CTI-REALM: A new benchmark for end-to-end detection rule generation with AI agents

Collection of Microsoft Security Blog posts (Mar 2026) covering AI-focused security initiatives and active real-world threats. Key items: CTI-REALM — an open-source benchmark to evaluate AI agents that convert CTI into validated detection rules; new Microsoft guidance and tooling for securing agentic AI and a Zero Trust for AI pillar (architecture, workshops, assessment); emphasis on observability and governance for AI systems and prompt-injection/prompt-abuse detection and response. Operational threat coverage includes tax-season phishing and malware campaigns, a Teams voice-phishing incident