July 2, 2026

Microsoft Security Exposure Management with Uros Babic [MVP-MCT]

Microsoft Security Exposure Management with Uros Babic [MVP-MCT]
Microsoft Security Exposure Management with Uros Babic [MVP-MCT]
M365 FM Podcast
Microsoft Security Exposure Management with Uros Babic [MVP-MCT]

Traditional cybersecurity often focuses on vulnerability counts, alerts, and compliance dashboards. Attackers don’t. They look for weak identities, excessive permissions, exposed cloud resources, forgotten devices, and misconfigurations they can combine into a successful attack. In this episode, Mirko Peters is joined by Microsoft Security MVP and MCT Uros Babic to explore cybersecurity from an attacker’s perspective and explain how Microsoft Security Exposure Management helps organizations stay ahead of modern threats.

Rather than discussing security in theory, the conversation walks through a realistic attack chain—from reconnaissance and phishing to credential theft, privilege escalation, lateral movement, ransomware, and data exfiltration. Uros demonstrates how Microsoft Defender XDR, Microsoft Sentinel, Security Copilot, Microsoft Entra ID, and Zero Trust principles work together to detect, prevent, and disrupt attacks before they reach critical assets.

A major focus is Microsoft Security Exposure Management, which shifts security teams away from fixing thousands of isolated vulnerabilities and toward identifying the attack paths that pose the greatest business risk. The episode explains concepts such as the Exposure Graph, Attack Path Analysis, Continuous Threat Exposure Management (CTEM), Attack Surface Management, and multi-cloud visibility, helping security professionals prioritize what truly matters.

The discussion also covers AI's growing role in cybersecurity, including how Security Copilot accelerates investigations while introducing new governance challenges around AI agents. Uros emphasizes that modern SOCs should measure exposure reduction and business risk instead of alert volume, and concludes with practical advice on building resilient security operations, improving backup and recovery strategies, and developing hands-on cybersecurity skills through continuous learning and real-world practice.

Apple Podcasts podcast player icon Spotify podcast player icon Youtube Music podcast player icon Spreaker podcast player icon Podchaser podcast player icon Amazon Music podcast player icon
Season 2 Microsoft Security AI In Microsoft 365 Guest Episodes

Quick answer: Microsoft Security Exposure Management attack paths is explained in this M365 FM episode through its purpose, practical use, and the architecture, security, governance, or operational decisions teams should understand before adopting it in a Microsoft environment.

You want to keep your organization’s data safe from threats that never stop evolving. Microsoft Security Exposure Management gives you an edge by connecting identities, endpoints, cloud resources, and permissions in one unified security graph. With this approach, you see your digital attack surface as attackers do. Instead of only listing vulnerabilities, you get risks translated into clear language, so every stakeholder understands the impact. Microsoft focuses on proactive, continuous monitoring and risk-based prioritization. You can address critical exposures first and validate them, making your security strategy stronger before attackers even try to break in.

Key Takeaways

  • Microsoft Security Exposure Management provides a unified view of your security posture by connecting identities, endpoints, cloud resources, and permissions.

  • The platform focuses on real risks, not just technical vulnerabilities, helping you prioritize and address critical exposures first.

  • Continuous monitoring and dynamic risk scoring allow you to detect and respond to threats in real time, keeping your organization safe.

  • Attack path analysis shows how vulnerabilities connect, helping you block routes attackers might use to access sensitive data.

  • AI and automation streamline security workflows, enabling faster threat detection, remediation, and improved analyst efficiency.

  • The platform supports multi-cloud environments, offering visibility into assets and exposures across different cloud providers.

  • Automated reporting and compliance tools make it easier to meet regulatory requirements and generate audit-ready reports.

  • Microsoft Security Exposure Management helps reduce breach risks, improve incident response times, and strengthen overall security defenses.

Microsoft Security Exposure Management Overview

Microsoft Security Exposure Management Overview
Image Source: unsplash

What Is Security Exposure Management

You need to understand what security exposure management means for your organization. This approach goes beyond traditional vulnerability checks. It helps you identify, assess, and reduce exposures that put your data at risk. Security exposure management focuses on real risks, not just a long list of technical issues. You discover assets, assess exposures, prioritize risks, and take action to fix problems. You also validate your efforts to make sure new risks do not appear as your environment changes.

Security exposure management includes several important components that work together to improve your security posture:

  • Vulnerability Management (VRM)

  • External Attack Surface Management (EASM)

  • Cloud Security (CSPM)

  • Endpoint Security (Device Security Posture)

  • Identity Security (ISPM)

  • SaaS Security Posture (SSPM)

  • Email Security

  • OT/IOT Security

  • Asset & Configuration Management

  • Secure Score

You focus on exploitable risks, reduce noise from low-impact findings, and improve your decisions about what to fix first. This process also helps you communicate security risks clearly to your leadership team.

Microsoft’s Proactive Security Philosophy

Microsoft believes you should always stay ahead of attackers. The proactive security philosophy means you do not wait for threats to strike. Instead, you use continuous threat exposure management to monitor your entire digital attack surface. You assess exposures all the time, not just during scheduled checks. This approach leads to faster detection and response.

When you use Microsoft Security Exposure Management, you can see real improvements in your security posture. For example, organizations have seen an 80% reduction in incident response effort, a 50% faster mean time to acknowledge threats, and a 67% faster mean time to resolve issues. Over three years, this can save you millions of dollars and boost your team’s productivity.

You also help your analysts work better. A unified system reduces frustration and lets even junior team members become effective quickly. You do not need extra setup to access the tools you need.

Unified Security Graph

A unified security graph gives you a clear view of your entire environment. This graph maps cloud assets, identities, permissions, and network interactions. You can uncover attack paths, misconfigurations, and security risks that other tools might miss. Unlike traditional tools that only look at logs, the security graph models relationships in real time.

The graph updates as users, workloads, and cloud services interact. This means you always see the latest security posture across identities, endpoints, cloud resources, and permissions. You can detect and respond to risks quickly, keeping your organization safe. With Microsoft Security Exposure Management, you gain a relationship-driven view that makes it easier to protect your data and improve your overall security posture.

Core Features of Security Exposure Management

Attack Path Analysis

Mapping Potential Attack Routes

You need to understand how attackers might reach your most sensitive data. Attack path analysis in microsoft security exposure management helps you see the same routes that cybercriminals would use. The platform maps connections between identities, endpoints, cloud resources, and permissions. This mapping gives you visibility into the entire attack surface, showing you where vulnerabilities exist and how they could be chained together. You can spot weak points before attackers do.

Attack path analysis does not just list vulnerabilities. It shows you how those vulnerabilities connect and what paths an attacker could take. This approach helps you focus on exposures that matter most. You can see which systems, users, or applications are at risk and take action to block those routes.

Prioritizing Critical Assets

Not all assets are equal. Some systems hold critical business data or control important processes. Attack path analysis lets you identify these critical assets and see which ones face the highest risk. You can prioritize your efforts to protect what matters most.

You use enhanced vulnerability prioritization to focus on exposures that could lead to real damage. The platform highlights critical vulnerabilities and exposures that attackers are most likely to exploit. This targeted approach helps you reduce noise and concentrate on the most important threats. Your security posture improves because you address the most critical risks first.

Attack Surface Management

Multi-Cloud Visibility

Attack surface management gives you a clear view of your organization's digital footprint, even as it spreads across multiple cloud environments. You need to know where your assets live and how they connect. Attack surface management tools continuously monitor external assets, providing ongoing visibility into the external attack surface. This complements vulnerability management, which focuses on internal systems.

  • Attack surface monitoring involves identifying and tracking internet-reachable assets in cloud-native environments.

  • You gain visibility into rapidly changing endpoints, identities, and services.

  • The system validates exploitability using non-intrusive checks, confirming real risks without disrupting production.

  • Exposed assets are mapped to their owners using cloud resource tags, configuration management databases, and version control metadata.

As organizations adopt cloud services, containers, and distributed applications, the attack surface becomes more dynamic and complex. Cloud-native application protection platforms provide continuous visibility into exposures such as insecure configurations, excessive permissions, exposed services, vulnerable workloads, and compliance violations.

With attack surface management, you see how your environment changes in real time. You can quickly spot new vulnerabilities and exposures as they appear. This proactive approach helps you stay ahead of cybersecurity threats.

Identifying Misconfigurations

Misconfigurations are a common cause of security incidents. Attack surface management helps you find these issues before attackers do. The platform scans your cloud resources, endpoints, and applications for settings that could expose your organization to risk.

You receive alerts about critical misconfigurations, such as open storage buckets, weak access controls, or excessive permissions. External attack surface management tools highlight these problems, so you can fix them quickly. This reduces your exposure to cybersecurity threats and strengthens your overall security posture.

Attack surface management also supports external attack surface management by monitoring assets that are visible to the internet. You can identify vulnerabilities that attackers might exploit from outside your network. This layered approach ensures you cover both internal and external risks.

AI and Automation

Microsoft Security Copilot Integration

AI and automation play a key role in microsoft security exposure management. Microsoft Security Copilot integrates directly into your security workflows. This tool helps you analyze large amounts of data quickly. You spend less time searching for information and more time investigating real threats.

  • Adam Keown, Chief Information Security Officer at Eastman, says, "The ability to leverage Security Copilot helps analysts to focus more on investigations and less on sifting through data."

  • Mario Ferket, CISO at Dow, notes that Security Copilot boosts automation and helps analysts learn advanced threat hunting skills.

  • Emily Longman, SOC Manager at OSU, shares that Security Copilot supports junior analysts, making them more effective.

You benefit from centralized security data and full attack-path context. AI agents automate repetitive tasks, so your team can focus on critical exposures and threats.

Automated Insights and Response

Automation increases your efficiency and helps you respond to threats faster. Microsoft security exposure management uses AI to anticipate attack paths and apply adaptive policies. You can orchestrate workflows at machine speed, reducing your exposure to vulnerabilities.

  • Centralize security data in a cloud-native data lake for better context.

  • Use intelligence and automation to predict and block attack paths.

  • Empower your security operations center with embedded AI agents.

Automated insights highlight critical vulnerabilities and exposures. You receive recommendations for remediation, so you can act quickly. This approach supports continuous improvement of your security posture and helps you stay ahead of cybersecurity threats.

With these core features, you identify, prioritize, and mitigate exposures before attackers can exploit them. AI and automation enhance analyst efficiency, making your security management program stronger and more proactive.

Real-Time Risk Assessment

Continuous Monitoring

You need to know what is happening in your environment at all times. Continuous monitoring gives you this power. With microsoft security exposure management, you can track changes across your identities, endpoints, and cloud resources every moment of the day. This approach helps you spot new risks as soon as they appear.

Microsoft uses advanced tools to collect and analyze data in real time. You see alerts for suspicious activity right away. You do not have to wait for a scheduled scan or a manual review. This means you can act quickly and protect your data before attackers have a chance to move.

Continuous monitoring enables you to adjust your risk evaluations based on new information. You stay ahead of evolving threats and keep your security posture strong.

Here are some ways continuous monitoring helps you:

  • You detect new vulnerabilities as soon as they surface.

  • You receive instant alerts for risky changes in your environment.

  • You can respond to threats before they cause harm.

  • You always have an up-to-date view of your security status.

Dynamic Risk Scoring

Not all risks are equal. Dynamic risk scoring helps you decide which threats need your attention first. Microsoft uses smart algorithms to score risks based on how likely they are to be exploited and how much damage they could cause.

This system updates scores as new information comes in. For example, if a new zero-day vulnerability appears in popular software, dynamic risk scoring triggers an immediate evaluation. You can then take action right away.

Here is how dynamic risk scoring works in practice:

  1. A new vulnerability is discovered in widely used software.

  2. The system evaluates the risk and updates the score.

  3. You receive a high-priority alert.

  4. You can quickly apply security measures to reduce the risk.

Dynamic risk scoring helps you focus on what matters most. You do not waste time on low-impact issues. Instead, you protect your most important assets and keep your organization safe.

With real-time risk assessment, you gain a proactive edge. You can identify, prioritize, and mitigate threats faster than ever before. Microsoft gives you the tools to build a strong and resilient security program.

How Microsoft Security Exposure Management Works

Microsoft security exposure management gives you a clear, step-by-step process to protect your organization. You move from identifying exposures to prioritizing risks and then taking action. This approach helps you shift from reactive to proactive security.

Exposure Identification

Data Collection and Analysis

You start by reviewing your security posture. The platform collects data from endpoints, identities, and cloud workloads. It looks for misconfigurations, unpatched vulnerabilities, and other exposure risks. Here is how the process works:

  1. Conduct an initial security posture review using attack surface insights.

  2. Identify misconfigurations, unpatched vulnerabilities, and exposure risks across your environment.

  3. Receive a breakdown of risk scores and see which gaps need immediate attention.

  4. Prioritize and address gaps based on your business needs.

This method ensures you do not miss any critical exposures. You get a complete view of your security posture.

Threat Intelligence

Microsoft integrates threat intelligence into exposure management. This helps you spot emerging risks and adjust your defenses. The platform combines threat intelligence, contextual scoring, and data sensitivity to highlight urgent risks. You can unmask adversaries and neutralize modern cyberthreats with Defender Threat Intelligence. This intelligence lets you adjust your security defenses before threats become incidents.

Evidence

Description

Threat Intelligence Integration

Microsoft’s integrated security tools combine threat intelligence, contextual scoring, and data sensitivity to elevate the most urgent risks.

Adversary Unmasking

Unmask adversaries and neutralize modern cyberthreats with Exposure Management and Defender Threat Intelligence.

Proactive Defense Adjustment

This intelligence allows security teams to proactively adjust security defenses based on emerging cyber threats.

Risk Prioritization

Business Impact Assessment

You need to know which exposures matter most. A business impact assessment helps you do this. It evaluates how disruptions could affect your critical business functions. You identify essential processes and estimate the consequences of downtime. This information shapes your risk scoring and helps you focus on exposures that could cause financial, operational, or reputational harm.

  • Evaluate the impact of disruptions on key business functions.

  • Identify essential processes and estimate downtime consequences.

  • Use this information to inform risk scoring and mitigation strategies.

Risk Scoring

Microsoft uses several criteria to score risks. This helps you decide what to fix first.

Criteria

Description

Asset Criticality

Importance of the asset to the organization.

Exposure Severity

The potential impact of the exposure if exploited.

Threat Intelligence

Information about current threats that may affect the organization.

Exploit Availability

The likelihood that an exploit is available for the exposure.

The attack paths feature helps you focus on the most significant routes to critical assets. You can use filters to find and address the highest risks.

Mitigation and Remediation

Automated and Manual Actions

You can use both automated and manual actions to reduce risks. Some common methods include:

  • Access control measures like multi-factor authentication and role-based access control.

  • Network segmentation to limit the spread of attacks.

  • Firewalls and intrusion prevention systems to block malicious traffic.

  • Application whitelisting to allow only approved software.

  • Encryption for sensitive data.

  • Regular security assessments, including vulnerability scans and penetration testing.

  • Incident response planning to prepare for threats.

Risk remediation is a continuous process. You identify vulnerabilities, assess and prioritize them, and develop a plan to address them.

Continuous Improvement

You need to keep improving your security posture. Continuous feedback and open communication help your team see where you stand. Security ratings give you a baseline to measure progress. Over time, small improvements make your security processes stronger and more effective.

  • Encourage feedback and communication for better visibility.

  • Use security ratings to track strengths and weaknesses.

  • Make incremental improvements for long-term effectiveness.

With microsoft security exposure management, you build a proactive, resilient security program that adapts to new threats and keeps your organization safe.

Benefits for Organizations

Enhanced Data Security

You want to keep your sensitive information safe from unauthorized access. Microsoft security exposure management gives you strong tools to protect your data. You use encryption and access controls to make sure only the right people can see important files. These measures help you keep your data confidential and maintain its integrity. When you follow these steps, you lower the chance of a data breach and build trust with your customers.

  • Encryption and access controls protect sensitive information from unauthorized access.

  • These tools help you keep your data safe and prevent breaches.

  • Meeting regulatory standards builds trust and credibility for your organization.

You also benefit from a clear view of your security posture. You can see where your exposures are and take action before attackers find them. This approach helps you stay ahead in the world of cybersecurity.

Reduced Breach Risk

Reducing the risk of a breach is a top priority for every organization. Microsoft security exposure management helps you focus on the most critical exposures. You use real-time data and threat intelligence to spot risks early. This lets you act fast and stop threats before they cause harm.

Here are some ways organizations have seen real improvements:

Benefit

Measurement

Reduction in false urgency

84% reduction in false urgency after re-prioritizing vulnerabilities.

Focus on critical vulnerabilities

Only 10% of initially classified high or critical vulnerabilities remained after validation.

Efficiency in remediation

Significant reduction in vulnerability backlog and mean time to remediate (MTTR).

You see fewer false alarms and can focus on exposures that matter most. Security teams report fewer breaches and lower costs after using microsoft security exposure management. You also improve your decision-making by connecting data from different sources. This leads to faster responses and a stronger security posture.

  • Organizations report lower costs and less impact from breaches.

  • Teams use better data to respond quickly to threats.

  • Enhanced threat-hunting helps you find and stop attacks early.

  • Your overall security posture becomes stronger, leading to fewer breaches.

Simplified Compliance

You need to meet strict rules and regulations in your industry. Microsoft security exposure management makes compliance easier by giving you the tools to track and report on your security posture. You use automation and clear reporting to show that you follow important standards.

Regulatory Alignment

You align your security program with major frameworks like ISO 27001 and NIST. Automated monitoring and strong access controls help you meet these requirements. Regular audits let you find and fix compliance gaps quickly.

  • Automation and visibility support compliance with key frameworks.

  • Regular audits help you address gaps in dynamic environments.

  • Access controls limit who can see sensitive data.

Audit-Ready Reporting

You need to prove your compliance during audits. Microsoft gives you automated reporting tools that make this process simple. You can show auditors exactly how you manage exposures and protect critical assets.

  • Automated monitoring and reporting make audits easier.

  • You gain clear visibility into your security systems.

  • Audit-ready reports help you demonstrate compliance at any time.

With these benefits, you build a strong security posture, reduce risk, and keep your organization ready for any challenge.

Improved Incident Response

When you face a security incident, every second counts. Microsoft Security Exposure Management helps you respond faster and more effectively. You gain tools that let you detect threats quickly and recover with less effort. This approach keeps your organization resilient and ready for any challenge.

Faster Detection

You need to spot threats as soon as they appear. With continuous monitoring, you receive alerts in real time. This means you can act before attackers cause damage. Microsoft Security Exposure Management uses advanced analytics to scan your environment for suspicious activity. You see changes in endpoints, identities, and cloud resources right away.

You benefit from a system that reduces the time it takes to notice and respond to incidents. Here are some improvements organizations have seen:

  • Mean time to acknowledge (MTTA) dropped from 30 minutes to just 15 minutes.

  • Mean time to resolve (MTTR) went from up to 3 hours to less than 1 hour.

  • Teams reported an 80% reduction in incident response effort.

These results show that you can detect and address threats much faster. You do not waste time sorting through false alarms. Instead, you focus on real risks and take action quickly.

Quick detection helps you limit the impact of security incidents. You protect your data and keep your business running smoothly.

Streamlined Recovery

After you detect a threat, you need to recover fast. Microsoft Security Exposure Management gives you clear guidance for each step. Automated workflows help you contain threats and restore normal operations. You can follow recommended actions to isolate affected systems, remove malicious files, and close security gaps.

You also gain access to detailed reports that show what happened during an incident. These reports help you learn from each event and improve your security processes. You can share findings with your team and update your response plans.

  • Automated playbooks guide you through recovery steps.

  • Centralized dashboards show you the status of each incident.

  • You track progress and confirm that all issues are resolved.

By streamlining recovery, you reduce downtime and minimize business disruption. You build confidence in your security program and show your stakeholders that you can handle any incident.

With Microsoft Security Exposure Management, you improve both detection and recovery. You respond to threats faster, recover with less effort, and strengthen your overall security posture.

Real-World Use Cases

Real-World Use Cases
Image Source: unsplash

Financial Data Protection

You handle sensitive financial data every day. Protecting this information is critical for your organization’s reputation and trust. With Microsoft Security Exposure Management, you can spot risks before they become threats. The platform connects your identities, endpoints, and cloud resources, giving you a complete view of your security posture. You see where attackers might try to access your financial records or payment systems.

You use attack path analysis to find weak spots in your network. This helps you block routes that cybercriminals might use to reach your most valuable data. Real-time risk assessment lets you respond quickly to new threats. You can also automate many security tasks, which saves time and reduces human error. By focusing on the most important exposures, you keep your financial data safe and meet industry regulations.

Healthcare Security

You face unique challenges if you work in healthcare. Patient records, medical devices, and hospital systems all need strong protection. Many small or rural hospitals have limited budgets, which makes it hard to invest in advanced cybersecurity tools. Microsoft Security Exposure Management helps you overcome these challenges with a mix of proactive and reactive measures.

  • The platform addresses scenarios like ransomware attacks and cloud misconfigurations.

  • You get tools that help you identify risks and build a sustainable security program.

  • Even with limited resources, you can stay ahead of evolving cyberthreats.

You monitor your environment for suspicious activity and receive alerts when something unusual happens. This helps you act fast and protect patient data. You also use automated reports to show compliance with healthcare regulations. By using these tools, you improve your security posture and keep your organization safe from attacks.

Intellectual Property Defense

You need to protect your intellectual property, such as designs, research, and trade secrets. Microsoft Security Exposure Management gives you advanced tools to secure this information. You can use Microsoft Purview Information Protection to discover, classify, and label sensitive files. This makes it easier to control who can access important documents.

You protect files from applications like design software by applying labels for suppliers. You make sure all file-sharing points are secure. You register external users in your identity management system, so only trusted partners can access your data. You also limit access for trade-restricted individuals to avoid compliance issues.

Govern 365 works with Microsoft Purview to manage your supply chain and protect content. You get features like dynamic watermarking, visibility, and auditing. You can even create Virtual Data Rooms for secure collaboration. These tools help you defend your intellectual property without slowing down your business.

When you use these security solutions, you keep your most valuable ideas safe and support innovation in your organization.

Remote Work Security

Remote work has changed how you protect your organization. You now face new challenges as employees connect from many locations and devices. You need to make sure only trusted users and devices can access your data. Security becomes even more important when your team works outside the office.

You can use several strategies to keep your remote workforce safe. Start with identity verification. This step checks that each person is who they say they are before they sign in. You also use multifactor authentication (MFA). MFA asks for more than just a password. It might send a code to your phone or require a fingerprint. This makes it much harder for attackers to break in.

You should set up Conditional Access policies. These rules decide who can access your systems and when. For example, you can block sign-ins from risky locations or require extra checks for sensitive data. Device compliance checks help you make sure every laptop, tablet, or phone meets your security standards. If a device does not pass, it cannot connect to your network.

Microsoft Entra ID helps you enforce sign-in risk checks, multifactor authentication, and Conditional Access policies. You can trust that only approved users and devices get access. Microsoft Intune lets you manage and secure endpoints from the cloud. You can control both personal and work devices. This tool helps you protect work data, even if someone uses their own phone or laptop.

You also need to protect your communication tools. Microsoft Teams supports real-time chats and meetings. It uses encryption, multifactor authentication, and compliance controls to keep conversations private. You can share files and hold meetings without worrying about leaks.

Here are some best practices for remote work security:

  • Use identity verification for every user.

  • Apply least privilege access. Give users only the permissions they need.

  • Monitor your environment all the time. Watch for strange activity.

  • Update devices and apps often to fix security gaps.

  • Train your team to spot phishing and other threats.

Tip: Regular training helps your team stay alert. Remind everyone to report anything suspicious right away.

You can build a strong cybersecurity program for remote work. By using these tools and strategies, you keep your data safe and your team productive—no matter where they work.

Microsoft Security Exposure Management Implementation

Prerequisites and Requirements

Before you start with exposure management, you need to make sure your environment meets a few important requirements. The following table outlines what you should have in place:

Requirement

Description

Critical Asset Management

Learn about critical asset management in exposure management.

Required Permissions

Review required permissions for working with critical assets.

Microsoft Defender Version

Endpoints must run version 10.3740.XXXX or later of the Microsoft Defender for Endpoint agent.

Licensing

Ensure you have appropriate licensing: MSEM features are available with Microsoft 365 E5, certain E3 with add-ons, or Defender suite licenses.

Permissions

Verify you have the required permissions: A dedicated Exposure Management role provides granular access, or you can use traditional roles like Security Admin or Global Admin.

You should check these requirements before you begin. This helps you avoid delays and ensures a smooth setup for your security program.

Getting Started with the Dashboard

Once you meet the requirements, you can access the exposure management dashboard. The dashboard gives you a central place to view your security posture. You see real-time data about exposures, critical assets, and risk levels. The dashboard helps you:

  • Monitor your environment for new exposures.

  • Track the status of remediation efforts.

  • Review alerts and recommendations for action.

You can customize the dashboard to focus on the areas that matter most to your organization. Use filters to highlight high-risk assets or specific types of exposure. The dashboard also lets you assign tasks to team members and monitor progress.

Tip: Start by reviewing the summary view. This gives you a quick snapshot of your current security status and helps you decide where to focus first.

Best Practices for Security Exposure Management

Ongoing Training

You should invest in regular training for your team. Security threats change quickly, so your staff needs up-to-date knowledge. Training helps everyone understand how to use exposure management tools and respond to new risks. You can:

  • Hold workshops to review new features and updates.

  • Encourage team members to share lessons learned from recent incidents.

  • Use online courses and certifications to build skills.

Continuous Program Improvement

You need to keep improving your security program. Follow these steps to make your exposure management stronger over time:

  1. Continuously monitor your environment to catch new exposures promptly.

  2. Focus on critical assets and high-risk areas first.

  3. Integrate security tasks into normal IT operations.

  4. Leverage automation to reduce manual effort in security management.

  5. Educate and involve your team in the exposure management program.

You should also build a framework for collaboration among security teams and business units. Set clear risk tolerance levels and define which assets need assessment. Use assessment tools for vulnerability scanning and prioritize exposures based on risk and business impact.

Note: Regular reviews and feedback sessions help you adapt your program to new threats and keep your organization secure.

By following these steps, you create a strong foundation for exposure management. You help your team stay ready for any challenge and protect your organization’s most valuable assets.

You gain a unified view of your organization’s security posture with microsoft security exposure management. The platform tracks exposure metrics, offers recommendations, and helps you monitor trends over time. You can identify attack surfaces, set target scores, and quickly assess similar assets. To build future-ready protection, discover and assess assets, prioritize gaps using threat intelligence, and remediate risks. Microsoft empowers you to reduce security risks and strengthen your defenses for tomorrow’s challenges.

FAQ

What is Microsoft Security Exposure Management?

You use Microsoft Security Exposure Management to find, prioritize, and fix security risks across your digital environment. The platform connects identities, endpoints, cloud resources, and permissions to give you a unified view of your security posture.

How does this solution help prevent cyberattacks?

You see your environment as attackers do. The platform maps attack paths and highlights critical exposures. You can act before threats reach your sensitive data.

Can I use Microsoft Security Exposure Management with multi-cloud environments?

Yes, you can. The platform supports multi-cloud visibility. You monitor assets and exposures across different cloud providers from a single dashboard.

What role does AI play in exposure management?

AI helps you analyze large amounts of security data. You receive automated insights, recommendations, and faster threat detection. This makes your response more efficient.

How do I get started with Microsoft Security Exposure Management?

You start by meeting the prerequisites, such as proper licensing and permissions. Then, you access the dashboard, review your security posture, and follow the guided setup.

Does this solution help with compliance requirements?

Yes, it does. You use automated monitoring and reporting tools to align with major frameworks. You can generate audit-ready reports to show compliance at any time.

🎧 Listen to this episode

Want a practical explanation of Microsoft Security Exposure Management? This episode breaks down the topic in clear language and shows why it matters for Microsoft 365, Azure, Power Platform, security, AI, and modern work.

Listen to this episode if you want to:

  • Understand the key concepts behind Microsoft Security Exposure Management
  • See how it fits into the wider Microsoft technology ecosystem
  • Learn where it can create practical value for your organization

You may also enjoy these related M365 FM episodes:

Discover more practical Microsoft conversations on M365 FM.

Last reviewed: July 2026.

Who Should Listen

This episode is for Microsoft practitioners, architects, developers, security professionals, and IT leaders evaluating the topic in a real-world environment.

🎧 You Should Also Listen To

🚀 Want to be part of m365.fm?

Then stop just listening… and start showing up.

👉 Connect with me on LinkedIn and let’s make something happen:

  • 🎙️ Be a podcast guest and share your story
  • 🎧 Host your own episode (yes, seriously)
  • 💡 Pitch topics the community actually wants to hear
  • 🌍 Build your personal brand in the Microsoft 365 space

This isn’t just a podcast — it’s a platform for people who take action.

🔥 Most people wait. The best ones don’t.

👉 Connect with me on LinkedIn and send me a message:
"I want in"

Let’s build something awesome 👊

1
00:00:00,000 --> 00:00:08,640
Yeah, welcome back to another edition of the MC65FM podcast where we bring you conversations

2
00:00:08,640 --> 00:00:13,960
with MbP's, engineers, architects and community leaders shaping the future of Microsoft

3
00:00:13,960 --> 00:00:14,960
technology.

4
00:00:14,960 --> 00:00:17,720
Today, episodes, it's a little bit different.

5
00:00:17,720 --> 00:00:19,960
Usually, we interview expert today.

6
00:00:19,960 --> 00:00:26,560
I'm going to be the attacker by going to simple break into URO's Microsoft environment,

7
00:00:26,560 --> 00:00:31,520
gather intelligence, deal credentials, move through the network, reach the growing

8
00:00:31,520 --> 00:00:35,440
uwits and hopefully not get catched.

9
00:00:35,440 --> 00:00:41,200
Yeah, thank you today's guest is a Microsoft leading security expert, URO's Babich, is

10
00:00:41,200 --> 00:00:47,000
a Microsoft security MbP, Microsoft certified trainer and lead product engineer for Microsoft

11
00:00:47,000 --> 00:00:52,560
security, deaf ops and a software-1 global center of excellence.

12
00:00:52,560 --> 00:01:00,000
We design enterprise SOC solutions using Microsoft Defender, Microsoft Sentinel security co-pilot,

13
00:01:00,000 --> 00:01:02,520
automation, Microsoft security, expose management.

14
00:01:02,520 --> 00:01:08,760
So today, if we can stop, if he can swap me with me, I succeed.

15
00:01:08,760 --> 00:01:10,400
URO's, are you ready?

16
00:01:10,400 --> 00:01:12,520
Yeah, thank you, Mirko.

17
00:01:12,520 --> 00:01:19,480
Thank you for joining me on this session and looking forward to discuss a very important topic.

18
00:01:19,480 --> 00:01:28,760
Because today, I want you to forget how usually look like in our security because your

19
00:01:28,760 --> 00:01:35,800
inertia attacker don't see our environment the way you do.

20
00:01:35,800 --> 00:01:43,480
They don't see dashboard, severity, no, 100 open ticket.

21
00:01:43,480 --> 00:01:46,200
They see opportunity.

22
00:01:46,200 --> 00:01:50,480
And that is very important, that is very challenge.

23
00:01:50,480 --> 00:01:53,640
They see some pet, interesting pet.

24
00:01:53,640 --> 00:01:59,440
And they see the fastest way to something very valuable.

25
00:01:59,440 --> 00:02:10,280
And actually, the problem is for many organizations are still fixing vulnerability in isolation,

26
00:02:10,280 --> 00:02:15,360
while attacker actually try to change them together.

27
00:02:15,360 --> 00:02:24,600
And in this our co-versation, in this session, it is very important to going to think like

28
00:02:24,600 --> 00:02:31,560
what you mentioned, like attacker, and understand not just what is vulnerable, but what is

29
00:02:31,560 --> 00:02:37,680
actually exposed, publicly exposed.

30
00:02:37,680 --> 00:02:43,880
And that is exactly where Microsoft security has for sure management help us.

31
00:02:43,880 --> 00:02:56,680
And that is actually game changer because it is help to identify, to prioritize, to the

32
00:02:56,680 --> 00:03:00,280
break attack pet that's really major.

33
00:03:00,280 --> 00:03:03,640
And that is the future for our modern stock.

34
00:03:03,640 --> 00:03:13,840
I love to say the future of a Celtic stock because we are the most AI now.

35
00:03:13,840 --> 00:03:18,440
But it's a center question how we protect our agent.

36
00:03:18,440 --> 00:03:26,880
And I love to say also what is the subject of elevation and etc.

37
00:03:26,880 --> 00:03:34,800
That is interesting when many organizations like I don't know before 15 days we have a

38
00:03:34,800 --> 00:03:45,800
situation with some agent is Dini, some sub-engine is not properly secure security

39
00:03:45,800 --> 00:03:50,560
configure and by security policy.

40
00:03:50,560 --> 00:04:01,000
And we must prioritize because, a entropic disable for example, FABL and METUS, it is great

41
00:04:01,000 --> 00:04:10,120
example why we rely on external agent tools without governance is actually risky.

42
00:04:10,120 --> 00:04:19,440
And if my employee, your employee are using our many AI tools for example, your data is

43
00:04:19,440 --> 00:04:26,680
effectively subject of some policy outside of your organization include the regulatory

44
00:04:26,680 --> 00:04:29,200
decision you don't control.

45
00:04:29,200 --> 00:04:34,160
And that is also the challenge and that is also the risk.

46
00:04:34,160 --> 00:04:43,040
In this central I love to amface something very important what we discuss under the beginning

47
00:04:43,040 --> 00:04:45,480
of our our conversation.

48
00:04:45,480 --> 00:04:54,960
We are facing with the challenge main cyber attack but into the cloud.

49
00:04:54,960 --> 00:05:05,560
The first actually your mansion is some kind of uncontrolled misconfiguration exploit.

50
00:05:05,560 --> 00:05:12,960
An attacker take advantage of fully configured cloud service.

51
00:05:12,960 --> 00:05:22,640
What is publicly accessible like storage bucket like overage permission identity access

52
00:05:22,640 --> 00:05:30,040
manager role to gay are authorized are says to our sensitive data.

53
00:05:30,040 --> 00:05:36,840
The great example is credential that great example is account compromise because we are

54
00:05:36,840 --> 00:05:43,240
facing with a lot of fishing brute force attack.

55
00:05:43,240 --> 00:05:50,400
Credential staffing are used to hear cloud account after leaving to a lot many lots of

56
00:05:50,400 --> 00:05:57,600
movement without cloud environment without any control user nomination early face for

57
00:05:57,600 --> 00:06:05,960
attack and the challenges how we can stop in the fast way.

58
00:06:05,960 --> 00:06:18,320
How we using to our tools in better efficient way because modern us were complying now include

59
00:06:18,320 --> 00:06:24,080
many many other challenge and clip cloud data.

60
00:06:24,080 --> 00:06:29,920
Pression with the third party clients partners for us to take with combination with data

61
00:06:29,920 --> 00:06:34,320
solution the next step is privilege installation.

62
00:06:34,320 --> 00:06:42,920
With data solution that is the great the margin but for a large input for many organization

63
00:06:42,920 --> 00:06:57,400
and for the money also for the reputation and actually we are facing also what is I so

64
00:06:57,400 --> 00:07:03,880
big challenge is the cloud base of the supply chain is also targeting but attacker compromise

65
00:07:03,880 --> 00:07:11,520
widely using some library or services to affect multiple organization and what a mission

66
00:07:11,520 --> 00:07:19,360
AI AI with the machine learning with the system exploit with the poison threatening data

67
00:07:19,360 --> 00:07:21,520
with the steel model.

68
00:07:21,520 --> 00:07:29,200
I wait with many other challenge to use AI to generate the commencing fishing or some

69
00:07:29,200 --> 00:07:40,520
defake context and because cloud environments with the malware design it is a great example

70
00:07:40,520 --> 00:07:52,800
for Kubernetes for docker a container security under eyes often stealing some API key talk

71
00:07:52,800 --> 00:08:03,200
and secret and that is that is very usual that is very common attack perspective weak

72
00:08:03,200 --> 00:08:11,320
misconfiguration access control can lead for example to unauthorized access for many Azure

73
00:08:11,320 --> 00:08:20,440
as to simply in stroke past or policy and MFA I love to say past or less without any

74
00:08:20,440 --> 00:08:28,520
password using strong multifacare authentication with the fish persians mechanism it is it is

75
00:08:28,520 --> 00:08:39,520
a good start so I think before I take your organization I start with social engineering

76
00:08:39,520 --> 00:08:49,240
so yeah it was can you tell us a little bit about yourself and and how your journey begins

77
00:08:49,240 --> 00:08:52,320
into cyber security.

78
00:08:52,320 --> 00:09:04,520
I am actually more than 20 years in cyber security start for my own premise I was actually system

79
00:09:04,520 --> 00:09:13,760
admin in Windows server environment and work with with a lot of on premise and who the

80
00:09:13,760 --> 00:09:24,240
two and lead to writing I remember 2016 and 2017 is migration actually from standard on

81
00:09:24,240 --> 00:09:38,760
premise and from on premise bare metal to cloud and actually my work is because the client

82
00:09:38,760 --> 00:09:48,560
often work in hybrid environment and move from the know but we also working for how environment

83
00:09:48,560 --> 00:09:57,080
but that is actually how I shift my knowledge my experience step by step in these 20 years

84
00:09:57,080 --> 00:10:06,160
and of course everything is changed shift and thinking and attack perspective and previous

85
00:10:06,160 --> 00:10:16,000
could be have other focus now we have more sophisticated focus how we can use the modern

86
00:10:16,000 --> 00:10:24,960
modern tool because you know we are facing with a lot of duct tape that data what means without

87
00:10:24,960 --> 00:10:33,360
any control in the cloud and the first question is before you define what is your sensitivity

88
00:10:33,360 --> 00:10:39,360
data do you know what is your sensitivity data how you protect your sensitive data in the

89
00:10:39,360 --> 00:10:47,160
cloud do you know how it looks like your data flow do you know what is managed and how

90
00:10:47,160 --> 00:10:54,400
you can manage your device or your device is under your control that is the first steps

91
00:10:54,400 --> 00:11:04,800
and yes very good exposure management give you a lot of opportunity but but in me must

92
00:11:04,800 --> 00:11:15,120
thinking very predicate and actually the great way is actually Microsoft security exposure

93
00:11:15,120 --> 00:11:22,080
management about why you love to discuss today how is shifting security from a reactive perspective

94
00:11:22,080 --> 00:11:33,040
to actually from reactive incident response to pro active risk reduction that is my focus

95
00:11:33,040 --> 00:11:46,640
and I love to continuously more the last five years to map my attack surface management

96
00:11:46,640 --> 00:12:01,280
and actually identify exposure across identity across endpoints across cloud across application

97
00:12:01,280 --> 00:12:13,360
and how I can prioritize my work and what is actually metric in that way that is crucial and

98
00:12:13,360 --> 00:12:24,320
that is that is a very good approach how we can do in our daily operation because also I love

99
00:12:24,320 --> 00:12:37,200
to mention I worked in day to day operation with the SOC team 24 hours critical asset critical resource

100
00:12:37,200 --> 00:12:48,320
incident other thing and what is the core message how we as for sure is not equal vulnerability we

101
00:12:48,320 --> 00:12:55,360
have vulnerability we have individual issue with common vulnerability as for score be the

102
00:12:55,360 --> 00:13:03,840
lot of misconfiguration what I mentioned before but exposure is actually how attacker actually

103
00:13:03,840 --> 00:13:14,720
chain goes issue together the key the key idea it is not about the fixing everything it is about fixing

104
00:13:14,720 --> 00:13:24,080
what attacker really exploit the first and that is that is a tricky and why that is why I love to

105
00:13:24,080 --> 00:13:34,480
am phasing I know no attack surface management the first thing I was thinking how discover attacker

106
00:13:34,480 --> 00:13:45,280
try to discover my asset from no from unknown and I have external option I have internal option

107
00:13:45,280 --> 00:13:53,280
that is also the case when you're conducting some internal or external pen test activity but

108
00:13:53,280 --> 00:14:02,720
exposure graph is very good option how you can identify security dependency method how show

109
00:14:02,720 --> 00:14:15,200
your weakness actually connecting into many attack path and the next step is how we can prioritize

110
00:14:15,200 --> 00:14:29,040
real risk and allow to make a question many time myself what is the fact aspect to domain admin

111
00:14:29,040 --> 00:14:42,400
or global admin for my critical assets and that is also attacker perspective show me I don't know show

112
00:14:42,400 --> 00:14:52,800
me top exposure affecting tier zero assets how I can help my analyst to reason faster and this is

113
00:14:52,800 --> 00:15:01,920
very important topic very important to point when we starting to work with this shift how

114
00:15:01,920 --> 00:15:09,360
well after say we have all so security operation center alert driven now manage sock modern sock

115
00:15:09,360 --> 00:15:20,320
thinking line attacker risk driven after attack no it is important proactive approach before attack

116
00:15:20,320 --> 00:15:35,280
and noise on overload how we can prioritize exposure management I love to to give you some real

117
00:15:35,280 --> 00:15:46,960
reward feeling how we work how we project our initiative with some practical scenario imagine some

118
00:15:46,960 --> 00:15:57,120
misconfiguration service account combined with device vulnerability and excessive permission

119
00:15:58,400 --> 00:16:07,360
individual that is not aren't critical but together they create path to domain admin

120
00:16:07,360 --> 00:16:17,600
extreme show management will be fine and purify that change that is good and this is actually answer

121
00:16:17,600 --> 00:16:29,840
how I shift myself from seco to DevOps for many automation in in the last in the last five years that is

122
00:16:29,840 --> 00:16:36,160
that is answer for a wish okay so I'm the checker so I try to bring you a little bit out of the concept

123
00:16:36,160 --> 00:16:44,720
so if you had an animal what name will you give him a name yeah

124
00:16:45,840 --> 00:16:55,600
with animal layer or something like that okay then I google now your your your birthday and I copy paste

125
00:16:55,600 --> 00:17:02,960
your email address from link that now I am in your your channel yeah yeah yeah yeah yeah correct

126
00:17:02,960 --> 00:17:10,800
very good yeah yeah let us a little bit short talk about the topic inside of risk

127
00:17:13,600 --> 00:17:21,040
what did you think how how big is this part actually of further the new checks the AI

128
00:17:21,040 --> 00:17:31,520
yes that is that is a good question the central question I actually have a lot of discussion

129
00:17:31,520 --> 00:17:42,960
about this topic the last one month we have a lot of AI agents now in two direction the first is

130
00:17:43,920 --> 00:17:52,880
a agent in security copilot for AI with some conditional access optimization agent to

131
00:17:52,880 --> 00:17:59,280
reveal your depping conditional access policy very good for security baseline in Microsoft

132
00:17:59,280 --> 00:18:07,840
365 tenant show some security analyst is very interesting now you you have direct chat now

133
00:18:08,560 --> 00:18:17,920
with two security consul should unit to replace your for example to be good thank your security analyst

134
00:18:17,920 --> 00:18:26,240
not replace really because we must get you an interaction but for your vulnerability management for

135
00:18:26,240 --> 00:18:33,200
your security score for your custom very language or a lot of questions with primary

136
00:18:33,200 --> 00:18:42,480
discoloration a lot of questions from for for a later a moment pet that is very interesting point and

137
00:18:42,480 --> 00:18:51,520
the the central question yes is elevation privilege this agent I have a lot of discussion

138
00:18:51,520 --> 00:18:59,360
and explain a lot of during the session but I love to have phasing something

139
00:19:02,880 --> 00:19:13,120
why AI agent should be threat as the first class identity how we can simulate data leakage scenario

140
00:19:13,120 --> 00:19:22,560
for many company and that in entry protection how to enforce conditional access policy how to

141
00:19:22,560 --> 00:19:33,200
respond to agent incident from isolate anomaly because the central question is elevation

142
00:19:33,200 --> 00:19:45,040
but when use the many new interact with copilot agent on custom AI workflow the agent doesn't

143
00:19:46,000 --> 00:19:57,200
just answer question it act it call Microsoft graph it reads from share point but it query exchange

144
00:19:57,200 --> 00:20:05,920
it doesn't all the using delegate of application permission that we granted integration time

145
00:20:05,920 --> 00:20:13,040
and we forget that and we we we are facing with a lot of elevation of permission

146
00:20:13,840 --> 00:20:21,040
and the behavior is actually makes AI agent functionality equivalent to some

147
00:20:21,040 --> 00:20:30,640
I know well service principle manage identity in terms of access scope and this is exactly why

148
00:20:30,640 --> 00:20:39,200
Microsoft enter now that again the identity and the first class subject in identity plan

149
00:20:39,200 --> 00:20:47,120
all of us use the device and work load the center question is how we to protect to our sensitive

150
00:20:47,120 --> 00:20:55,360
information go outside when we have interaction of scope i vote great example is maybe data security

151
00:20:55,360 --> 00:21:02,720
poster management for AI on Microsoft review you can use in deal peak policy in combination the

152
00:21:02,720 --> 00:21:13,760
protection and detect some your sensitive data when you have but security joy journey is actually

153
00:21:13,760 --> 00:21:22,480
provide some very good framework in my opinion what we first identify with AI agent in

154
00:21:22,480 --> 00:21:30,480
Microsoft entry agent agent preview protect with hondesh initial access policy detect with identity

155
00:21:30,480 --> 00:21:38,080
protection in enter ID and security copilot respond with defender

156
00:21:38,080 --> 00:21:43,200
automatic access block and session termination using some

157
00:21:43,200 --> 00:21:51,280
conditional access or defender is the air capability and finally don't forget optimization

158
00:21:52,480 --> 00:22:02,640
continuous policy analysis get identification with and this is actually the six act and

159
00:22:02,640 --> 00:22:12,320
how we understand you are using very useful you often interacting with the pilot agent customer agent

160
00:22:12,320 --> 00:22:21,280
with share point online with the exchange line micro graph API and we have access the data access

161
00:22:21,280 --> 00:22:31,040
we have sensitive content access accessing file and folders critical outside and that is realistic data

162
00:22:31,040 --> 00:22:39,760
leakage scenario. Miscofegration agent without any control orchestration layer it will be

163
00:22:39,760 --> 00:22:48,240
challenged in the next period of time we can use many protection mechanism but the central question

164
00:22:48,240 --> 00:22:59,600
how we use sound automation response to block to terminate tool login in scope for our automatic

165
00:22:59,600 --> 00:23:14,160
blocking via some policy when we have risk agent in in in in Fox and you can use many many very

166
00:23:14,160 --> 00:23:25,280
good good tool like defender for how depths like micro solution in many many additional

167
00:23:25,280 --> 00:23:34,240
capability in that way. Yeah, Microsoft have a topic I think in years they say zero trust zero

168
00:23:34,240 --> 00:23:42,880
trust zero trust for devices zero trust for users zero trust for applications how have zero trust

169
00:23:42,880 --> 00:23:53,120
change in the age of AI. Yes, very good question and we have a lot of

170
00:23:53,120 --> 00:24:01,200
opportunity in that way. Yes, your mission very

171
00:24:01,200 --> 00:24:10,720
actually we can use some blend expert for management with the zero trust

172
00:24:11,840 --> 00:24:21,040
mindset instead to move step by step to change identity and point mis-confiduration permission

173
00:24:21,040 --> 00:24:32,560
into the path because for attacker perspective attacker don't care about your security model

174
00:24:32,560 --> 00:24:41,360
that is very interesting and they don't respect boundary they don't respect your your zero trust

175
00:24:41,360 --> 00:24:50,240
and they definitely don't follow your priority list because zero trust reduce trust but for

176
00:24:50,240 --> 00:24:59,200
example in combination in expert management we can it can be show you where you still exposed

177
00:24:59,200 --> 00:25:08,320
if so if nothing is trusted it is real question becomes what is still exploitable and connect zero

178
00:25:08,320 --> 00:25:19,600
trust with special management that is maturity angel and position you in in that way but zero trust

179
00:25:19,600 --> 00:25:27,280
in combination for for AI it will be it will be challenged

180
00:25:31,520 --> 00:25:43,040
surely with the identity AI when we when we have when we have the real scenario we when we have

181
00:25:43,040 --> 00:25:50,880
because because the trust is in age of again TKI

182
00:25:51,600 --> 00:25:58,640
a retinking security special for a for my opinion and the fixing special not just all it

183
00:25:58,640 --> 00:26:08,720
we are using angelic AI and especially the driven security in combination for our future

184
00:26:08,720 --> 00:26:18,480
modern stock and zero trust in in in conclusion is not enough you must use many other

185
00:26:19,280 --> 00:26:26,960
solution like special management but you implement zero trust model now with the AI but why

186
00:26:26,960 --> 00:26:36,880
is still exposed that is that is again TKI plus zero trust why attacker still actually win

187
00:26:36,880 --> 00:26:50,240
a how to stop in in in in in the either part and the I love to explore and thinking shift our focus

188
00:26:50,240 --> 00:26:57,440
how combines zero trust with micro security special management and again TKI all of us to

189
00:26:57,440 --> 00:27:06,480
finally shift from reacting to others to proactively breaking attacker pets for example before they

190
00:27:06,480 --> 00:27:14,080
ever use that is the modern stock and just zero trust limit access as per show management show where

191
00:27:14,080 --> 00:27:22,800
the attacker still win and that is a good approach for agent TKI agent TKI doesn't just detect threats

192
00:27:22,800 --> 00:27:32,720
they understand them it will be challenged and very good question so the question is no longer

193
00:27:33,760 --> 00:27:44,320
do we trust this it's can attacker still get true and it is it is the right approach

194
00:27:44,320 --> 00:27:53,360
breadball narrative into our our focus in the next period of time and thank you for this

195
00:27:53,360 --> 00:28:01,360
special um microsoft had had a lot of security tools I say Microsoft peer view your data security

196
00:28:01,360 --> 00:28:09,280
Microsoft in tune for device management Microsoft enter for identity Microsoft sent in it for

197
00:28:09,280 --> 00:28:18,400
yeah collecting detecting threats then they have uh not known I have forgotten for what was it

198
00:28:18,400 --> 00:28:28,320
and and and they have a defend or a lot of defenders but you're a specialist in Microsoft

199
00:28:28,320 --> 00:28:36,400
security expelers management is there's a true or what is it is a framework yeah that is that is

200
00:28:36,400 --> 00:28:46,640
good question uh how we can start with with special management uh that is combination your answer is

201
00:28:46,640 --> 00:28:58,000
combination uh this is I love to say more security solution provide for you unify view security

202
00:28:58,000 --> 00:29:05,120
posture across many organizations have all called the endpoint cloudless for I don't know my

203
00:29:05,120 --> 00:29:12,480
cellar that surface and security as for show management give you all asset information

204
00:29:12,480 --> 00:29:21,040
with security context and help you here to be proactive manage at a surface pro protect critical

205
00:29:21,040 --> 00:29:32,240
assets and explore and mitigate some special risk in digital state but actually now standard

206
00:29:32,240 --> 00:29:39,760
integration is with the defender for cloud because defender for cloud now is moving for a

207
00:29:39,760 --> 00:29:50,640
easier portal to defender portal uh not only for uh ager it is now be talking about multi-tenth

208
00:29:50,640 --> 00:29:58,480
and multi management across ager a a a a a a a a a a a a a a a a a a a a w s and gcp we are

209
00:29:58,480 --> 00:30:06,880
defend for cloud integration alongside traditional on premise single uh this unify approach graph

210
00:30:07,600 --> 00:30:14,240
expo show graph give you for example i don't know device your identity or cloud assets

211
00:30:14,240 --> 00:30:21,840
external atox surface management along with the gardener continuous threat expo show management

212
00:30:21,840 --> 00:30:30,880
in general to your answer is both this is some kind of framework but also provide for many many

213
00:30:30,880 --> 00:30:42,640
great opportunity great security tool uh and you can uh actually uh who is use this for example

214
00:30:42,640 --> 00:30:51,600
for my perspective security compliance having to improve your organization security post security

215
00:30:51,600 --> 00:31:02,080
operation guys uh need to visibility into data into your flow a workflow across uh many organization

216
00:31:02,080 --> 00:31:09,040
in order to detect in order to investigate in order to mitigate security threats the third category

217
00:31:09,040 --> 00:31:14,800
what you mentioned at the beginning of our organization very important topic is security

218
00:31:14,800 --> 00:31:22,800
architect architect is responsible to solving some issue in order of security poster management

219
00:31:22,800 --> 00:31:30,000
and our spisto i don't know chief security information officer uh with some decision makers

220
00:31:30,000 --> 00:31:36,480
who need inside into organization atox surface management they should manage being in order to

221
00:31:36,480 --> 00:31:43,920
address better understand security risk in organization the uh what is uh very important for our

222
00:31:43,920 --> 00:31:51,680
discussion to understand now vulnerability management is moving from traditional environment

223
00:31:51,680 --> 00:32:01,680
and point environment to uh expo show management and actually this is easy answer combination

224
00:32:01,680 --> 00:32:10,000
vulnerability with the risk management it is a great uh great and what can i do with this

225
00:32:10,000 --> 00:32:19,200
i can use unify view across many organizations with my asset ten points cloud environment

226
00:32:19,200 --> 00:32:27,040
external atox surface management managing investigation atox surface in order to visualize something

227
00:32:27,040 --> 00:32:36,800
i don't know uh analyze this manager uh and the other surface spending on premise and hybrid environments

228
00:32:36,800 --> 00:32:45,520
that is also very very important topic to to understand and i can discover i can say regard my critical

229
00:32:45,520 --> 00:32:53,040
asset i can manage the exposure tool to manage security exposure and mitigate many exposure risk

230
00:32:53,040 --> 00:33:03,760
and i can finally manage and investigate atox surface management with graph schema with a lot of

231
00:33:03,760 --> 00:33:12,320
another and the last topic what is important here for our discussion what you mentioned with the

232
00:33:12,320 --> 00:33:24,800
Sentinel but uh yes Sentinel is a cloud native security management system uh to connect uh many

233
00:33:24,800 --> 00:33:34,000
data sources but here we can uh with security as such management we can connect our data connector

234
00:33:34,720 --> 00:33:44,240
to integrate with the different security solution uh uh and data sources including external vendor

235
00:33:44,240 --> 00:33:55,680
rapid seven i will know cloud many other platform tenable callies uh uh a service now into single

236
00:33:55,680 --> 00:34:02,720
unify view uh esposh management graph and that is good that is fine and finally you can

237
00:34:02,720 --> 00:34:09,600
i will give you a deeper insight into security push for integrity data for various environment and

238
00:34:09,600 --> 00:34:17,440
external sources uh four years uh i think companies often think oh we have all these tools we pay

239
00:34:17,440 --> 00:34:24,080
Microsoft on the security and um yeah Microsoft they know and know and uh a lot of companies start

240
00:34:24,080 --> 00:34:32,160
to build their cyber security teams or have a partner for this topic but now it's

241
00:34:33,040 --> 00:34:39,280
i think a really new product it's the Microsoft security co-pilot uh and i think uh i got the

242
00:34:39,280 --> 00:34:49,920
sheep son of security expert and i paid in 60 uh european hour uh and now i can can get it four for six

243
00:34:49,920 --> 00:34:58,160
yes that is the interesting you know uh we are in areas security co-pilot and

244
00:34:58,800 --> 00:35:10,480
agente kai and actually uh you can use security co-pilot with uh as a core feature in your security

245
00:35:10,480 --> 00:35:21,600
quest for use some interesting use case uh many interesting for example you know i give you some

246
00:35:21,600 --> 00:35:31,440
great example wise from my perspective uh needed uh incident summarization it is better for you

247
00:35:31,440 --> 00:35:39,280
for your security alert to consist on actual online better connecting with your vulnerability uh

248
00:35:39,280 --> 00:35:46,960
basis uh data basis impact analysis ask the potential impact of security incidents

249
00:35:47,600 --> 00:35:53,920
at enable quicker response time uh reverse engineering you can put all your malicious

250
00:35:53,920 --> 00:36:02,000
scripts in security co-pilot to analyze this complex line script and translate into natural

251
00:36:02,000 --> 00:36:10,400
language with clear explanation uh of action without move to any digital forensic station you can

252
00:36:10,400 --> 00:36:17,600
use primarily binary first respondent forensic uh with security co-pilot and why the response

253
00:36:17,600 --> 00:36:25,600
step by step willens for incident response for example uh how you can automatically lock your account

254
00:36:25,600 --> 00:36:33,120
how you can automatically disable your account is your account for rest of the network uh the next steps

255
00:36:33,120 --> 00:36:41,040
for your recommendation for better uh security score everything including in right direction for

256
00:36:41,040 --> 00:36:49,040
triage for investigation for containment incident for a mediation critical part of your security

257
00:36:49,040 --> 00:37:00,560
management and this is very good uh and after that you have many uh agente kai with security co-pilot

258
00:37:02,160 --> 00:37:08,960
you can use uh 30-tellage's briefing agent to automatically create relevant and timely

259
00:37:08,960 --> 00:37:16,800
intelligence report you can use uh conditional access optimization to for your uh uh get

260
00:37:16,800 --> 00:37:26,720
insecurity policy uh uh fix for identity teams fishing three agent vulnerability remediation agent

261
00:37:26,720 --> 00:37:35,040
aint not all co-pilot in uh in preview in entra lot of lot of other challenge but that is that is

262
00:37:35,040 --> 00:37:44,080
good that is uh and yes provision capacity is uh very important to uh to know how you set your

263
00:37:44,080 --> 00:37:51,680
de-40 level and how to assign long permission how to use them with provision co-pilot capacity

264
00:37:52,560 --> 00:38:01,040
and the work with cost optimization phenopes it is great opportunity today uh especially for many

265
00:38:01,040 --> 00:38:13,920
security admin or security analysts in the cloud yeah um thank you this was really good good answer

266
00:38:13,920 --> 00:38:22,240
and let's a little bit talk about or uh or i have a question uh how is uh exposure different from

267
00:38:22,240 --> 00:38:32,640
uh value and urelities it's damn too old yeah that is very good question how is different uh you know

268
00:38:33,440 --> 00:38:42,480
our security esp- uh esp- uh esp- uh management offer uh that is important in the in-naster

269
00:38:42,480 --> 00:38:50,480
attacker can't destroy it to gain access to your data or how the rest of us and uh uh when you have

270
00:38:50,480 --> 00:39:00,080
insecure security api and point and growing necessity and microstracoolize that and uh give last

271
00:39:00,080 --> 00:39:09,280
very good program initiative for endpoint uh with good target score with uh cloud with your identity

272
00:39:09,280 --> 00:39:20,640
with your application uh and uh you have very top initiative here for uh found the re-beshma control

273
00:39:20,640 --> 00:39:26,240
zeal transfer nation this is male compromise is uh your mention

274
00:39:27,040 --> 00:39:36,000
very important topic busy small compromise is not for example classical fishing that is uh uh

275
00:39:36,000 --> 00:39:43,280
in in combination socio-engineering with many the middle attack and many other uh

276
00:39:43,280 --> 00:39:53,440
been in general it must be more and more proactive with critical asset protection to improve our

277
00:39:53,440 --> 00:40:01,840
scoring vulnerability management to uh to understand the score of history uh to devices

278
00:40:01,840 --> 00:40:11,120
special management distribution everything is related and uh uh when we know better our

279
00:40:11,120 --> 00:40:19,680
at the surface metric at the pet uh critical asset summary uh it will be definitely with this

280
00:40:19,680 --> 00:40:26,880
proactive approach uh uh uh i mentioned uh some critical pillar

281
00:40:26,880 --> 00:40:33,600
ranceover human operation ranceover is a challenge in in the last two two two years with the

282
00:40:33,600 --> 00:40:45,520
data filtration with this busy small compromise and we must shift uh uh you know uh it is very easy

283
00:40:45,520 --> 00:40:53,520
ask for your question lack of visibility lack of control uh not knowing where data is stored

284
00:40:53,520 --> 00:41:02,480
and who can uh he who has access uh two and can be risky but i can implement comprehensive

285
00:41:02,480 --> 00:41:11,200
monitoring and access management social care and hands visibility in this control and that is

286
00:41:11,200 --> 00:41:19,280
that is in in the summary there i approach uh how we can protect and how we actually shifting our

287
00:41:19,280 --> 00:41:27,520
thinking and the great question is how we can thinking like like that okay hope

288
00:41:27,520 --> 00:41:39,440
um there it's um i think our uh metra corp i think they have these um yeah and you see for e list uh

289
00:41:39,440 --> 00:41:50,720
that you think uh it's enough to handle cyber security um or have we have it there also a change

290
00:41:50,720 --> 00:41:58,800
yes very good approach we can map everything with uh my to protect framework

291
00:41:58,800 --> 00:42:07,520
we can use uh a bezel tactic technique it called on normal knowledge uh

292
00:42:07,520 --> 00:42:16,480
knowledge base of real world article behavior that is uh preposition uh pre-requisite and showing

293
00:42:16,480 --> 00:42:27,680
me how to actually operate step by step uh a key idea it doesn't focus on tool on malware but

294
00:42:27,680 --> 00:42:38,320
it focused on behavior and attack pattern meter attack framework is bej basically map of how

295
00:42:38,320 --> 00:42:48,240
I talk you think how I talk you move how I achieve the their goal inside your environment and uh that

296
00:42:48,240 --> 00:42:58,800
is the reason why I using many tactic uh in issuos kredeshwaks water movement as a iteration what

297
00:42:58,800 --> 00:43:06,400
is the attack try to achieve that is the the the the the first question and after that how

298
00:43:06,400 --> 00:43:16,720
I can use some technique like fishing pass the hash golden ticket stair skeleton key uh

299
00:43:16,720 --> 00:43:24,800
exploit vulnerability partial execution how would they achieve that and finally with a lot of

300
00:43:24,800 --> 00:43:34,800
sub technique in more detail uh with uh I don't know what a moment like SMV protocol

301
00:43:34,800 --> 00:43:44,240
RDP protocol a siltration with data transfer uh uh it shows how attacker progress across stage

302
00:43:44,240 --> 00:43:54,880
and I'm using in my approach attack attack uh a few metrics this is a very good approach and uh

303
00:43:54,880 --> 00:44:06,640
we have uh most important tactic uh I don't know our first is uh attacker getter info with

304
00:44:06,640 --> 00:44:16,560
reconnaissance uh execution initial access persistence and finally with privileges uh uh uh

305
00:44:16,560 --> 00:44:22,880
escalation for dash elaxes a lot of movement with the spread uh communication external with the

306
00:44:22,880 --> 00:44:30,080
command and control c2 server malissio server uh we have input we have damage we have ransom but

307
00:44:30,080 --> 00:44:41,040
and I love to conduct many red blue simulation uh maybe the wood uh uh to discuss for our another session

308
00:44:41,040 --> 00:44:49,680
some vocabulary detection engineering something like that to to for our resilience

309
00:44:49,680 --> 00:44:58,000
map sent in a rule with attack technique can't base behavior with the alerts uh attack show

310
00:44:58,000 --> 00:45:06,960
how attack will happen and finally if special management show you where they we will succeed

311
00:45:06,960 --> 00:45:16,400
and that is actually uh uh attacker don't think you know it they think in technique and might

312
00:45:16,400 --> 00:45:27,120
detect uh in in the conclusion it's very good blueprint of attack behavior yeah um uh I think a lot

313
00:45:27,120 --> 00:45:32,800
of executives are when they visit the cyber security team they they look at the dashboards and all

314
00:45:32,800 --> 00:45:41,440
this 80% and it's green and uh for the most are uh yeah is it uh then it's secure because it's green

315
00:45:42,240 --> 00:45:52,880
yeah um but how can an executive understand security posture without really called technical reports

316
00:45:52,880 --> 00:46:09,120
yes that is that is also uh you can control uh security score it is also important part what we

317
00:46:09,120 --> 00:46:19,600
don't mention uh with a single view of your data you're at the point with identity with data with

318
00:46:19,600 --> 00:46:32,880
application and to reveal yet uh and some identity some device some follow up location data

319
00:46:32,880 --> 00:46:42,880
cloud infrastructure um this type of consolidation enable a better proactive approach in risk management

320
00:46:42,880 --> 00:46:55,120
and inform you about decision making uh good for audit but uh uh uh uh you can also use in the many

321
00:46:56,880 --> 00:47:03,840
recommendation from Microsoft in your pro-pro-active approach for your device for your cloud from

322
00:47:03,840 --> 00:47:12,080
software to service application I don't know uh identity data with recommendation summary uh the

323
00:47:12,080 --> 00:47:25,040
center question is uh yes uncrasted uh but uh we must align in our defender uh class device

324
00:47:25,680 --> 00:47:34,480
manage device to onboard the now device to to be to be more secure uh your device and manage

325
00:47:34,480 --> 00:47:45,120
device uh without any control it will be great example of risk uh in today in uh very very sophisticated

326
00:47:45,120 --> 00:47:58,080
attack metric and uh we're facing with serious uh advanced threat uh uh groups uh and uh actually

327
00:47:58,080 --> 00:48:07,680
the lesson of although uh attacks to in the last uh uh one year tell us we must shifting

328
00:48:08,320 --> 00:48:20,000
definitely in in this in this uh in this way which metrics really are really important or which

329
00:48:20,000 --> 00:48:35,440
metrics or KPIs watch you every day yes uh actually uh metrics with the KPI how um for example

330
00:48:36,800 --> 00:48:46,240
diagram with attack with the exposure graph with attack pet how to map sentinel detection to

331
00:48:46,240 --> 00:48:56,560
attack pets uh red-blue demo using attack chain this uh this is would uh uh exercise management

332
00:48:56,560 --> 00:49:05,360
priority is attack reveals and micro-attact show your uh how attack remove but uh it doesn't tell

333
00:49:05,360 --> 00:49:12,800
which pet is the most dangerous this is wood combination to use some KPI approach

334
00:49:12,800 --> 00:49:22,160
and uh that is where aswoshu management comes in uh uh uh attack reminds them minds that

335
00:49:22,160 --> 00:49:33,440
and tell us uh tell us uh a lot of techniques to sub technique in in in that way uh uh but uh

336
00:49:34,960 --> 00:49:44,880
in in general uh this is this is uh uh um the biggest challenging modern soc is not

337
00:49:44,880 --> 00:49:53,920
like potato it is actually measuring the wrong things that is wood KPI uh the most

338
00:49:53,920 --> 00:50:00,480
stock track problem number of fellas number of incidents main time to respond time to fall

339
00:50:00,480 --> 00:50:08,480
number of close ticket the uh those are actually metric not security outcomes and you can

340
00:50:08,480 --> 00:50:16,080
close all at all day but it it will be still exposed and really what is the KPI

341
00:50:16,080 --> 00:50:26,560
too much noises KPI reward will you not quality uh no attack or context KPI don't reflect real attack pet

342
00:50:28,480 --> 00:50:37,280
everything is green but while attacker still have a pet full sense of security uh it is

343
00:50:37,280 --> 00:50:49,440
it is a lot of but uh traditional KPI we have out of volume but now i love to to discuss with you

344
00:50:49,440 --> 00:50:56,880
about exposure reduction real goals without the attack elimination with the modern KPI

345
00:50:57,680 --> 00:51:05,040
time to remediate critical exposure that is very good uh topic this is also business-imposed

346
00:51:05,040 --> 00:51:12,080
how we can cover a gem in in to meter meter attack framework with the texture quality

347
00:51:12,080 --> 00:51:20,480
how how i can identify a risk with tier zero exposure with the most critical real layer we can

348
00:51:20,480 --> 00:51:30,320
must use and what we discussed previously in agente here era that is a change in change the game

349
00:51:30,320 --> 00:51:37,600
but not processing more art but prioritize what is actually actually reduce with the

350
00:51:37,600 --> 00:51:47,120
the exposure management that is uh stop measuring activity start measuring exposure that is the message

351
00:51:48,880 --> 00:51:56,720
yeah okay um that's interesting if while you already know where i most like to attack but uh yeah

352
00:51:56,720 --> 00:52:05,760
it's time for plan B uh let's say my fishy game i worked uh what employee clicked uh what's now

353
00:52:05,760 --> 00:52:17,520
what's happened now? Very good point what's happened to you can uh if you're correctly using

354
00:52:17,520 --> 00:52:29,840
uh uh if you're correctly using uh uh microsuit free side defender you can use uh SPF the

355
00:52:29,840 --> 00:52:42,800
Kim and DeMark policy and it will uh uh if we correctly uh uh accommodate correctly protect with

356
00:52:42,800 --> 00:52:55,120
that uh the next is uh to go your fishing in quarantine and your sympians not receive this

357
00:52:55,120 --> 00:53:08,800
is mail uh security uh policy with the SPF uh DeMark and uh the Kim uh many uh other protection

358
00:53:08,800 --> 00:53:17,520
mechanism in defender is they are give you a lot of opportunity uh to settings in microsufry

359
00:53:17,520 --> 00:53:28,720
syspy environment uh for your mail for your collaboration uh uh and you have you have a lot of uh

360
00:53:29,760 --> 00:53:40,480
for example uh security policy in uh uh uh on this uh policy recommendation you can use uh

361
00:53:40,480 --> 00:53:50,240
trade policy you can use alert policy uh uh for anti-fishing anti-spam anti-malware

362
00:53:50,240 --> 00:53:56,000
save attachment to protect your organization of the malicious wanted for mail attachment save links

363
00:53:56,640 --> 00:54:03,680
protect users from opening and sharing money issues links in mail and office apps

364
00:54:03,680 --> 00:54:12,560
that is by policy but you can use many rule uh filtering mechanism is quarantine policy apply

365
00:54:12,560 --> 00:54:22,800
custom rule for quarantine uh message by using uh uh policy or created uh with them uh yes but i

366
00:54:22,800 --> 00:54:29,280
love to add something security awareness is very important and we are facing with the

367
00:54:29,280 --> 00:54:39,520
Lotus uh social engineering techniques uh this is not only to help you to we are human and uh uh

368
00:54:39,520 --> 00:54:47,280
you know uh human is weak and sleek uh inside your security and uh the the it is always

369
00:54:47,280 --> 00:54:59,760
chilling to educate our employee uh uh you can use tool uh but uh if you don't have uh mechanism to stop

370
00:54:59,760 --> 00:55:08,000
in automatically way good example for many attacker is the automatic at a disruption of the generative AI

371
00:55:08,000 --> 00:55:16,480
without human intervention to stop partial malicious activity uh with uh

372
00:55:16,480 --> 00:55:24,960
combination fishing mail in a replace of incident without any human intervention uh in automatically

373
00:55:24,960 --> 00:55:33,040
way and that is that is a good good approach for our uh for our work and ask of your own question

374
00:55:33,040 --> 00:55:41,760
you can use combination uh uh security awareness technique uh how to protect for many social

375
00:55:41,760 --> 00:55:50,800
engineering and tools uh that is a sort of a question okay uh let's say you found me but uh

376
00:55:50,800 --> 00:55:57,520
you're assuming i only compromised one account what's next yeah it is spread

377
00:55:58,640 --> 00:56:14,640
laterally and the next is your uh your uh uh aim is to compromise um uh administrative account

378
00:56:14,640 --> 00:56:22,640
so privilege account uh that is the uh if you compromise user account and after that later

379
00:56:22,640 --> 00:56:30,400
a moment through a change i don't know with pesticide techniques uh for your active directory

380
00:56:30,400 --> 00:56:39,360
the next step is data subteration combination with the ransomware activity and that is not so easy

381
00:56:39,360 --> 00:56:47,040
now we have in our cyber kill chain a lot of different technique uh technique from attacker

382
00:56:47,040 --> 00:56:56,480
perspective not one start with some fishing uh it can be more and more with different sophisticated

383
00:56:56,480 --> 00:57:06,320
techniques yeah so so i have a um congratulations you may make it me much harder than i expect but i

384
00:57:06,320 --> 00:57:14,000
am stubborn wrong uh i still doing yeah uh look after your drone you will so i will take

385
00:57:14,880 --> 00:57:20,400
sensitive data or executive mailbox global admin or your file potential

386
00:57:20,400 --> 00:57:28,080
um yeah what should we do or what should what did you do now

387
00:57:28,080 --> 00:57:39,040
i think the shit is when the shit yeah yeah that is my the previous job i was also working as a cyber

388
00:57:39,040 --> 00:57:48,000
kind investigator and we also have the last popular reactive approach in that way yes

389
00:57:48,000 --> 00:57:58,800
and many companies uh don't have any uh of course i totally don't recommend to go with any

390
00:57:59,600 --> 00:58:09,760
negotiation and conversation with attacker it will be now you know everything is in uh virtual

391
00:58:09,760 --> 00:58:23,120
voting some for example Bitcoin it will be today one zero dot eight they will be more and more

392
00:58:23,120 --> 00:58:31,760
and yes your data is locked and you don't have any possibility but there is a problem i think the key

393
00:58:31,760 --> 00:58:44,640
yeah answer is our backup in our restore procedure well disaster recovery and that is uh i

394
00:58:44,640 --> 00:58:54,720
i i i got many many uh explanation uh well where is your backup in your computer and you can have

395
00:58:54,720 --> 00:59:02,560
any external sources for your backup and thought about you know and that is the tricky and the the main

396
00:59:02,560 --> 00:59:15,520
most valuable topic here how we using our backup and restore procedure in that case is and

397
00:59:15,520 --> 00:59:21,680
if you have a good this way i think it is the win-win situation

398
00:59:21,680 --> 00:59:27,680
yeah okay so you catch me i have give all the bam bitcoins back

399
00:59:27,680 --> 00:59:36,800
so i hope we ask some time because i yeah we are running out of time i don't know if you have a few

400
00:59:36,800 --> 00:59:45,760
minutes um i have in every round i have a fact rapid fire round i ask uh some questions and uh you

401
00:59:45,760 --> 00:59:54,640
give me a short short answer it's okay yes of course okay defender or sentinel a very good question

402
00:59:54,640 --> 01:00:01,760
but it is not easy because we all defend the experience now transition from major portal to defender

403
01:00:01,760 --> 01:00:11,280
portal and sentinel is actually the part of defender now and that is us of your question

404
01:00:12,880 --> 01:00:22,080
exposure management or valuable management uh definitely um that is a tricky question

405
01:00:22,080 --> 01:00:32,160
i like i like to say both in combination with with it is not easy proactive approach

406
01:00:32,160 --> 01:00:39,200
risk but valuable management is very very important topic and to using both in in my approach

407
01:00:40,480 --> 01:00:52,320
okay um bicep or terraform uh that is of course if i using only agent i can use bicep if i

408
01:00:52,320 --> 01:01:03,040
using terraform for multi-cloud environment for AWS a gtp of course terraform is multi-cloud option

409
01:01:03,040 --> 01:01:12,960
then then bicep and the piece i'm not or ignored oh of course by default is um every p but

410
01:01:12,960 --> 01:01:23,120
i definitely wish to be speaker on this year in some fascisco or microsoft ignited it is where

411
01:01:23,120 --> 01:01:31,120
you reveal many innovation features and start discussions about many many positive thinking and

412
01:01:31,840 --> 01:01:40,400
yes it it is by default any piece i'm it i love i'm a piece i'm it because it it is i love deep

413
01:01:40,400 --> 01:01:48,160
technical session during the vp summit and see my colleague uh and everything but inside is

414
01:01:48,160 --> 01:01:53,680
something different something else uh very very good and i fully recommend it

415
01:01:53,680 --> 01:01:59,520
and we hope microsoft uh ampliess yearlet that who willing to be a speaker

416
01:02:00,560 --> 01:02:04,320
year for us okay um identity or endpoint

417
01:02:04,320 --> 01:02:17,840
hmm uh mirror in in era how to i i i i was working very long as identity security engineer and i know

418
01:02:17,840 --> 01:02:27,440
everything but uh very s has together everything is important uh both both right there is the

419
01:02:27,440 --> 01:02:35,840
an endpoint management is uh very very critical because uh i'm facing big lot of migration for

420
01:02:35,840 --> 01:02:46,320
s cm to microsoft today uh in for many clients and uh very very important uh topic is also

421
01:02:46,320 --> 01:02:55,600
boot identity and device management together together if you work for a very poor company

422
01:02:55,600 --> 01:02:59,600
they only will pay one security to with from microsoft which one is it

423
01:02:59,600 --> 01:03:13,920
oh you know uh that is a tricky question because uh small and many you mentor praise uh in

424
01:03:13,920 --> 01:03:23,120
bear very often our source the security engineer and uh we are facing uh it it is dependent for

425
01:03:23,920 --> 01:03:30,160
budget but definitely my recommendation is unify security operation in microsoft

426
01:03:30,160 --> 01:03:34,400
defenderies year which haka movie is the most realistic

427
01:03:34,400 --> 01:03:40,000
movie

428
01:03:40,000 --> 01:03:42,000
i really see

429
01:03:42,000 --> 01:03:47,600
movie regarding

430
01:03:51,840 --> 01:04:01,520
what we discussed today if you don't you don't have uh uh i saw something before

431
01:04:01,520 --> 01:04:11,920
uh and mention data data without any any protecting control without any don't flow without

432
01:04:12,720 --> 01:04:23,440
risk and it is expensive for us uh and after that we have uh uh data sweeteration we have data

433
01:04:23,440 --> 01:04:32,960
leakage uh outside company and compromise uh it is also not only a tech for reputation uh

434
01:04:32,960 --> 01:04:40,480
your lersha something very important but uh maybe move in in into dark web

435
01:04:42,320 --> 01:04:49,920
i like cybercrime and the public exposed something very valuable on twitter or social network in

436
01:04:49,920 --> 01:05:02,640
the setra it will be very fairly uh and uh i i saw something and that is secret what uh

437
01:05:02,640 --> 01:05:12,080
sock every sock wish to to need uh and take into account and that is the more more realistic from

438
01:05:12,080 --> 01:05:23,040
proactive to react to uh uh reactive approach i think um cyber security expert uh it's one of the

439
01:05:23,040 --> 01:05:31,920
new sexiest job in the world uh i think there are big opportunity but a lot of young

440
01:05:31,920 --> 01:05:41,600
professionals tech professionals try to start a career in cyber security what advice can you give them

441
01:05:42,080 --> 01:05:53,520
uh yes um i am a couple of decade also microso-settifree trainer and i have a lot of experience in that

442
01:05:53,520 --> 01:06:04,160
and this is also a very often question from me uh go step by step and shifting you uh from

443
01:06:04,720 --> 01:06:14,640
data the first layer physical security to early phase and spend some time two years three years as a

444
01:06:14,640 --> 01:06:22,800
networking engineer uh uh not shifting directly on security because i reveal many gaps for young

445
01:06:22,800 --> 01:06:30,720
engineering uh many many gifts in knowledge uh networking is most important i love networking

446
01:06:30,720 --> 01:06:39,040
natural protection uh for or and after that move from a classical security to application security

447
01:06:39,040 --> 01:06:49,040
layer and the setra but just don't hurry just go step by step to the uh uh with the knowledge and

448
01:06:49,040 --> 01:06:58,560
everything and this is a good approach and using uh many many great uh uh my start was with uh

449
01:06:58,560 --> 01:07:08,480
bitcantea network plus security plus now we have the icis square with security um uh uh

450
01:07:08,480 --> 01:07:14,800
certified cyber security this is also a very good approach from my icis square many good

451
01:07:14,800 --> 01:07:26,560
tutorials but work slowly uh and uh it is not accent uh certification is important but

452
01:07:27,520 --> 01:07:35,680
for my opinion practical your skills what you have in your ten fee fingers it is the most important book

453
01:07:35,680 --> 01:07:46,480
yeah i think uh some some guys think it's good to do an hack or i don't know for two months or

454
01:07:46,480 --> 01:07:53,520
several there was some some hack and the microsoft was not so happy about this guy but yeah um

455
01:07:53,520 --> 01:08:00,160
like i've heard the book heard the book and uh uh bellini i'm i'm start with the unix

456
01:08:00,160 --> 01:08:06,720
uh i'm i'm also a lino's guy not only microsoft oriented and work with different

457
01:08:06,720 --> 01:08:14,800
environment and different platform is the most easy way using uh a lot of proactive using think

458
01:08:14,800 --> 01:08:22,080
like hattaker have the books platform uh have the which uh challenge with with the work with many many

459
01:08:22,800 --> 01:08:30,240
good opportunity uh uh many online platforms provide you very good very good approach for that

460
01:08:30,240 --> 01:08:41,840
yeah so thank you we're i i i can talk with you much more more longer uh but yeah uh thank you so much

461
01:08:41,840 --> 01:08:49,360
for being here for staying longer than than planned so i hope you you don't miss anything or something

462
01:08:49,360 --> 01:08:56,720
yeah um today i tried to to think like an attacker but yeah what we conclude the modern cyber security

463
01:08:56,720 --> 01:09:03,360
is just about stopping attackers after they happened it's yeah understanding your exposure before

464
01:09:03,360 --> 01:09:11,120
a tucker do and yeah i think this was really really helpful to understand what happened especially

465
01:09:11,760 --> 01:09:21,040
with uh in the age of ai so yeah thank you for all the topics we have security exposure management

466
01:09:21,040 --> 01:09:27,760
security co-pilot defend like str identity protection ai attack pass and yeah our

467
01:09:27,760 --> 01:09:32,960
our engineers can shift for reactive security to protect defense so thank you both for being

468
01:09:32,960 --> 01:09:40,480
yeah thank you very much uh and if was really great pleasure to discuss with you this is our

469
01:09:40,480 --> 01:09:46,000
first conversation but i'm looking forward to care video more very interesting

470
01:09:46,000 --> 01:09:54,160
co-resential ideas today thank you very much and uh see you on the next challenge and have a nice

471
01:09:54,160 --> 01:09:58,640
rest of the day yeah thank you bye

Mirko Peters Profile Photo
Mirko Peters

Founder of m365.fm, m365.show and m365con.net

Mirko Peters is a Microsoft 365 expert, content creator, and founder of m365.fm, a platform dedicated to sharing practical insights on modern workplace technologies. His work focuses on Microsoft 365 governance, security, collaboration, and real-world implementation strategies.

Through his podcast and written content, Mirko provides hands-on guidance for IT professionals, architects, and business leaders navigating the complexities of Microsoft 365. He is known for translating complex topics into clear, actionable advice, often highlighting common mistakes and overlooked risks in real-world environments.

With a strong emphasis on community contribution and knowledge sharing, Mirko is actively building a platform that connects experts, shares experiences, and helps organizations get the most out of their Microsoft 365 investments.

Uros Babic Profile Photo
Uros Babic

Uroš is a Lead Product Engineer for Microsoft Security DevOps at SoftwareOne’s Global Center of Excellence. He contributes to the design and innovation of MXDR for Microsoft Sentinel and strengthens Managed SOC capabilities through security automation, incident response engineering, and SOC‑as‑code development.

With 20+ years of cybersecurity experience, he focuses on Azure‑based security architecture, CI/CD automation, and large‑scale SecOps engineering using Bicep, Terraform, and GitHub Actions. As a Microsoft Security MVP and Microsoft Certified Trainer, he actively shares knowledge through community events, conferences, and technical content, with a strong focus on Microsoft Defender, Sentinel, and AI‑driven security automation.