Category Archives: LinkedIN

Enterprise AI Connectors for Purview

Have you heard about Microsoft’s new Claude Enterprise connector for Purview. At a high level, enterprise AI connectors are designed to collect and govern activity occurring within enterprise AI platforms. Depending on the platform and integration, that can include information such as user activity, utilization, prompts, responses, uploaded content, administrative actions, and other telemetry generated… Read More: Enterprise AI Connectors for Purview »

Microsoft Security and AI Certification Roadmap

Recently, I found myself thinking about certification exams again. It had been several months since I last sat for a major certification exam, and while reviewing some of Microsoft’s newer AI certifications, I started asking myself a simple question: What should I take next? That led me down a rabbit hole of reviewing Microsoft’s current… Read More: Microsoft Security and AI Certification Roadmap »

Building a YouTube Statistics Tracker at 35,000 Feet

I was flying home from a security conference in Boston on a Friday evening, enjoying an unexpected complimentary upgrade to business class, listening to Dungeon Crawler Carl, and reflecting on some of the conversations I had over the previous few days. During one of those conversations, I had confidently stated that a YouTube channel I… Read More: Building a YouTube Statistics Tracker at 35,000 Feet »

Sentinel TVM Snapshot Data Connector V2

Why I Started Building This Several weeks ago, I set out to create a proper Microsoft Defender Vulnerability Management (TVM) data connector for Microsoft Sentinel. What started as a relatively simple side project turned into a much larger effort involving API comparisons, ingestion architecture, scaling limitations, and a deeper understanding of how Defender exposure-management data… Read More: Sentinel TVM Snapshot Data Connector V2 »

Understanding Microsoft’s Growing AI Ecosystem

Over the last two years, Microsoft’s AI ecosystem has expanded incredibly fast. What initially started as a relatively straightforward launch of Microsoft 365 Copilot has rapidly evolved into a much broader platform involving enterprise grounding, semantic intelligence, multi-model orchestration, AI agents, delegated workflows, governance platforms, and enterprise AI security controls. Along the way, Microsoft has… Read More: Understanding Microsoft’s Growing AI Ecosystem »

Securing AI Depends on How AI Is Being Used

The phrase “AI Security” is becoming increasingly difficult to define because the risks change dramatically depending on how organizations interact with AI. Sometimes employees are simply using public AI services to summarize documents or generate content. Sometimes organizations deploy enterprise copilots grounded on internal data. Increasingly, organizations are building AI workflows and agents capable of… Read More: Securing AI Depends on How AI Is Being Used »

Authorized Access Unauthorized Destinations

Security teams are starting to use and pay closer attention to tools like MCP servers, AI agents, GitHub Copilot, VS Code integrations, and other AI-assisted operational tooling. As organizations become more familiar with these tools, it naturally raises questions around the privacy and security implications of connecting them to enterprise systems. The real issue is… Read More: Authorized Access Unauthorized Destinations »

AI-Driven SOC Series Overview

What started as a simple idea, exploring how AI could support a modern Security Operations Center, has grown into a structured series that documents both real solutions and the learning journey behind them. This collection of articles is intended to walk through the evolution from traditional, deterministic automation toward more adaptive, agent-driven approaches, while sharing… Read More: AI-Driven SOC Series Overview »

Intro and Initial Deployment of a Foundry Agent

Introduction This series started with a simple question: what does an agentic SOC actually look like in practice? Early on, I focused on making that idea tangible. Instead of staying theoretical, I built out a working approach using Azure AI Foundry and Azure Logic Apps. The goal was not to prescribe a single “right” architecture,… Read More: Intro and Initial Deployment of a Foundry Agent »

Sentinel TVM Snapshot Data Connector

This started as a straightforward idea. I wanted to get Defender Threat and Vulnerability Management (TVM) data into Microsoft Sentinel for long-term retention and dashboarding. The data potentially has value, and Sentinel is designed to ingest large volumes of security data, so on the surface it felt like something that should already exist. After building… Read More: Sentinel TVM Snapshot Data Connector »

Deterministic vs. Agentic Incident Response

There is a subtle shift happening in how we design incident response systems. For years, most solutions followed a deterministic (explicit, rule-based, structured) model. An alert fires, a playbook runs, actions execute in a defined order, and results are returned. When something breaks, we trace the path, fix the logic, and run it again. That… Read More: Deterministic vs. Agentic Incident Response »

Building a Sentinel Cost Estimator

I have been working with Microsoft Sentinel since before it reached general availability in September 2019, supporting customers, delivering training, and developing real-world deployment guidance. Over that time, I have worked with dozens of organizations across both commercial and government environments, ranging from small universities to large global enterprises. I share that context only to… Read More: Building a Sentinel Cost Estimator »

Building a SOC AI API with Azure AI Foundry

A practical alternative and complement to Security Copilot I wrote about Alternatives to Microsoft Security Copilot last year and why many organizations are still looking for practical ways to bring AI into their SOC. That conversation has continued to come up in customer engagements. Some teams do not have access yet. Others are constrained by… Read More: Building a SOC AI API with Azure AI Foundry »