You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Microsoft Defender XDR uses predictive shielding (Preview) as a proactive defense strategy designed to anticipate and mitigate threats before they materialize. Learn [how predictive shielding works](shield-predict-threats.md#how-predictive-shielding-works) to dynamically infer risk, anticipate attacker progression, and harden your environment.
33
+
Microsoft Defender uses predictive shielding (Preview) as a proactive defense strategy designed to anticipate and mitigate threats before they materialize. Learn [how predictive shielding works](shield-predict-threats.md#how-predictive-shielding-works) to dynamically infer risk, anticipate attacker progression, and harden your environment.
34
34
35
35
This article describes how to manage predictive shielding so that you can enrich your prediction data and understand how predictive shielding actions are applied in your environment.
36
36
37
37
## Review predictive shielding details and results
38
38
39
-
The incident view in Microsoft Defender XDR includes built-in predictive shielding details. Use the incident graph and activity information to assess the predictive shielding impact and status.
39
+
The incident view in Microsoft Defender includes built-in predictive shielding details. Use the incident graph and activity information to assess the predictive shielding impact and status.
40
40
41
41
> [!TIP]
42
42
> To enrich your predictive shielding data, we recommend that you use the Microsoft Defender for Identity sensor to improve security insights and expand coverage. For more information, see [Enrich predictive shielding data](#enrich-predictive-shielding-data).
Predictive shielding (Preview) is a proactive defense strategy designed to anticipate and mitigate threats as part of an ongoing attack. Predictive shielding [expands the Microsoft Defender XDR autonomous protection stack](#how-predictive-shielding-expands-on-automatic-attack-disruption), enhancing automatic attack disruption capabilities with proactive measures.
33
+
Predictive shielding (Preview) is a proactive defense strategy designed to anticipate and mitigate threats as part of an ongoing attack. Predictive shielding [expands the Microsoft Defender autonomous protection stack](#how-predictive-shielding-expands-on-automatic-attack-disruption), enhancing automatic attack disruption capabilities with proactive measures.
34
34
35
35
This article provides an overview of predictive shielding so that you can understand its capabilities and how it enhances your security posture.
36
36
37
-
Learn [how predictive shielding works](#how-predictive-shielding-works) or how to [manage predictive shielding in Microsoft Defender XDR](shield-predict-threats-manage.md).
37
+
Learn [how predictive shielding works](#how-predictive-shielding-works) or how to [manage predictive shielding in Microsoft Defender](shield-predict-threats-manage.md).
38
38
39
39
## How predictive shielding expands on automatic attack disruption
40
40
41
41
The evolving threat landscape creates an imbalance: defenders must secure every asset, while attackers need only one opening. Traditional defenses are reactive, responding after malicious activity begins. This approach leaves defenders chasing attackers, who often act too quickly or subtly to detect in real time. While some attacker behaviors must be blocked outright, static prevention disrupts productivity and adds operational overhead.
42
42
43
-
To address these challenges, predictive shielding enhances Defender XDR's autonomous protection stack, expanding [attack disruption](automatic-attack-disruption.md) to include proactive measures during an attack, anticipating risks and applying targeted protections only where needed.
43
+
To address these challenges, predictive shielding enhances Defender's autonomous protection stack, expanding [attack disruption](automatic-attack-disruption.md) to include proactive measures during an attack, anticipating risks and applying targeted protections only where needed.
44
44
45
45
This proactive approach reduces the reactive chase, minimizes operational burden, maintains usability, and protects the environment before attackers can advance.
46
46
@@ -58,7 +58,7 @@ Predictive shielding relies on two pillars:
58
58
59
59
-**Prediction**
60
60
- Involves analyzing threat intelligence, attacker behavior, past incidents, and organizational exposure.
61
-
- Defender XDR uses this prediction data to identify emerging risks, to understand likely attack progression, and to infer risk on noncompromised assets.
61
+
- Defender uses this prediction data to identify emerging risks, to understand likely attack progression, and to infer risk on noncompromised assets.
62
62
-**Enforcement** applies preventative protective controls to disrupt potential attack paths in real time.
63
63
64
64
This dual approach ensures that protection is both precise and timely.
@@ -67,7 +67,7 @@ This dual approach ensures that protection is both precise and timely.
67
67
68
68
Prediction allows organizations to identify assets at risk and apply tailored protections in real time. Prediction focuses on emerging risks rather than static prevention, which minimizes operational friction and ensures that security measures are applied precisely where needed. For example, if a specific attacker tool is detected, predictive shielding can infer the next likely target based on past attack patterns.
69
69
70
-
Defender XDR uses multiple layers of insight to make accurate predictions:
70
+
Defender uses multiple layers of insight to make accurate predictions:
71
71
72
72
- Threat intelligence aligns observed activity with known attacker tools and tactics.
73
73
- Learnings from past incidents are used to recognize statistical patterns, and extrapolate the most probable next steps.
@@ -79,15 +79,15 @@ Together, these insights create a dynamic understanding of the environment and i
79
79
80
80
Graph-based prediction logic bridges the gap between pre-breach and post-breach systems, providing a unified view of attacker activity across the organizational topology. This unified view includes the organization's assets, connections, and vulnerabilities. Graph-based logic combines live activity data with the structural map of the environment.
81
81
82
-
This integration allows Defender XDR to dynamically adjust protections based on the most critical vulnerabilities, enabling real-time prioritization of defenses and stopping attackers before they reach critical assets.
82
+
This integration allows Defender to dynamically adjust protections based on the most critical vulnerabilities, enabling real-time prioritization of defenses and stopping attackers before they reach critical assets.
83
83
84
84
The process involves three key stages:
85
85
86
-
1. Defender XDR overlays post-breach activity onto the organization’s exposure graph, creating a comprehensive view of potential attack paths.
87
-
1. Defender XDR identifies the blast radius—the related assets that the identified activity might affect.
86
+
1. Defender overlays post-breach activity onto the organization’s exposure graph, creating a comprehensive view of potential attack paths.
87
+
1. Defender identifies the blast radius—the related assets that the identified activity might affect.
88
88
1. Reasoning models predict paths attackers are most likely to take, factoring in past behaviors, asset characteristics, and environmental vulnerabilities.
89
89
90
-
This dynamic understanding allows Defender XDR to move beyond reactive responses, enabling just-in-time protection that stops attackers before they reach critical assets.
90
+
This dynamic understanding allows Defender to move beyond reactive responses, enabling just-in-time protection that stops attackers before they reach critical assets.
91
91
92
92
## Predictive shielding actions
93
93
@@ -104,7 +104,7 @@ Predictive shielding uses Defender for Endpoint-based actions. To use these acti
104
104
105
105
## Next steps
106
106
107
-
-[Manage predictive shielding in Microsoft Defender XDR](shield-predict-threats-manage.md) - Learn how to manage predictive shielding actions and investigate their impact in your environment.
108
-
-[Automatic attack disruption in Microsoft Defender XDR](automatic-attack-disruption.md) - Learn how automatic attack disruption works to identify and neutralize confirmed malicious activities.
107
+
-[Manage predictive shielding in Microsoft Defender](shield-predict-threats-manage.md) - Learn how to manage predictive shielding actions and investigate their impact in your environment.
108
+
-[Automatic attack disruption in Microsoft Defender](automatic-attack-disruption.md) - Learn how automatic attack disruption works to identify and neutralize confirmed malicious activities.
0 commit comments