From Identity Compromise to AI Defense: Inside Modern Incident Response

This week we are taking you back to Black Hat USA 2026 and exploring two sides of the security landscape. 

First, Microsoft incident response experts Adrian Hill and Terry Mee break down identity-based attacks, from compromised credentials and MFA bypasses to containment, logging, access controls, and the growing risks surrounding AI agents. 

Then, members of Microsoft’s Defender Purple Team discuss how they recreate full attack chains, including emerging AI-driven techniques, to identify detection gaps, strengthen defenses, and use AI to accelerate security research while keeping human expertise in the loop. 

In this episode you’ll learn: 

Why identity is at the center of modern security incidents 

How attackers can bypass MFA and maintain access through sessions, tokens, and other forms of persistence 

Why logging and long-term data retention are critical during incident response 

How purple teams recreate full attack chains to uncover gaps in detection and response 

Where AI can accelerate security research, and where deterministic systems and human oversight still matter 

Why AI agents introduce new risks around access, permissions, and trust 

Some questions we ask: 

What should organizations be logging and retaining for incident response?