Volume 343, Issue 2 · 9 articles from 2 issues
Microsoft urges organizations to inventory certificate dependencies and test post-quantum authentication now.
Microsoft notes that post-quantum cryptography planning often focuses on encrypted data, but authentication systems including certificates, trust anchors, PKI services, devices and HSMs are also affected by new algorithms and larger certificate chains.
Its PQC TLS Pilot Program helps eligible certificate authorities evaluate interoperability and operational readiness.
The post recommends inventorying certificate dependencies, assessing vendor roadmaps, identifying long-lived infrastructure and creating non-production test environments to expose compatibility and process gaps before post-quantum authentication is required at scale.
Microsoft advises CISOs to prepare for much larger AI-driven vulnerability volumes and record Patch Tuesday releases.
Microsoft's Office of the CISO argues that the real challenge of AI-driven vulnerability discovery is balancing patching speed with patching correctly at unprecedented scale.
Microsoft uses frontier AI models and harnesses to scan its own code, its MDASH harness is now available to customers, and customers should expect higher Patch Tuesday volumes for on-premises software after September 2026 set a record of close to 1,000 vulnerabilities.
The post recommends more resources for patching and prioritization, defense-in-depth controls and deployment of Microsoft Baseline Security Mode.
Microsoft's Azure hardware chief explains how agentic AI connects design, supply chain and fleet operations across Azure.
Rani Borkar, President of Azure Hardware Systems and Infrastructure, describes how Microsoft applies AI from systems design through supply chain, deployment and fleet operations across more than 80 Azure regions and 500 datacenter campuses.
She stresses that AI transformation starts with the work, not the technology, and under a 'Lean before AI' approach teams simplified processes and built a governed shared data foundation before adding agents.
One example is demand planning, where investigating why an infrastructure plan changed once required reconciling multiple systems.
Microsoft's FORGE Lab found Windows flaws behind 140 CVEs since May and shares three lessons on scaling AI vulnerability research.
Microsoft Security's FORGE Lab helped discover Windows vulnerabilities assigned 140 CVEs from May through September 2026, including 52 in the September security release, using the multi-model agentic scanning harness codenamed MDASH.
Members also submitted 155 validated reports across 23 open-source projects, and one Linux report became the first Akrites submission to produce a merged kernel patch.
The post outlines three shifts: from frontier capability to scale, from token consumption to reasoning economics, and from isolated discovery to coordinated validation and remediation.
Microsoft announced Project Tessera, turning Azure Integrated HSM into an open-source initiative with Marvell, Oracle and OCP.
At the OCP Global Summit, Microsoft announced Project Tessera, which evolves the Azure Integrated Hardware Security Module into a fully open-source initiative developed with Marvell, Oracle and the Open Compute Project.
Tessera opens the architecture, specifications, protocols, drivers, software, firmware and reproducible build environments of the directly attached HSM design, and over time aims for a fully open-source silicon implementation and broadly available hardware.
The approach follows Caliptra, Microsoft's widely adopted open-source silicon root of trust.
Azure Networking describes a layered model that lets an AI agent autonomously resolve production network incidents within guardrails.
An Azure Networking engineer describes an AI agent built to reconstruct production network incidents, pulling device state, reading telemetry, correlating recent changes and writing a summary before the on-call engineer logs in, though the harder problem is letting the agent apply the fix on its own.
Microsoft designed a layered model that bounds autonomous remediation with identity, authorization, tooling and human-approval controls.
The post explains why no single safeguard is enough when moving from copilot to autopilot.
Mark Russinovich and Scott Hanselman explain a Microsoft and Carnegie Mellon effort to train junior developers in the AI era.
Microsoft's Mark Russinovich and Scott Hanselman ask what a software engineer's job becomes when AI can design architecture, write code and fix problems in seconds, arguing the software developer career is here to stay and that today's junior developers will be tomorrow's senior engineers.
Microsoft and Carnegie Mellon University are collaborating on how developers learn software engineering when AI does much of the coding.
The post outlines their approach to AI-accelerated software engineering education.
An architectural analysis of Microsoft's third-generation Maia 300 accelerator, designed to scale agentic inference.
Microsoft, which runs inference for OpenAI models and its own Copilot workloads, may have the biggest inference problem in the world, the article says.
At the OCP Summit it disclosed details of its future Clea Maia 300 XPU, which adds architectural changes to run generative AI inference faster and to scale up for agentic workloads in which many models share network and memory.
The piece traces the program from the Athena Maia 100 in 2023 to the Braga Maia 200 now ramping on Azure.
It also examines Maia 300's memory bandwidth and scale-up design.
Microsoft-Decision-1 returns calibrated probabilities for routing, classification and verification, challenging TypeSafe AI's Jev.
Tom Smith reports that Microsoft released Microsoft-Decision-1 in Foundry and on OpenRouter, a decision-scoring model post-trained from Qwen3.5-9B.
It returns a calibrated probability for each of a fixed set of answers instead of free text, which suits yes/no, multiple-choice, ratings and rubric grading in agent workflows.
It costs $0.042 per million input tokens, matching TypeSafe AI's Jev, and Microsoft claims top accuracy across 36 benchmarks and 2.5 times the speed of the runner-up, noting that 100ms saved on each of 20 sequential decisions removes two seconds.
Smith advises testing calibration on your own labeled data and keeping humans in the loop for consequential calls.