CTI-REALM: A new benchmark for end-to-end detection rule generation with AI agents

This Microsoft Security Blog collection (Mar 2026) highlights Microsoft’s work and guidance across AI and traditional threat areas. Key items: CTI-REALM — an open-source benchmark for evaluating AI agents that generate end-to-end detection rules from CTI; new Zero Trust for AI guidance and tools plus Secure Agentic AI capabilities to harden agents and foundations; emphasis on observability for AI systems and playbooks for detecting and remediating prompt injection/prompt abuse; practical incident case studies including a Teams voice-phishing compromise investigated by DART; threat reporting on