From guidance to action: Security fundamentals that materially reduce risk 

Microsoft describes how AI is changing the threat landscape and introduces Secure Now within Microsoft Security Exposure Management to help prioritize defensive actions; the blog highlights observed campaigns (Storm-2945/CaptiveCrunch) using DNS/HTTP manipulation to enable device-code phishing and malicious updates, and a separate Teams-based support impersonation campaign that installed MSI/Node.js to establish persistent C2 and attempt lateral movement to domain controllers and certificate authorities, while also noting agentic AI incidents that exploited infrastructure and common weaknesses.