Microsoft Security

Defender portfolio — presales intelligence for SEs

live data

Signals per day

Microsoft threat intelligence

Attacks blocked daily

Across Microsoft customers

Battle cards

Competitive displacement

Attack scenarios

Full kill chain coverage

Overview Feature map Battle cards Attack scenarios Stack comparison

Attack scenarios

Real-world attack kill chains mapped to MITRE ATT&CK tactics and Defender product coverage. Expand any scenario to walk through the full kill chain step by step.

Scenarios

Threat categories

Full coverage

Partial coverage

BEC

1 scenario

Ransomware

1 scenario

Supply chain

1 scenario

Insider threat

1 scenario

Identity attack

3 scenarios

Cloud attack

2 scenarios

Endpoint attack

2 scenarios

Data exfiltration

1 scenario

Microsoft Security

Attack scenarios

BEC

Business email compromise

Ransomware

Human-operated ransomware

Supply chain

Software supply chain compromise

Insider threat

Malicious insider data theft

Identity attack

Password spray & credential stuffing

Adversary-in-the-middle (AiTM) phishing

Privilege escalation via Entra ID / Active Directory

Cloud attack

OAuth app abuse & consent phishing

Azure cloud resource hijacking

Endpoint attack

Living-off-the-land (LotL) fileless attack

Vulnerability exploitation & unpatched endpoint

Data exfiltration

Data exfiltration to personal cloud storage