I occasionally have a conversation with a customer about how quickly their security monitoring systems generate alerts. Sometimes they are evaluating Microsoft’s first-party alerting. Other times they are integrating Microsoft security services with a third-party ticket management system and trying to understand why it takes so long for something to arrive in the queue. These… Read More: Your Alert Is Already Late »
I often encounter customers who own Microsoft Defender for Endpoint but have never enabled it. Sometimes they purchased a licensing package to gain access to other capabilities, and Defender for Endpoint came along with it. Often, they already have a third-party antivirus or EDR solution they prefer, so enabling another service seems unnecessary or potentially… Read More: The Power of MDE Passive Mode »
This week, I found it necessary to take a closer look at Microsoft Entra Verified ID. I thought I would share what I learned, along with my impressions of what the service does well and where I would like to see it improve. The easiest comparison is a driver’s license. You provide evidence to the… Read More: Learning Microsoft Entra Verified ID »
I was poking around old folders and found an Excel spreadsheet I’ve kept for years to track work travel. After years as a road warrior, my travel has slowed significantly in a new role. I like the job, but I’ll admit I get a little stir-crazy when I go a month without setting foot on… Read More: Reconstructing a Travel Life with AI »
Over the past few weeks, I have been working with a customer preparing for an enterprise deployment of Microsoft App Control for Business. This is an established environment with years of existing application deployments, not a new environment where every device and application can be standardized from the beginning. I had encountered App Control before,… Read More: App Control for Business: Looking Beyond the Surface »
It has been a while since my last post. Work has been busy, I started a new semester in my applied artificial intelligence program, and I have escaped into a few video games when time permits. My current course focuses on machine learning operations, or MLOps. While working through this week’s material, I realized that… Read More: Making Sense of Notebooks »
For the past few years, shortly before the beginning of the school year, I have required my two children to attend what I call “Andrew University.” It is only an hour. We sit down as a family and talk about school, grades, priorities, technology, and some of the lessons I have learned from my own… Read More: Welcome to Andrew University »
I started thinking about the economics of artificial intelligence on the flight home from DEF CON. I had spent the week talking with security researchers, developers, technology companies, and vendors, nearly all of whom were discussing AI in one form or another. Some were using it to improve existing products. Others were building entirely new… Read More: The Strange Economics of Artificial Intelligence »
If your feed is anything like mine, you have probably been inundated with Black Hat and DEF CON posts over the past week. After five years of sharing my own recaps, I recognize that I am adding one more voice to an already crowded conversation. If you care to keep reading, however, I will try… Read More: Inside My Fifth Black Hat and DEFCON »
A few weeks ago, a viral prompt encouraged people to use AI to create illustrated resume or work profile images from their LinkedIn profiles. They were fun to look at, but they also made me wonder… What if, instead of visualizing your career, you visualized your life? That simple question led me down a surprisingly… Read More: The 40-Milestone Challenge »
Like many people, I’ve gotten into the habit of simply choosing the newest model and moving on. GPT-5? Sure. Claude Opus? Sounds good. Gemini 2.5 Pro? Why not? Beyond a general understanding that some models are better at coding, some reason more deeply, and some are optimized for speed or lower cost, I realized I… Read More: Understanding the Modern AI Landscape »
Every once in a while, a conversation reminds me that no matter how much time I’ve spent in this industry, there is always something new to learn. Recently, a coworker repeatedly used the word harness while discussing AI agents. It wasn’t the word itself that caught my attention. It was the way it was being… Read More: When Did “Harness” Become an AI Term? »
A few weeks ago, I had the opportunity to attend a small private conference where one of the speakers from DARPA shared the story behind the AI Cyber Challenge (AIxCC), a program I’ll discuss later in this article. Around the same time, I was researching many of these topics for work as organizations began asking… Read More: AI and the Future of Secure Code »
I was excited to see Microsoft embrace the OpenClaw concept at Build a few weeks ago with the introduction of a new service called Scout. I finally got around to spending some time with it this past week, and honestly, it’s been a pretty awesome experience. I actually had a blog post sitting in my… Read More: My Top 10 Vibe Coding Tips »
I was recently asked, how are automation rules managed in the Defender portal when multiple Sentinel workspaces are connected? I expected the answer to be simple. After all, I’ve spent a significant amount of time working with Sentinel, and not many things in this space come as a surprise anymore. I opened the Defender portal… Read More: Closer Look at Sentinel Automation in the Defender Portal »
Microsoft first announced Sentinel Data Lake in July 2025 and immediately generated a lot of interest across the security community. The value proposition was compelling: For many organizations, especially those collecting hundreds of gigabytes or even terabytes of data per day, Sentinel Data Lake looked like the next logical evolution of the platform. Then reality… Read More: Waiting for Sentinel Data Lake? »
This is a topic I find myself explaining regularly, especially when customers are migrating to the unified Defender experience and trying to understand how existing automation, ITSM integrations, and incident workflows will be affected. It’s one of my longer articles, but understanding alerts, incidents, and correlation is an important part of understanding how Microsoft Sentinel… Read More: Sentinel and Defender Incident Correlation »
I recently found myself needing to learn Microsoft Agent 365. Like most new Microsoft services, my first stop was the documentation. After an hour or two of focused reading, combined with some time in a lab environment clicking through the menus, I felt like I had a reasonably good understanding of what the service does… Read More: Agent 365: The Quick Version »
“Goddammit, Donut, quit typing in all caps.” “I AM NOT TYPING IN ALL CAPS, CARL. I AM USING AN AI CODING ASSISTANT. IT JUST THINKS EVERYTHING IS IMPORTANT.” That exchange never happened in Dungeon Crawler Carl, but after spending the last year vibe coding, it feels like it could have. Over the past year, I’ve… Read More: The Other 80% of Vibe Coding »
Have you heard about Microsoft’s new Claude Enterprise connector for Purview. At a high level, enterprise AI connectors are designed to collect and govern activity occurring within enterprise AI platforms. Depending on the platform and integration, that can include information such as user activity, utilization, prompts, responses, uploaded content, administrative actions, and other telemetry generated… Read More: Enterprise AI Connectors for Purview »