Microsoft Defender for Endpoint Updates & Release Notes

| Feature | New Microsoft Secure Score recommendations for AI-Readiness | GA | Microsoft Defender now brings together six security recommendations for AI-Readiness to help organizations strengthen endpoint trust against AI-accelerated cyberattacks. Together, these recommendations provide a layered security baseline that helps reduce externally visible entry points, establish hardware-backed trust in device startup, isolate critical Windows security functions, protect kernel code integrity, and limit the reuse of local administrator credentials for lateral movement.In the Microsoft Defender portal, go to Exposure Management > Recommendations > Devices > Misconfigurations, and filter by the AI-Readiness tag to view the complete recommendation set, affected devices, exposed critical devices, points achieved, and potential impact on the Devices Secure Score. Use this view to prioritize remediation, assign ownership, track exceptions, and monitor adoption throughout the device estate.Four new recommendations are available for AI-Readiness:- Establish a hardware root of trust with TPM 2.0: Helps protect cryptographic keys, device identity, and boot measurements with hardware-backed security.- Isolate critical security functions with VBS: Helps protect critical security functions in an isolated environment that is separate from the operating system kernel.- Enforce kernel code integrity with HVCI: Helps validate kernel-mode code, block untrus…

| Feature | Microsoft Defender for Endpoint plug-in support for WSL containers (WSLc) | Preview | Extend Microsoft Defender for Endpoint protection to workloads running in WSL containers (WSLc). Gain visibility into WSL container activity through device inventory, alerts, incidents, device timeline, and Advanced Hunting, helping security teams investigate and respond to threats across both Windows and Linux workloads.Available in Public Preview. To enroll, complete the registration form. |

August 2026

| Feature | Local AI agent discovery — macOS support and new agents | Preview | Local AI agent discovery now supports macOS endpoints in addition to Windows. This update also adds discovery support for new agents including Junie CLI, Kiro CLI, Warp, Hermes Agent, Goose Desktop, Perplexity Desktop, Kiro IDE, Devin Desktop (formerly Windsurf), and QClaw. For more information, see Local AI agent discovery. | | Feature | Enhanced Defender deployment tool for Windows | GA | The new version of the tool streamlines onboarding and enhances security by:- Bundling the onboarding package directly into the tool's executable.- Generating a key during deployment package creation that is required for running the tool.- Enabling users to configure an expiry date for the package to reduce the risk of unauthorized use.In addition:- You have the option of downloading the package as either an .exe or a .zip file, whichever best suits your organization's needs.- A new Deployment packages page in the Defender portal facilitates management of downloaded packages by providing centralized visibility into all the packages and their current status. | …

| Feature | New Microsoft Secure Score recommendation | GA | Microsoft Secure Score now includes the Reduce unnecessary inbound internet exposure on internet-facing devices recommendation, which helps identify devices that are accessible from the public internet and may represent unnecessary attack surface.Internet-facing devices are primary entry points for attackers and automated scanners, making them prime targets for credential brute-forcing, exploitation of unpatched vulnerabilities, and initial access for ransomware and hands-on-keyboard intrusions.This recommendation provides centralized visibility into internet-facing devices across the environment, enabling organizations to validate whether exposure is expected, prioritize remediation for unintended exposure, and reduce external attack surface at scale. | | Feature | Local AI agent discovery | Preview | Microsoft Defender for Endpoint now automatically discovers supported local AI agents running on onboarded Windows devices — including coding agents and IDE extensions, desktop AI assistants, local AI runtimes, and agent platforms. Discovered agents appear as assets in the AI agent inventory, exposure map, and advanced hunting, giving security teams visibility into local AI agent usage across the organization. For more information, see Discover local AI agents. | …