Security
- AI supercharges cyberattacks on Australia, with superannuation savings in the firing line
The ASD’s annual threat assessment says frontier AI is helping attackers find and exploit vulnerabilities faster. The ASD sent more than 4,400 notifications of possible malicious activity last year, up 80 per cent, and the average cost of an attack on a medium-sized business rose 45 per cent to $141,300. The message for Australian SMBs is blunt: get legacy kit off the internet and put security ahead of availability, even if that means a short outage to patch.
https://www.smh.com.au/politics/federal/ai-supercharges-cyberattacks-on-australia-with-superannuation-savings-in-the-firing-line-20261026-p618mz.html - From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
Attackers posed as IT support in Teams and talked users into Quick Assist sessions. From there they abused misconfigured certificate templates (ESC1) or relayed NTLM to AD CS web enrollment (ESC8) to get certificates for privileged accounts and domain controllers. Good reminder that a password reset doesn’t revoke an issued certificate, so audit AD CS templates and web enrollment on any hybrid client, block external Teams chats you don’t need, and don’t leave privileged accounts out of automatic containment.
https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/ - Tracking AI adoption in North Korean threat actor tradecraft
Microsoft says AI use among North Korean groups is now high. They’re using it to spin up front companies, generate dozens of tailored lures in minutes, trojanise source code repositories and run the ARTEX agentic pen-testing framework. The attacks are still human-directed and rely on social engineering and legitimate tools, so the defences haven’t changed, but expect fake job applicants and fake vendors to look a lot more convincing.
https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/ - Part 4: See, investigate, and measure email and collaboration attacks with Defender reporting
Version 4 of the free Detections and Insights workbook for Sentinel and Power BI adds a Teams and Collaboration view, an impersonation and BEC tab, and 125 new or improved advanced hunting queries, including a Teams protection folder. There’s also a new Attack Simulation Training report that tracks who clicks, who reports and who keeps failing. Worth a look for MSPs, as the Sentinel workbook can combine several workspaces in one view, which makes multi-tenant reporting much easier.
https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-4-see-investigate-and-measure-email-and-collaboration-attacks-with-defender/4562274 - MAI Cyber 1.1 Flash: Sharper findings and fewer tokens inside MDASH
Microsoft’s in-house security model for vulnerability discovery now costs 18 per cent less per scan with comparable results, and it already runs almost half of all MDASH scans. It’s only available to verified MDASH customers, so most SMBs won’t touch it directly. Still early, but it shows defenders getting the same AI-driven bug hunting that attackers are already using.
https://microsoft.ai/news/mai-cyber-1-1-flash/
Microsoft 365 & Windows
- What’s New in Microsoft Copilot | October 2026
A big month: the Copilot app Home brings Chat and Cowork together, Projects and skills come to Copilot Chat in November, and Autopilot, an always-on personal agent with its own mailbox, files and remote computer, arrives for Frontier users in November. On the admin side, Purview can now retain Copilot memory and DLP is extending to Cowork in preview. Plenty of this is Frontier-only for now, so check what’s actually reaching each client tenant before you start training users, and have a governance plan ready before Autopilot lands.
https://techcommunity.microsoft.com/blog/microsoft-copilot-blog/what%E2%80%99s-new-in-microsoft-copilot–october-2026/4568528
Cloud & AI
- MAI-Image-2.6 and MAI-Image-2.6-Flash are now generally available in Microsoft Foundry
Microsoft’s own image models are now GA in Foundry. They support up to five reference images to keep products and branding consistent, web grounding through Bing, and output up to 1.5K, with Flash aimed at fast, high-volume work. Nothing groundbreaking, but it’s another sign Microsoft is building its own model stack rather than relying only on OpenAI, which matters for anyone building client solutions on Foundry.
https://techcommunity.microsoft.com/blog/azure-ai-foundry-blog/mai-image-2-6-and-mai-image-2-6-flash-are-now-generally-available-in-microsoft-f/4566327 - Cheap code, precious trust: Code modernization at scale
Microsoft explains how it uses AI agents to migrate and modernise huge codebases such as Windows and Azure, including moving C and C++ to Rust, backed by testing and formal verification. Its key point is that generating code is now the easy part and knowing whether to trust it is the hard part. The same applies to every script and automation your team is now generating with AI, so verify before it goes near a client tenant.
https://commandline.microsoft.com/agentic-software-engineering-large-scale-code-migration-language-modernization-spec-driven-development/ - How Microsoft quietly reinvented itself to build better AI
Fast Company goes inside Microsoft’s AI reorganisation: one Copilot super app across Chat, Code, Cowork and Autopilot, in-house frontier models now that the OpenAI tie is looser, and an internal accelerator to spread AI know-how. Worth a read for the direction of travel, because “one Copilot” means less product sprawl to explain to clients but a lot more interface change along the way. Much of the new app is still in Frontier preview with no GA date.
https://www.fastcompany.com/91607730/microsoft-ai-copilot-autopilot-kevin-scott-charles-lamanna-mustafa-suleyman
Other
- Partner Blog | Make each Microsoft 365 Business Premium opportunity a security conversation
Microsoft’s SMB lead tells partners to treat every Business Premium deal as a security conversation, with the Defender and Purview Suites for Business Premium as the next step, and points to the FY27 SMB sales plays and Channel Partner Playbook. It’s sales guidance, not a new discount or incentive. Good reminder that the recurring revenue comes from managing posture after the sale, not from the licence itself.
https://techcommunity.microsoft.com/blog/partnernews/partner-blog–make-each-microsoft-365-business-premium-opportunity-a-security-co/4568159 - Microsoft Announces First Quarter Results (FY27 Q1)
Revenue was $92.3 billion, up 19 per cent, and Microsoft Cloud revenue was $63.9 billion, with growth accelerating to 30 per cent. Nadella’s pitch is all about agent safety, security and letting customers “own their own intelligence”. Nothing groundbreaking for day-to-day operations, but it tells you where Microsoft’s investment, and its partner incentives, will keep flowing.
https://www.microsoft.com/en-us/Investor/earnings/FY-2027-Q1/press-release-webcast
After hours
Will AI cause utopia or disaster? – https://www.youtube.com/watch?v=AoKo6EujpW8
Editorial
If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.
If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.
Watch out for the next CIA Brief next week
