Automatic Attack Disruption with Liz Tesch
Summary
Richard Campbell interviews Liz Tesh, a Microsoft cloud solution architect, about Automatic Attack Disruption and Predictive Shielding in Defender for Endpoint. They discuss how these AI-driven features automatically contain threats and block lateral movement with high certainty. The episode also covers new capabilities for securing local AI agents, enhanced Linux management, and support for legacy operating systems.
Topics discussed
Intro: Liz Tesh's new role and Microsoft Defender product landscape
Automatic Attack Disruption: Real-time containment and isolation
AI/ML certainty, threat intel integration, and on-prem support
Customer success stories and the arms race with AI attackers
Predictive Shielding: Proactive blocking of attack paths
Tuning protections, exemptions, and false positive concerns
Local AI Agent discovery and runtime protection capabilities
MDE licensing, passive mode, and antivirus vs. EDR distinctions
FY26 MDE roadmap highlights: Deployment tools and Linux features
Listen ad-free on Castria