A new era for the Security Operations Center

Microsoft is bringing XDR and SIEM together through its new Integrated Security Operations Center experience in Microsoft Defender. As agentic systems reshape enterprise environments, the SOC itself is evolving — from separate security tools toward unified visibility, investigation and response.

Security operations are evolving as rapidly as the threats they are designed to detect and contain.

Microsoft has introduced the Integrated Security Operations Center (ISOC) experience in Microsoft Defender, bringing XDR and SIEM together in one integrated platform and shifting the focus from individual security tools toward security outcomes.

The change becomes particularly relevant as organizations begin introducing autonomous and agentic systems into their environments. Security teams increasingly need unified visibility across identities, endpoints, applications, cloud resources, data and emerging AI agents.

The question is no longer simply which security tools are deployed — but whether the SOC can see, understand and respond to activity across the entire digital environment.

Microsoft describes the new ISOC experience as being built for agentic security and designed around the practitioner, reducing the operational boundaries traditionally separating XDR and SIEM workflows.

As Hayete Gallot, EVP of Microsoft Security, puts it:

“The physics of cybersecurity are changing. So must the SOC.”

The Microsoft Security post below introduces the new approach and the thinking behind the Integrated Security Operations Center.

⬇️ Watch the original Microsoft Security post here.