From Identity Compromise to AI Defense: Inside Modern Incident Response

This week we are taking you back to Black Hat USA 2026 and exploring two sides of the security landscape. First, Microsoft incident response experts Adrian Hill and Terry Mee break down identity-based attacks, from compromised credentials and MFA bypasses to containment, logging, access controls, and the growing risks surrounding AI agents. Then, members of Microsoft’s Defender Purple Team discuss how they recreate full attack chains, including emerging AI-driven techniques, to identify detection gaps, strengthen defenses, and use AI to accelerate security research while keeping human expertise in the loop. In this episode you’ll learn: Why identity is at the center of modern security incidents How attackers can bypass MFA and maintain access through sessions, tokens, and other forms of persistence Why logging and long-term data retention are critical during incident response How purple teams recreate full attack chains to uncover gaps in detection and response Where AI can accelerate security research, and where deterministic systems and human oversight still matter Why AI agents introduce new risks around access, permissions, and trust Some questions we ask: What should organizations be logging and retaining for incident response? Where do organizations underestimate SaaS, OAuth, and identity persistence risks? When should defenders contain an attacker versus continue gathering intelligence? How does attacking an AI-enabled system begin to look like traditional offensive security? Where should security researchers trust AI, and where should they rely on deterministic systems? What should security teams understand about the exposure and permissions of their AI agents? Resources: View Elliot Volkman on LinkedIn Related Microsoft Podcasts: Afternoon Cyber Tea with Ann Johnson The BlueHat Podcast Uncovering Hidden Risks Discover and follow other Microsoft podcasts at microsoft.com/podcasts Get the latest threat intelligence insights and guidance at Microsoft Security Insider The Microsoft Threat Intelligence Podcast is produced by Microsoft, Hangar Studios and distributed as part of N2K media network.