The agentic SOC—Rethinking SecOps for the next decade

This collection of Microsoft Security Blog posts (Apr 2026) highlights an intensifying threat landscape: financially motivated and state-linked actors are exploiting supply chains, vulnerable SDKs, insecure SOHO routers, web-facing software, and human authentication flows. Notable incidents include the Axios npm supply‑chain compromise attributed to North Korea’s Sapphire Sleet, a severe intent‑redirection vulnerability in a widely used Android SDK exposing millions of wallets, Storm‑2755 “payroll pirate” attacks targeting Canadian employee accounts, Forest Blizzard router compromises enabling