When we think about an attacker gaining access to Microsoft 365, we typically imagine a compromised user account. Someone clicks a phishing link, enters their credentials into a malicious website, or unknowingly approves an authentication request. From there, the attacker […]

With Microsoft continuing to push organizations toward cloud services, particularly Microsoft 365 and SharePoint Online, an interesting question remains: Is there still a reason to deploy and maintain SharePoint Server on-premises? For some organizations, the answer is absolutely yes. For […]

As you know, I like to try to write a series of blog posts to explain more complex features or something I am working on. I recently wrote a series here about prompting for Artificial Intelligence: I am also in […]

From spending hours in libraries reading books and learning through trial and error, to watching my children teach themselves music and coding through online videos, the way we learn has changed dramatically. Now, with AI transforming how we discover, understand, […]

Artificial Intelligence is advancing at an incredible pace, but how close are we to machines that can truly think, reason, or even feel? Artificial General Intelligence (AGI) and Sentient AI are often discussed as though they are the same thing, […]

I don’t usually write much about my personal life. If you have followed my blog for any length of time, you will know that most of what I share revolves around technology, security, Microsoft, work, teaching, soccer, or whatever project […]

Microsoft’s new Integrated Security Operations Center (ISOC) in Defender signals a major shift in how security teams detect, investigate, and respond to threats. By bringing together XDR, SIEM, threat intelligence, automation, and AI-driven agents, Microsoft is moving toward an agentic […]

Throughout the previous articles, we’ve explored increasingly sophisticated ways of probing the security boundaries of a Large Language Model. Testing Instruction Hierarchy and Prompt Override Attacks Testing Role-Playing and Context Manipulation Testing Linguistic Obfuscation and Prompt Encoding We started with […]

In the previous two articles, we explored how modern Large Language Models defend themselves against direct instruction overrides and role-playing attacks. Testing Instruction Hierarchy and Prompt Override Attacks Testing Role-Playing and Context Manipulation In both cases, the underlying request remained […]

Microsoft has added another important capability to Windows Autopilot device preparation, and this one addresses one of the bigger differences between the newer device preparation model and traditional Windows Autopilot. It is called device association. Device association allows an organization […]

In the previous article, we explored one of the simplest prompt injection techniques: attempting to override the model’s original instructions. Modern Large Language Models have become increasingly resilient to these direct attacks because they recognize phrases such as “ignore previous […]

Over the past few months, I’ve written extensively about AI Red Teaming, prompt injection, and the techniques attackers use to probe the security boundaries of Large Language Models. Those articles focused on the concepts behind AI security and the mindset […]

Authentication has changed dramatically over the past decade. Not long ago, attackers focused primarily on stealing usernames and passwords because that was all they needed to gain access to an environment. As organizations adopted Multi-Factor Authentication (MFA), Conditional Access, passwordless […]

Authentication in SharePoint Server has gone through a lot of changes over the years. Most of us started with Windows authentication using NTLM or Kerberos, moved through Claims authentication, added SAML-based trusted identity providers, and then started integrating on-premises SharePoint […]

Throughout this series, we’ve looked at how attackers manipulate AI systems by changing context rather than exploiting traditional software vulnerabilities. We’ve explored how safety boundaries are created, why they are probabilistic instead of absolute, and how techniques such as prompt […]

For years, most identity security conversations have focused on protecting the authentication process. We have moved from passwords to multifactor authentication, Conditional Access, device compliance, risk-based policies, passwordless authentication, and increasingly phishing-resistant methods such as passkeys and FIDO2 security keys. […]

In Part 1, we explored how AI security boundaries are created and why they are fundamentally different from traditional security controls. We also looked at several common jailbreak techniques, including persona forcing, obfuscation, progressive reframing, and payload splitting. While these […]

Artificial intelligence has introduced one of the biggest shifts in enterprise technology since organizations first moved to the cloud. Large Language Models (LLMs) are now embedded into chatbots, search platforms, software development tools, productivity applications, customer service platforms, and increasingly […]

Large Language Models have become far more capable over the past few years, but those improvements have introduced a new category of security problem. These systems are designed to follow instructions, reason through complex requests, summarize information, generate code, and […]

Artificial intelligence continues to reshape cybersecurity, not only in how organizations defend themselves but also in how security technologies are being built. Over the past two years, most of the focus has been on increasingly capable general-purpose AI models. Microsoft’s […]

For years, organizations have invested heavily in endpoint protection, multifactor authentication, Conditional Access, email security, and network controls. All of those technologies are important, but they can still be undermined if an attacker gains access to a highly privileged identity. […]

There is something about a road trip that changes your perspective. Maybe it is the endless hours staring through a windshield, maybe it is seeing parts of the country that you only ever fly over, or maybe it is simply […]

Artificial intelligence has changed the cybersecurity landscape faster than most organizations anticipated. Over the past decade, security teams have become accustomed to protecting cloud environments, hybrid identities, remote workforces, and increasingly complex application portfolios. Each of these shifts introduced new […]

If you’ve spent any amount of time using AI, you’ve probably experienced both ends of the spectrum. Sometimes the response is exactly what you needed, requiring only a few minor edits before it is ready to use. Other times, the […]

If you’ve spent any time exploring AI over the past year, you’ve almost certainly come across prompt frameworks. Whether you’re using ChatGPT, Microsoft Copilot, Claude, Gemini, or another large language model, there’s no shortage of acronyms claiming to be the […]