ISOC changes where security operations can start. The useful decision is which workflows can operate in Defender and which still need workspace-backed SIEM capabilities.

Phil Kinsley
Security

Published September 28, 2026

Defender XDRSentinelSecurity operations

Read article ↗

3 MIN READ / Technical article

Anatomy of a business email compromise investigation

A phishing alert becomes a different investigation when mailbox rules, sign-in activity, and financial communications show a coordinated pattern.

Phil Kinsley
Security

Published May 8, 2026

Microsoft 365Defender for Office 365EntraIncident response

Read article ↗

2 MIN READ / Short update

Detecting what happens after initial access

Earlier this month, as part of Cybersecurity Awareness Month, I wrote about how attackers are exploiting legitimate identities, authenticated sessions, and trusted IT processes to gain access to organizations.

Phil Kinsley
Security

Published October 11, 2026

Practitioner perspectiveLinkedIn post

Read update ↗

2 MIN READ / Short update

Cybersecurity awareness beyond suspicious links

October is Cybersecurity Awareness Month, and I think one of the biggest changes in recent years is that awareness can’t just mean teaching people not to click suspicious links.

Phil Kinsley
Security

Published October 5, 2026

Practitioner perspectiveLinkedIn post

Read update ↗

2 MIN READ / Short update

The patterns behind interconnected cyber risk

Earlier today I posted about interconnected cyber risk.

Phil Kinsley
Security

Published October 2, 2026

Practitioner perspectiveLinkedIn post

Read update ↗

2 MIN READ / Short update

Interconnected cyber risk crosses organizational boundaries

Microsoft published an interesting piece this week on preparing governments for an era of interconnected cyber risk.

Phil Kinsley
Security

Published October 2, 2026

Practitioner perspectiveLinkedIn post

Read update ↗

1 MIN READ / Short update

Giving something back through technology

Something has reminded me lately that it’s important to stay humble and find ways to give something back.

Phil Kinsley
Security

Published September 27, 2026

Practitioner perspectiveLinkedIn post

Read update ↗

1 MIN READ / Short update

Identity visibility belongs in the security review

Identity is still one of the hardest attack surfaces to see clearly. Microsoft just made the Identity Security Dashboard and Coverage & Maturity generally available in Defender XDR, bringing identity risk and…

Phil Kinsley
Security

Published September 21, 2026

Practitioner perspectiveLinkedIn post

Read update ↗

1 MIN READ / Short update

Security capability needs an operating model

Something I’ve been reflecting on lately is how often Cybersecurity conversations start with technology, when the harder problem is usually what happens after the technology is in place.

Phil Kinsley
Security

Published September 18, 2026

Practitioner perspectiveLinkedIn post

Read update ↗

1 MIN READ / Short update

XDR value comes from connected investigations

Microsoft has been named a Leader in the Forrester Wave for XDR Platforms, which is worth noting.

Phil Kinsley
Security

Published June 18, 2026

Practitioner perspectiveLinkedIn post

Read update ↗

1 MIN READ / Short update

Device code phishing abuses legitimate sign-in flows

Another reminder that phishing has moved well beyond fake login pages and bad grammar.

Phil Kinsley
Security

Published June 16, 2026

Practitioner perspectiveLinkedIn post

Read update ↗

2 MIN READ / Short update

Security advice has to survive real constraints

I sometimes think the cybersecurity industry does itself a disservice.

Phil Kinsley
Security

Published June 13, 2026

Practitioner perspectiveLinkedIn post

Read update ↗

2 MIN READ / Short update

Invest in the gap between tools and outcomes

As we start the week, I have been thinking about a conversation that seems to come up more and more often across TechnologyLeadership and CyberSecurity.

Phil Kinsley
Security

Published June 7, 2026

Practitioner perspectiveLinkedIn post

Read update ↗

2 MIN READ / Short update

Technology leadership when the easy answer is unavailable

Technology leadership is tested long before the roadmap is approved or the latest innovation is announced.

Phil Kinsley
Security

Published June 5, 2026

Practitioner perspectiveLinkedIn post

Read update ↗

2 MIN READ / Short update

Build a cybersecurity-first culture

You can buy better security tools. However, you need to foster a cybersecurity first culture.

Phil Kinsley
Security

Published January 6, 2026

Practitioner perspectiveLinkedIn post

Read update ↗

1 MIN READ / Short update

A little security consulting humor

A little Friday evening humor:

Phil Kinsley
Security

Published October 17, 2025

Practitioner perspectiveLinkedIn post

Read update ↗

1 MIN READ / Short update

Windows 11 25H2: a signal to review security baselines

Windows 11 (25H2) Security Baseline: A Strategic Signal for IT Leaders

Phil Kinsley
Security

Published October 6, 2025

Practitioner perspectiveLinkedIn post

Read update ↗

1 MIN READ / Short update

Five cybersecurity priorities for executives

Cyber threats are no longer rare events, they are a constant reality for every organization. From ransomware attacks in healthcare to massive data breaches, the stakes have never been higher.

Phil Kinsley
Security

Published September 19, 2025

Practitioner perspectiveLinkedIn post

Read update ↗

1 MIN READ / Achievement

Microsoft Copilot for Security technical skills achievement

View my verified achievement from MCAPS Academy.

Phil Kinsley
Security

Published April 10, 2024

Practitioner perspectiveLinkedIn post

Read announcement ↗

1 MIN READ / Achievement

Microsoft Security Immersion completion achievement

View my verified achievement from Microsoft Security Partner Marketing Program.

Phil Kinsley
Security

Published December 1, 2023

Practitioner perspectiveLinkedIn post

Read announcement ↗

1 MIN READ / Short update

Security management for Defender for Endpoint

Exciting new Security Management capabilities for Microsoft Defender for Endpoint securitymanagement activedirectory endpointsecurity

Phil Kinsley
Security

Published December 4, 2021

Practitioner perspectiveLinkedIn post

Read update ↗

4 MIN READ / Technical article

How To Compare Overlapping Security Tools When Everyone Wants a Simple Answer

I get asked this constantly. Usually some variation of “Do we really need Proofpoint or Mimecast if we already have Defender for Office?” or [insert tool over what we have today]. The expectation is a yes or no…

Phil Kinsley
Security

Published January 16, 2026

Practitioner perspectiveLinkedIn article

Read article ↗

4 MIN READ / Technical article

Best of Breed Isn’t Always Best for the Organization

I was asked today to review the Gartner Magic Quadrant for a specific technology stack. My eyes immediately jumped to the top right corner, where everything looks orderly and decisive and the implication is clear…

Phil Kinsley
Security

Published December 30, 2025

Practitioner perspectiveLinkedIn article

Read article ↗

2 MIN READ / Technical article

Data Governance still has work to do. The Field is telling us so.

Recent conversations with customers across industries have reinforced something many of us recognize but do not always say plainly. There is still significant work to be done in the data governance space,…

Phil Kinsley
Security

Published December 15, 2025

Practitioner perspectiveLinkedIn article

Read article ↗

5 MIN READ / Technical article

Security Copilot use cases that fit the work of a security team

Start with a repeatable investigation or handoff, define the evidence an analyst needs, and measure whether Security Copilot improves the work without taking responsibility away from the team.

Phil Kinsley
Security

Published January 16, 2026

Security CopilotSOCPromptbooks

Read article ↗

6 MIN READ / Technical article

A modern security operating model for Microsoft environments

Connect identity, endpoints, cloud workloads, and data to an owned response process. The operating model should establish what is covered, who acts on the evidence, and how controls improve after an incident.

Phil Kinsley
Security

Published March 4, 2026

Defender XDRSentinelPurviewZero TrustSecurity operations

Read article ↗

8 MIN READ / Technical article

Microsoft Zero Trust Assessment: Understand Your Security Posture Before Making Changes

Use Microsoft’s Zero Trust Assessment to examine supported tenant configurations, interpret gaps, and build a remediation plan around exposure, ownership, and operational dependencies.

Phil Kinsley
Security

Published October 13, 2026

Zero TrustEntra IDIntuneDefenderPurviewSecurity Assessment

Read article ↗

7 MIN READ / Technical article

CISA SCuBA: An Independent Assessment of Your Microsoft 365 Security Configuration

Use CISA’s published baselines and ScubaGear to check Microsoft 365 configurations, distinguish failed controls from incomplete coverage, and prioritize remediation. Includes anonymized September 2026 assessment examples.

Phil Kinsley
Security

Published October 13, 2026

Microsoft 365SCuBAScubaGearEntra IDSecurity Assessment

Read article ↗

8 MIN READ / Technical article

Microsoft Zero Trust Assessment vs. CISA SCuBA: Which Should You Run?

Choose the assessment that answers your security question. Compare Microsoft’s broader configuration review with CISA’s Microsoft 365 baseline validation, and decide when a second assessment adds useful evidence.

Phil Kinsley
Security

Published October 13, 2026

Microsoft 365Zero TrustSCuBAScubaGearSecurity Assessment

Read article ↗

9 MIN READ / Technical article

You’ve Secured Your AI Agents. But Can You Trust Their MCP Servers?

MCP tool definitions and returned content can influence an agent that already has legitimate access. Review the trust boundary, cross-tool interactions, and independent authorization before expanding autonomous actions.

Phil Kinsley
AI

Published October 13, 2026

SecurityMCPAI AgentsPrompt InjectionTool Poisoning

Read article ↗