Microsoft previews automatic device isolation in Defender for Endpoint

Microsoft is previewing automatic device isolation in Defender for Endpoint, a feature that uses AI to quickly disconnect compromised devices from the network while keeping them connected to security services, helping contain attacks that move at machine speed. However, a SANS Institute research paper warns that attackers could potentially exploit this feature to disable user accounts if it is not properly configured and tuned. Security experts emphasize that autonomous AI action tools like this must be carefully configured and tested, similar to any other automation capability.