Security · 23 September 2026
Microsoft Defender’s integrated security preview: what it means for your business
Microsoft is bringing security monitoring and threat protection closer together in Defender, with AI agents helping people investigate and respond. For smaller businesses, the potential benefit is a more joined-up defence, but preview status calls for careful evaluation.
What has Microsoft announced?
Microsoft has announced an integrated security operations centre, or ISOC, within Microsoft Defender. The announcement says it is available in preview, rather than presenting it as a finished service ready for every business.
A security operations centre is the function responsible for spotting, investigating and responding to cyber threats. Microsoft’s new approach combines security information and event management, known as SIEM, with threat protection. In plain English, it brings the information used to investigate suspicious activity closer to the controls used to stop it.
The aim is to let security professionals and AI agents work from the same information and use the same protective controls, rather than repeatedly switching between separate systems.
Why bring these tools together?
Microsoft argues that attackers are using AI agents to carry out attacks faster and on a larger scale. These agents are software systems that can perform tasks, rather than simply provide answers. Defenders need more than an AI assistant attached to a collection of disconnected tools.
Under the ISOC approach, information about activity, the context needed to understand it and the controls needed to respond are connected. Microsoft describes a continuous cycle in which findings from investigations feed back into stronger protection.
The company points to Defender’s attack disruption capabilities as an example: identifying an attack while it is happening, interrupting it and anticipating where the attacker might go next. The proposed benefit of ISOC is making this coordinated approach part of the platform, with less work required to assemble and maintain it separately.
Why this matters to a smaller business
For a small or medium-sized business in London or Manchester, the useful question is not whether you need your own security operations centre. It is whether whoever manages your security can understand a threat and act without unnecessary delays.
If your IT team or managed provider has to piece together alerts across different tools, an integrated approach could reduce that effort. Microsoft’s stated goal is to free security professionals from chasing individual alerts so they can spend more time deciding which risks deserve attention.
This is not a promise that AI will replace human oversight. Microsoft’s model keeps people responsible for priorities, judgement and desired outcomes, while agents handle more continuous investigative and defensive work.
What should you do next?
Ask your IT team or managed provider where security monitoring and response currently depend on manual handovers. Use those gaps to assess whether this preview could address a genuine operational problem, rather than adopting it simply because it includes AI.
If you already use Defender, ask what would be required to evaluate ISOC in your environment. The supplied announcement does not detail pricing, licence eligibility or a date for general availability, so do not assume your current subscription includes it.
Before considering a trial, agree who will supervise automated actions and how its usefulness will be assessed. Review Microsoft’s announcement recording or accompanying whitepaper with your provider, and treat the preview as something to evaluate carefully rather than an automatic reason to replace existing protection.
Need help putting this into practice?
Our London and Manchester team can review your setup and keep you secure.
Talk to Tech Engine UKBased on Microsoft's article: Reimagining the SOC for the agentic era in Microsoft Defender