Automatic Attack Disruption with Liz Tesch

What if Microsoft Defender not only detected attackers - but also fought back? Richard talks to Liz Tesch about Microsoft Defender Automatic Attack Disruption and Predictive Shielding. Liz talks about how attacks are often detected before the payload executes, but by the time humans can respond, far more damage has been done. Automatic Attack Disruption acts immediately on detection to limit the attacker by locking accounts, restricting access on a compromised server, and more. Predictive Shielding goes a step further by limiting attackers' ability to respond to the disruption by turning off GPO changes, disabling safe mode, and otherwise interfering with the typical actions that attackers take once they know they have been detected. Add AI to the mix, and everything gets more complicated. The black hats are using AI to attack, and Microsoft Defender XDR is using it to defend - the race is on! Links Microsoft Defender XDR Automatic Attack Disruption Predictive Shielding Microsoft Sentinel Microsoft Defender for Identity Automatic Attack Disruption EBook Web Scale Graph Mining for Cyber Threat Intelligence Research Paper Local AI Agent Discovery with MDE Threat Hunting in Microsoft Sentinel Microsoft Defender for XDR Preview New Features for MDE Recorded June 29, 2026