits
GPT 5.6 Terra = 260 credits [Model no longer shown]

Interestingly, Sol 6.1 generated a 73 page report while Astra 6 was only 35! That’s 2 x the output. Stop and think about that, 73 detailed pages with a single prompt! Amazing!

I also compared it to its predecessor, GPT Sol 6 and found – https://github.com/directorcia/general/blob/master/Copilot/Comparisons/20260930-Cowork-GPT6-61Sol-Grok-eval.md

GPT 6.1 Sol is also the clear winner here as the results show. Again, an amazing improvement jump by my comparison from only Sol 6.0 to Sol 6.1! Where is this going to end?

The summary of the all the outputs produced is here:

https://github.com/directorcia/general/blob/master/Copilot/Comparisons/20260816-File-paramters.md

while the results, including outputs are here:

https://github.com/directorcia/general/tree/master/Copilot/Comparisons

How much better can these models get? We’ll know shortly, I’ll bet.

The Promises Nobody Else Sees

image

Confidence is often treated as something you either have or you do not. Some people appear comfortable speaking in a meeting, presenting to a room or making a difficult decision. Others hesitate.

I do not think confidence begins in those public moments.

I think it is built much earlier, usually when nobody is watching.

It is built when I decide that I will finish something and then actually finish it. When I block out an hour to learn a new skill and resist the temptation to move it. When I tell myself I will deal with the awkward email today rather than leave it sitting in Outlook for another week.

These actions may look small, but they create evidence.

Private actions shape public behaviour

Every commitment I keep strengthens the relationship I have with myself.

If I repeatedly promise that I will start exercising, complete a course, prepare properly or have a difficult conversation, but never follow through, I begin to notice. Even if nobody else knows, I know.

The reverse is also true.

When I consistently do what I said I would do, I walk into public situations with a different posture. I do not need to manufacture certainty. I have a history I can rely on.

That history matters far more than motivational quotes or temporary enthusiasm.

I see the same principle at work with Microsoft 365 Copilot adoption. Someone announces that they are going to “get serious about AI”, attends a demonstration and then returns to their normal routine. A month later, they conclude that Copilot has not changed much.

The problem is not necessarily the technology. The private commitment never became a working habit.

A better approach is much less dramatic. I might decide that, before every client meeting, I will use Copilot in Outlook and Teams to review the relevant conversation, identify open questions and prepare a short briefing. Then I do it. Every time.

That repeated action builds capability. More importantly, it builds trust in my own preparation.

Systems make promises easier to keep

Good intentions are unreliable, especially when the inbox is full and the day starts moving faster than expected.

I therefore try to make my commitments visible. If something matters, it belongs in my calendar, Planner or a simple Loop workspace. I want to see what I agreed to do and whether I completed it.

This is not about filling Microsoft 365 with another complicated productivity system. It is about reducing the opportunity to quietly renegotiate with myself.

Copilot can help me break a vague intention into a practical next action. It can summarise my notes, turn a discussion into tasks or help draft the first version of a document I have been avoiding. But it cannot supply the discipline to return tomorrow and continue.

Technology can lower the friction. I still have to honour the decision.

Confidence is accumulated evidence

I have learned not to wait until I feel confident before acting. I act in a way that gives confidence something solid to stand on.

That might mean preparing properly for a presentation, completing the uncomfortable task first or spending twenty focused minutes learning something instead of promising myself an imaginary free afternoon.

Public confidence is rarely created in public.

It is the visible result of many quiet decisions that were made, respected and completed. If I want to trust myself when the pressure arrives, I need to become trustworthy when nobody is checking.

That is where confidence really starts.

Thinking Is Useful. Movement Is Better.

image

I can usually tell when I have stopped making progress. The work is still open. The notes keep getting longer. I am comparing options that were already compared yesterday. I tell myself I am being thorough, but I am often just circling the decision.

Thinking matters. Reflection matters. But there is a point where more consideration stops improving the result. It simply protects me from the discomfort of beginning.

Activity creates information

I have learned that many questions cannot be answered from the chair. I can speculate about whether a client will value a new service, whether a training session will land, or whether a process will save time. Eventually, though, I need contact with the real world.

A short client conversation gives me more useful information than another hour rewriting the proposal. A rough workshop delivered to ten people teaches me more than another week adjusting the slides. A small test inside the business reveals the friction that planning tends to hide.

Action does not merely complete work. It produces evidence.

That changes how I view mistakes. A small, reversible step is not a final judgement on the idea. It is a way to gather better material for the next decision. I would rather discover an awkward assumption on Tuesday afternoon than preserve it perfectly in a planning document for three months.

Copilot should shorten the distance to a first attempt

This is where I see Microsoft 365 Copilot being most useful. It should not become another place to endlessly explore possibilities. It should help me turn a vague intention into something I can inspect, use, and improve.

If I am avoiding a difficult reply, I can ask Copilot in Outlook to draft a clear response from the email thread. I still review it. I still own the message. But the blank page is gone, and I now have something concrete to react to.

If a project has become a cloud of discussion, I can use Copilot in Teams to summarise the meeting, pull out unresolved points, and turn the next action into a task in Planner. The value is not the summary itself. The value is that the conversation now has somewhere to go.

The same principle applies in Word. I can ask Copilot to shape scattered notes into a rough brief, then send that brief to someone who can challenge it. The first version does not need to be impressive. It needs to exist.

Reduce the size of the next move

When I keep delaying, the problem is often not laziness. I have made the next step too large in my head. “Build the service” feels heavy. “Write the one-page outline” feels possible. “Fix the whole client experience” creates fog. “Call one client and ask where the handover failed” creates direction.

I try to reduce the commitment without reducing the learning. Send the draft to one person. Run the process once. Test the prompt on one real email. Put the idea into tomorrow’s team meeting and listen carefully to what happens.

I do not need certainty before I move. I need a step small enough to take and useful enough to teach me something.

The mind can make an unfinished idea feel enormous. A little movement restores its proper size. When I notice myself thinking in circles, I no longer ask for a better thought. I ask what I can put into the world before the day ends.