> IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor Assessment

Today, we’re proud to share thatMicrosoft has been named a Leader in the 2026 IDC MarketScape for Worldwide Modern Endpoint Security for Enterprises (Doc #US54123526, September 2026). The IDC Marketscape calls out three strengths that we believe matter most in endpoint security today: Autonomous attack disruption and predictive shielding contain ransomware and identity attacks in minutes, at a meaningful scale. Agentic AI through Security Copilot is now generally available, with measured gains in alert accuracy and analyst time saved. The company offers broad native cross-platform coverage plus sovereign cloud and data residency options for regulated and multinational customers. Read the IDC report IDC MarketScape vendor analysis model is designed to provide an overview of the competitive fitness of technology and suppliers in a given market. The research methodology utilizes a rigorous scoring methodology based on both qualitative and quantitative criteria that results in a single graphical illustration of each supplier’s position within a given market. The Capabilities score measures supplier product, go-to-market and business execution in the short-term. The Strategy score measures alignment of supplier strategies with customer requirements in a 3-5-year timeframe. Supplier market share is represented by the size of the icons. The most critical moment in any attack is when it moves from access to action. That’s when ransomware detonates, stolen credentials are put to work, and, increasingly, a manipulated AI agent turns a user’s own data and tools against them. And threat actors are now using teams of AI agents to execute attacks faster and more relentlessly. Between 2025 and 2026, Microsoft Security researchers observed a more than 15% increase in ransomware detonations against enterprises.1 When an attacker can move from first foothold to encryption in minutes, protection on the endpoint must act at the same speed, without waiting for a person to connect the dots. Protection that acts while the attack is still unfolding The IDC MarketScape highlights that “Automatic attack disruption contains compromised devices, users, and IP addresses in near real time, and predictive shielding proactively hardens likely next attacker moves.” Built into Microsoft Defender, attack disruption uses AI and signals from the endpoint and across identities, email, and cloud to recognize multistage attacks, such as ransomware, as they happen. It then automatically contains the affected devices and users to stop the attacker from moving laterally. Against attacks that move in minutes, protection has to work autonomously, while the attack is still in progress and before it can spread. QNET, a global direct-selling company, saw this firsthand. Defender identified an active ransomware attack, isolated the compromised device, and stopped the second-stage payload within 128 seconds of the first high-severity alert. A foundation built for agentic security Stopping an attack like QNET’s in seconds starts with the right foundation. Attack disruption succeeds because Defender can see activity across endpoints, identities, email, and cloud, understand what that activity means, and act on it natively. The IDC MarketScape highlights that “the Defender portal unifies incident and alert queues, graph-based incident views, and advanced hunting, correlating signals from endpoint, identity, email, SaaS, and cloud sources into a single incident.” That foundation depends on three layers working as one. Signals and sensors give the system awareness across the entire environment. Context turns those signals into understanding: what is happening, what is exposed, how an attacker could move, and what matters most. Actuators, like attack disruption, turn that understanding into protective action. To protect against the latest AI-based threats, these layers need to work in unison. That’s why, on September 23, 2026, we announced the integrated security operations center (ISOC) in Microsoft Defender. ISOC brings security information and event management (SIEM) and Defender’s threat protection together, giving people and agents shared signals, shared context, and shared controls to see, understand, and act across the environment as one. On top of that foundation, we continue to strengthen what Defender can see: Richer endpoint signals: Defender provides more than 200 native event types for threat hunting. Custom data collection extends that visibility by letting security teams collect specialized telemetry to support tailored detections and advanced hunting. Comprehensive signals across your environment: Microsoft Sentinel now provides more than 500 connectors to ingest security-relevant data from across your organization’s digital estate. This breadth gives defenders the context to connect activity across otherwise fragmented systems, detect threats that no single signal would reveal, and investigate and respond with greater confidence. Agentic AI built into the flow of work With signals, context, and actuators working as one in Microsoft Defender, agents have what they need to be effective: the visibility to see what’s happening, the context to understand it, and the controls to act on it. IDC notes that AI is deeply embedded across the Defender platform, with agentic AI now generally available and delivering “measured gains in alert accuracy and analyst time saved.” One platform to see, understand, and protect local AI agents The same visibility, context, and controls that make agents effective for defenders also make it possible to secure the agents employees use every day. Developers and knowledge workers now run local agents, from coding assistants to agentic development environments, with access to data, credentials, tools, and Model Context Protocol (MCP) servers. IDC advises buyers to ask how vendors secure AI on the endpoint, including visibility into local models and agent activity. With Defender, security teams can see those agents, understand their reach, and protect them as they operate. See every local agent: Discovery of local agents and their configured MCP servers is available on Windows and macOS, covering more than 50 supported agents and MCP servers, including claw-based agents such as OpenClaw. Understand their reach: The exposure graph in Defender maps each agent’s blast radius across devices, identities, and MCP connections, and teams can investigate agent activity in advanced hunting alongside data from endpoints, identities, email, and cloud. Protect agents as they operate: Runtime protection, in preview on Windows, stops malicious instructions, such as prompt injection hidden in a file or web page, before an agent acts on them, and raises an alert with agent and session context. In a threat landscape being reshaped by AI, Microsoft Defender will continue to deliver leading endpoint security for any platform with a focus on reducing exposure, disrupting active attacks in your environment, and strengthening resilience across the entire organization. To see where security operations are headed next, join Rob Lefferts at Microsoft Ignite for the session: The Alert Is Dead. The Blueprint for the Agentic SOC. Microsoft named a Leader by IDC Read the 2026 IDC MarketScape to learn why IDC named Microsoft a Leader in Worldwide Modern Endpoint Security for Enterprises. Read the report To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Follow us on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest news and updates on cybersecurity. 1Microsoft 2026 Digital Defense Report The post IDC MarketScape names Microsoft a Leader in the 2026 Worldwide Modern Endpoint Security for Enterprises Vendor Assessment appeared first on Microsoft Security Blog.