Reimagining the SOC for the agentic era in Microsoft Defender

Microsoft is announcing an Integrated Security Operations Center (ISOC) in Microsoft Defender that combines SIEM (security information and event management, which collects and analyzes security data from across a network) and threat protection into one unified system. This design addresses the challenge that cyberattackers now use AI agents to automate attacks at massive scale, requiring defenders to operate faster by eliminating delays caused by separate, disconnected security tools. ISOC enables both human security teams and AI agents to work together using shared signals, context, and controls to detect threats, predict attacks, and respond in real-time.