Like many people, I’ve gotten into the habit of simply choosing the newest model and moving on. GPT-5? Sure. Claude Opus? Sounds good. Gemini 2.5 Pro? Why not? Beyond a general understanding that some models are better at coding, some reason more deeply, and some are optimized for speed or lower cost, I realized I… Read More: Understanding the Modern AI Landscape »
Every once in a while, a conversation reminds me that no matter how much time I’ve spent in this industry, there is always something new to learn. Recently, a coworker repeatedly used the word harness while discussing AI agents. It wasn’t the word itself that caught my attention. It was the way it was being… Read More: When Did “Harness” Become an AI Term? »
A few weeks ago, I had the opportunity to attend a small private conference where one of the speakers from DARPA shared the story behind the AI Cyber Challenge (AIxCC), a program I’ll discuss later in this article. Around the same time, I was researching many of these topics for work as organizations began asking… Read More: AI and the Future of Secure Code »
I was excited to see Microsoft embrace the OpenClaw concept at Build a few weeks ago with the introduction of a new service called Scout. I finally got around to spending some time with it this past week, and honestly, it’s been a pretty awesome experience. I actually had a blog post sitting in my… Read More: My Top 10 Vibe Coding Tips »
I was recently asked, how are automation rules managed in the Defender portal when multiple Sentinel workspaces are connected? I expected the answer to be simple. After all, I’ve spent a significant amount of time working with Sentinel, and not many things in this space come as a surprise anymore. I opened the Defender portal… Read More: Closer Look at Sentinel Automation in the Defender Portal »
Microsoft first announced Sentinel Data Lake in July 2025 and immediately generated a lot of interest across the security community. The value proposition was compelling: For many organizations, especially those collecting hundreds of gigabytes or even terabytes of data per day, Sentinel Data Lake looked like the next logical evolution of the platform. Then reality… Read More: Waiting for Sentinel Data Lake? »
I recently found myself needing to learn Microsoft Agent 365. Like most new Microsoft services, my first stop was the documentation. After an hour or two of focused reading, combined with some time in a lab environment clicking through the menus, I felt like I had a reasonably good understanding of what the service does… Read More: Agent 365: The Quick Version »
“Goddammit, Donut, quit typing in all caps.” “I AM NOT TYPING IN ALL CAPS, CARL. I AM USING AN AI CODING ASSISTANT. IT JUST THINKS EVERYTHING IS IMPORTANT.” That exchange never happened in Dungeon Crawler Carl, but after spending the last year vibe coding, it feels like it could have. Over the past year, I’ve… Read More: The Other 80% of Vibe Coding »
Have you heard about Microsoft’s new Claude Enterprise connector for Purview. At a high level, enterprise AI connectors are designed to collect and govern activity occurring within enterprise AI platforms. Depending on the platform and integration, that can include information such as user activity, utilization, prompts, responses, uploaded content, administrative actions, and other telemetry generated… Read More: Enterprise AI Connectors for Purview »
Recently, I found myself thinking about certification exams again. It had been several months since I last sat for a major certification exam, and while reviewing some of Microsoft’s newer AI certifications, I started asking myself a simple question: What should I take next? That led me down a rabbit hole of reviewing Microsoft’s current… Read More: Microsoft Security and AI Certification Roadmap »
Why I Started Building This Several weeks ago, I set out to create a proper Microsoft Defender Vulnerability Management (TVM) data connector for Microsoft Sentinel. What started as a relatively simple side project turned into a much larger effort involving API comparisons, ingestion architecture, scaling limitations, and a deeper understanding of how Defender exposure-management data… Read More: Sentinel TVM Snapshot Data Connector V2 »
Over the last two years, Microsoft’s AI ecosystem has expanded incredibly fast. What initially started as a relatively straightforward launch of Microsoft 365 Copilot has rapidly evolved into a much broader platform involving enterprise grounding, semantic intelligence, multi-model orchestration, AI agents, delegated workflows, governance platforms, and enterprise AI security controls. Along the way, Microsoft has… Read More: Understanding Microsoft’s Growing AI Ecosystem »
The phrase “AI Security” is becoming increasingly difficult to define because the risks change dramatically depending on how organizations interact with AI. Sometimes employees are simply using public AI services to summarize documents or generate content. Sometimes organizations deploy enterprise copilots grounded on internal data. Increasingly, organizations are building AI workflows and agents capable of… Read More: Securing AI Depends on How AI Is Being Used »
Security teams are starting to use and pay closer attention to tools like MCP servers, AI agents, GitHub Copilot, VS Code integrations, and other AI-assisted operational tooling. As organizations become more familiar with these tools, it naturally raises questions around the privacy and security implications of connecting them to enterprise systems. The real issue is… Read More: Authorized Access Unauthorized Destinations »
What started as a simple idea, exploring how AI could support a modern Security Operations Center, has grown into a structured series that documents both real solutions and the learning journey behind them. This collection of articles is intended to walk through the evolution from traditional, deterministic automation toward more adaptive, agent-driven approaches, while sharing… Read More: AI-Driven SOC Series Overview »
Introduction This series started with a simple question: what does an agentic SOC actually look like in practice? Early on, I focused on making that idea tangible. Instead of staying theoretical, I built out a working approach using Azure AI Foundry and Azure Logic Apps. The goal was not to prescribe a single “right” architecture,… Read More: Intro and Initial Deployment of a Foundry Agent »
This started as a straightforward idea. I wanted to get Defender Threat and Vulnerability Management (TVM) data into Microsoft Sentinel for long-term retention and dashboarding. The data potentially has value, and Sentinel is designed to ingest large volumes of security data, so on the surface it felt like something that should already exist. After building… Read More: Sentinel TVM Snapshot Data Connector »
This article builds on a series of previous discussions around building an agentic SOC solution, comparing agentic versus deterministic logic, and walking through an overview of Sentinel MCP. In this one, the focus shifts to hands-on evaluation. The goal here is to take Microsoft Sentinel MCP and run it inside Visual Studio Code to see… Read More: Using Sentinel MCP in VS Code »
Earlier this week, I had a conversation about Sentinel MCP where I gave a quick gut reaction. I said Sentinel MCP, or more broadly this type of model, might be on its way out. The thinking felt reasonable at the time. With how easy it is to vibe code API integrations now, why introduce another… Read More: Sentinel MCP and the Evolution of Automation »
There is a subtle shift happening in how we design incident response systems. For years, most solutions followed a deterministic (explicit, rule-based, structured) model. An alert fires, a playbook runs, actions execute in a defined order, and results are returned. When something breaks, we trace the path, fix the logic, and run it again. That… Read More: Deterministic vs. Agentic Incident Response »