At Experts Live Denmark 2026, Raviv Tamir, Vice President and Chief Product Strategy for SIEM & XDR at Microsoft, gave a candid account of what Microsoft has learned from defending its own environment.
It wasn’t a product pitch or a roadmap update. Much of the talk dealt with lessons learned the hard way as attacks became faster and more coordinated.
The central message was simple and unsettling: if attackers have a better map of your organization than you do, you’re already losing.
The old playbook is dead
Picture a typical Tuesday in a security operations center. An alert fires. An analyst investigates, confirms attacker presence, and begins containment. Historically, this was the turning point. Once discovered, attackers would retreat, hide, or abandon the operation altogether.
That assumption is now dangerously outdated.
In recent major incidents, including attacks against Microsoft’s own environment, something new happened. The attackers knew they had been detected. They understood what the defenders knew. And they continued the attack anyway.
Detection alone is no longer a deterrent. The attacker on the other end of that keyboard may adapt or accelerate when your SIEM fires. AI-assisted reconnaissance and automation can compress parts of an operation that used to take days into hours.
In some cases, attackers appeared to have a more complete understanding of Microsoft’s own environment than the internal defenders did.
The story of a million shadow tenants
During an investigation, Microsoft discovered that an attacker had found an over-privileged application sitting in a satellite tenant, created years earlier for demos or testing, long forgotten by the teams that built it. The attacker identified it, compromised it, and leveraged its permissions to pivot straight into the core environment.
Tamir said Microsoft’s follow-up investigation found more than one million shadow tenants, many without full security coverage. That number comes from the keynote rather than a public dataset, but the underlying problem will be familiar to anyone who has inherited a large Azure estate.
Each forgotten tenant can contain an identity, application or trust relationship that the central security team never put under management.
Two painful truths emerged:
- The edges of your environment are often where you’re most exposed. The demo environment someone created three years ago may be easier to exploit than the flagship production tenant.
- You can’t defend what you can’t see. Most large organizations have more blind spots than their central inventory suggests.
Attackers think in graphs. Defenders think in lists.
This insight, originally articulated by John Lambert, sits at the heart of Microsoft’s evolving defense strategy, and it’s one I keep coming back to in my own work with organizations.
Attackers don’t care about your domain boundaries, your tooling decisions, or your org chart. They care about paths: how to traverse from one asset to another until they reach their target. They see your environment as a connected graph of relationships, permissions, and trust chains.
Defenders, meanwhile, have traditionally worked with lists. Lists of vulnerabilities. Lists of alerts. Lists of patches. Lists of users.
That mismatch creates a dangerous asymmetry. The attacker sees a web of interconnected paths. The defender sees a spreadsheet.
- Vulnerabilities
- Alerts
- Patches
- Users
The answer is a graph-based model of your organization:
- Assets become nodes
- Relationships become edges
- Attack paths become visible
The graph has to be operational rather than something pinned to a whiteboard. It should change prioritisation and response.
Stop boiling the ocean
Trying to secure everything equally is impossible. Every organization knows this, yet most still spread their resources thin across an ever-expanding attack surface. The graph enables a fundamental shift in thinking.
Instead of asking “How do we fix every vulnerability?” the question becomes: “What are our critical assets, and how can attackers reach them?”
Tamir put critical assets at roughly 1% of total assets in the environments Microsoft studied. Treat that as a keynote estimate, not a universal constant. The practical point holds: the attack paths leading to those assets are a smaller and more manageable subset of all possible vulnerabilities. Breaking one path may require removing or controlling only one edge.
One misconfigured permission. One excessive privilege. One unnecessary trust relationship. Remove it, and an entire attack path collapses.
That reframing turns an overwhelming, never-ending problem into a solvable one.
When minutes decide everything
During an active attack, an adversary can move laterally and escalate privileges while the SOC is still assembling the incident picture.
In one example from the keynote, Microsoft’s automated systems executed hundreds of defensive actions within 50 minutes. Those actions included isolating compromised accounts, revoking tokens and blocking lateral movement.
No human SOC, no matter how talented or how caffeinated, can operate at that pace.
This has led to what Raviv described as a “fire first, ask questions later” model:
- High-confidence threats trigger immediate automated response
- Humans investigate once the attack is paused
- The system continues reacting as the attacker pivots
Tamir said this mode is enabled by default for supported ransomware and hands-on-keyboard scenarios. The operating assumption is that a high-confidence automated response in seconds can be safer than waiting for a perfect human decision while the attack continues.
Predictive shielding
With a graph model in place, defenders can move beyond reaction into prediction.
Instead of blindly isolating everything when an attack is detected, the system can ask contextual questions: What is this asset? What role does it play? How aggressive can we be without breaking the business?
Defensive actions become surgical:
- Temporarily tightening policies on exposed assets
- Blocking specific lateral movement connections
- Selectively isolating downstream resources that sit in the likely attack path
The goal is precision containment. Think of the difference between flooding an entire building and using targeted suppression to protect its critical rooms.
The AI paradox in the SOC
AI is reshaping the SOC, but not in the way most vendor marketing suggests. Raviv described three emerging patterns:
- Augmenting humans: AI as copilot, accelerating investigation and triage
- Delegating tasks: autonomous agents handling routine response
- Agents as team members: AI embedded into workflows as persistent participants
The same economics apply on the other side. I explore how cheaper automated effort changes target selection and response in When Effort Became Free, and map the Microsoft controls for governing those agents in Outside the Model.
Tamir also raised a problem I see in practice: AI can accelerate senior analysts while misleading junior analysts who lack the experience to challenge it. Without structured learning paths, organizations risk weakening the pipeline that creates future security experts. Senior analysts get faster; junior analysts may never learn why an apparently plausible answer is wrong.
One approach shared in the keynote was transcribing analyst actions inside the SOC: capturing investigation steps, generating case notes, identifying repetitive tasks and comparing real behaviour against standard operating procedures. That gives junior analysts something concrete to study instead of only seeing the final answer.
The new blueprint
The keynote closed with a useful division of labour:
- Graphs provide the map
- AI provides the speed
- Automation provides the scale
- Humans provide the judgment
A graph without operational response is a picture. Automation without context is fast chaos. AI adds speed, but people still decide which business risks are acceptable.
A question for tomorrow morning
Right now, somewhere in your environment, there’s a forgotten service principal with excessive permissions. A shadow tenant that nobody monitors. A trust relationship that creates a direct path from your least-secured asset to your crown jewels. An attack path that an adversary could traverse in hours while your team debates the priority of a vulnerability ticket.
Do you know what your critical assets are? Do you know the paths that lead to them? And do you know which single edge, if removed, would collapse the most dangerous of those paths?
If you can’t answer those questions, the attackers already have a better map than you do.
Security teams need to see the environment the way an adversary does: as a connected graph of opportunities. Buying another tool won’t compensate for a missing map.
Start with the graph. Everything else follows.
Sources: This article is based on Raviv Tamir’s Experts Live Denmark 2026 keynote; keynote-specific figures are attributed to his presentation above. Public product detail from Microsoft Learn on automatic attack disruption and attack paths in Microsoft Security Exposure Management. The graph-versus-list framing is credited to John Lambert in the article and diagram.