Using AI to detect security bugs in Windows will now be standard practice at Microsoft

Yesterday, Microsoft began urging IT admins to adopt staged rollout strategies for Windows updates rather than deploying them indefinitely. The company emphasized that this has become necessary in the evolving threat landscape where AI has accelerated the ability to discover, analyze, and exploit security issues. Now, Windows chief Pavan Davuluri has further explained how the firm is making sure that its Windows updates are secure and what customers should be doing.

Microsoft has integrated multi-model agentic scanning harness (MDASH) into its Windows development pipeline at scale. This mechanism automatically detects vulnerabilities and ensures that only the highest confidence findings reach the engineering team. It also reduces review time, which means that Microsoft has a higher chance of discovering 0-day vulnerabilities faster. This process also extends to other Microsoft product security teams, which work closely with the Microsoft Security Response Center (MSRC) to assess rollout patterns, customer feedback, and more.

Now, Microsoft is formally updating its Software Development Lifecycle (SDLC) best practices so that the company can effectively tackle AI-enabled attack techniques through secure-by-design development methodologies. This includes integrating AI into its end-to-end development process from discovering a bug to issuing a validated fix. The firm will also be investing more in validation programs like Security Update Validation Program (SUVP) and internal validation. Finally, it will be investing in Windows technology like agentic harnesses that use AI to detect and fix bugs, while keeping humans in the loop.

All this means that customers will start seeing more security updates with each Windows release, which is actually good because it means that Microsoft's new defensive practices are working. Still, in case of issues and regressions, customers will be able to reach out to customer support or deploy Known Issue Rollbacks (KIRs) as soon as they become available.

With that being said, it is the customer's responsibility to apply security updates as soon as possible. Security personnel at organizations have been urged to review Common Vulnerabilities and Exposure (CVE) advisories, and also deploy preview "D" releases, which become available two weeks before Patch Tuesday. It has also advised customers to rely on integrated operating system capabilities like Windows Hello and Microsoft Defender.

IT admins deploying at scale should take full advantage of Windows Autopatch, hotpatch, Intune, conditional access, compliance policies, and more. Microsoft has noted that as the threat landscape continues to evolve, customers shouldn't have to choose between speed and stability. It hopes that its integration of AI in security processes to continuously improve Windows and other products should help build trust between the firm and its customers.