Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

How do AI agents catch an attack that stays below every alert threshold? Jaime Guimera Coll, Microsoft Security MVP and security and AI architect at BlueVoyant, shares how he builds agentic SOC workflows that triage, investigate and correlate alerts across customer tenants.

In this episode

• How an agent correlated a low-severity brute force across tenants and found the one customer that was actually compromised
• Why the agent is "just the brain": tools live in an orchestrator with code-enforced guardrails, budgets and full transparency
• Where the human still decides, and why agents do not take response actions in production today
• Testing SOC agents against real analyst outcomes and comparing models on speed, cost and quality
• Surprising agent behaviour, including an agent that used the KQL externaldata operator to fetch internet data through Sentinel
• What data reaches the model, and why enterprise instances in Microsoft Foundry change the picture
• Security Copilot versus Project Perception, and Jaime's own Security Copilot MCP server
• What SOC managers should train their analysts on, and advice for analysts worried about their jobs

Chapters

00:00 Welcome and introductions

01:24 From developer to security founder

07:46 Agentic workflows in the SOC

11:48 Catching a slow cross-tenant brute force

16:29 Transparency and human decisions

20:11 Will AI replace SOC analysts?

25:11 Testing SOC agents for production

32:59 Model choice and data privacy

35:57 Security Copilot vs Project Perception

42:25 Daily AI use, rapid fire and advice

Guest: Jaime Guimera Coll – Security and AI Architect at BlueVoyant, Microsoft Security MVP

Hosts: Frans Oudendorp & Pouyan Khabazi

Watch on YouTube: https://youtu.be/flnWzcKx0D8

More episodes: https://talkingsecurity.nl

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

How do you secure AI agents in Microsoft Entra? Security MVP Derk van der Woude explains agent identity blueprints, classic vs modern agents and Agent 365.

In the relaunch of MVP Security Insights, Frans and Pouyan talk with Derk about AI agent security from both the attacker and the defender side.

In this episode

• What a secure AI assessment and a secure AI landing zone look like in practice

• Workload identity risk: multi-tenant apps with high-privileged application permissions

• Classic vs modern agents, and why most security controls only work on modern agents

• Agent identity blueprints: the four-layer model and why attackers go after the blueprint

• What you won't see in the UI: inherited permissions that only show up in the token

• Agent 365 explained: control plane, license and security controls in Entra, Defender, Purview and Intune

• Conditional Access for agents and the new AgentsInfo hunting table

• Where to start if you have one week to secure the agents in your tenant

Chapters

00:00 Welcome to MVP Security Insights

02:27 From a 486 to Microsoft Certified Master

07:12 Building a secure AI landing zone

11:57 Workload identity posture management

15:04 Classic vs modern agents

19:53 Agent identity blueprints explained

26:46 What the UI and audit logs miss

31:12 Agent 365 and Conditional Access

37:53 Where to start in one week

41:59 Rapid fire, IT/OT and advice

Guest: Derk van der Woude – CTO Cybersecurity at BBTG, Microsoft Security MVP (https://blue16.nl)

Hosts: Frans Oudendorp & Pouyan Khabazi

Watch on YouTube: https://youtu.be/JgH00RYLbHg

More episodes: https://talkingsecurity.nl

In this special Talking Security episode, recorded live from Microsoft HQ during the MVP Summit, hosts Frans Oudendorp and Pouyan Khabazi sit down with Ofer Shezaf, the mastermind behind Microsoft Sentinel—the first truly cloud-native SIEM.

With over 30 years in cybersecurity, Ofer takes us on a journey through the evolution of InfoSec, shares the origin story of Sentinel, and unpacks what it takes to grow a billion-dollar product. From the early days of SIEM to the role of AI in modern detection and response, this episode is packed with insights, strategy, and a few fun stories along the way.

Whether you're a seasoned SOC analyst, a cloud architect, or just curious about how Sentinel became a cornerstone of modern cyber defense—this one’s for you.

👉 Topics covered:

- Why existing SIEMs weren’t enough—and how Sentinel changed the game

- Lessons from building and scaling a $1B+ cybersecurity product

- Real vs. perceived risk in product strategy

- The role of community and open-source in shaping the future of cyber defense

- Ofer’s advice for the next generation of cybersecurity leaders

Grab your Favorito drink, and let’s talk security! 🔐