Case study: How predictive shielding in Defender stopped GPO-based ransomware before it started

A set of Microsoft Security Blog posts (March 2026) covering multiple, active threats and defensive improvements: a case study where Microsoft Defender’s predictive shielding blocked a human-operated ransomware campaign that abused Group Policy Objects (GPOs) to disable defenses and deploy encryption at scale (hardened ~700 devices, zero GPO-based encryptions); CTI-REALM, an open-source benchmark for AI-driven detection rule generation; guidance and tooling for securing agentic AI and a new Zero Trust for AI pillar; tax-season phishing and malware campaigns leveraging time-sensitive lures; AI/