Insights

What the 2026 Microsoft Digital Defense Report Means for MSPs | inforcer

Graham Morrison — Thu, 29 Oct 2026 12:25:21 GMT

Summary

Microsoft's 2026 Digital Defense Report finds that AI is now directing attacks rather than assisting them, reducing attack chains from days to minutes. Password attacks fell 26% but token theft more than doubled, voice phishing over Teams rose 502%, unsanctioned RMM agents now mark most human-operated intrusions, and a 2020 CVE still leads the exploit table. For MSPs, the takeaways are that identity-only monitoring leaves tenants vulnerable, and that manual response can no longer keep pace with threats directed by AI agents.

Agentic AI vs Generative AI in Cybersecurity: What MSPs Need to Know | inforcer

Graham Morrison — Wed, 28 Oct 2026 12:07:00 GMT

Summary

Generative AI creates content when prompted. Agentic AI works towards goals it has been given: planning steps, using tools, and taking action with less human input. Businesses already use AI across daily operations, and attackers are using agents too. Documented cases show AI running most of an intrusion end to end. At that pace, the time required to contain threats is critical for controlling the outcome, so human-governed agentic AI is becoming the baseline for Microsoft 365 security.

When the backup app becomes the way in

Dan Harris — Sat, 17 Oct 2026 14:43:09 GMT

[Based on information available as of 09:30 17 October 2026.]

AI-Powered, Human Controlled: The SOC Is Evolving | inforcer TDR

Graham Morrison — Fri, 25 Sep 2026 12:12:21 GMT

Summary

Round-the-clock threat detection has traditionally required countless hours of billable engineering time or outsourced SOCs that are costly and slow to respond. inforcer TDR lets MSPs offer an alternative that leverages AI for detection, analysis and automatic containment of major threats, while humans train and validate the technology. MSPs can also push fixes to every tenant that needs them through inforcer’s 365 Manager and generate customer-facing reports, effectively creating a cost-effective alternative to SOCs.

Why We Went Right of Boom | inforcer TDR Interview

Graham Morrison — Thu, 24 Sep 2026 08:00:01 GMT

Summary

In inforcer's first Ask an Expert interview, Graham Morrison, Microsoft 365 Team Lead, explains why inforcer moved beyond prevention into threat detection and response. He covers why prevention alone left MSPs exposed, why enterprise-built, identity-only and acquired detection tools don't fit the way MSPs work, and how inforcer TDR builds on inforcer's multi-tenant management expertise to cut alert noise, close the gap between prevention and detection, and help MSPs prove their value to customers.

Multi-tenant Threat Detection for MSPs in action

Graham Morrison — Wed, 23 Sep 2026 15:57:38 GMT

Summary

inforcer TDR’s multi-tenant visibility gives MSPs a single-pane view of alert signals across every Microsoft 365 tenant they manage. These signals are correlated across identity, devices, mail, files, and data movement within each tenant, providing vital context that differentiates genuine threats from false positives produced during normal business activities and helps recognize signs of a coordinated attack that might appear to be noise when considered in isolation.

ITDR, XDR, SIEM, MDR: A Plain-English Guide to the Microsoft 365 Security Alphabet for MSPs

Graham Morrison — Mon, 07 Sep 2026 14:26:13 GMT

Summary

Security categories describe three different things at once: which surface a tool watches, who operates it, and whether it hardens configuration or detects live attacks. Separating those axes makes the overlaps obvious. EDR watches endpoints, ITDR watches identity, XDR correlates several surfaces, SIEM stores and queries everything you feed it, SOC and MDR describe who does the watching, and ISPM and ESPM harden identity and mail configuration before anything happens. Most of these categories assume a single enterprise estate, which is where multi-tenant Microsoft 365 MSPs run into trouble.

The Six Layers of TDR for Microsoft 365 (& Why ITDR Alone Isn't Enough)

Graham Morrison — Tue, 01 Sep 2026 08:00:01 GMT

Summary

Most MSPs now run some form of Identity Threat Detection and Response (ITDR), and for good reason: identity is the primary attack surface in Microsoft 365. But identity is where an attack begins, not where it ends. A single attack can move through six distinct signal layers, and ITDR only has clear visibility into one of them. Correlation across every layer, rather than more alerts from a single one, is what actually lets an MSP see and stop a breach.

How to turn Microsoft's commercial changes into an MSP security win

Roy Klooster — Fri, 28 Aug 2026 14:04:08 GMT

If you've been putting off the Business Premium conversation with your Standard customers, now is the moment to pick it back up.

How MSPs Can Turn Every Breach Into Stronger Long-Term Prevention

Graham Morrison — Fri, 28 Aug 2026 08:00:01 GMT

Summary

Detection and prevention usually live in separate tools, so catching an attack does not always produce a permanent fix. For multi-tenant MSPs, that means one misconfiguration can stay open and exploitable across the estate. inforcer TDR closes the loop by mapping each detected attack to the policy that would have stopped it, then allowing MSPs to deploy the required changes across every tenant in their estate using 365 Manager. This turns each incident into lasting prevention.