One of the biggest challenges in cyber security is identifying activity that appears legitimate on the surface.
Modern attackers often use genuine credentials, trusted tools and normal-looking processes, making it harder to distinguish malicious activity from everyday operations. Canary Tokens are designed to help address that challenge. They act as deliberately placed detection points within an environment, generating an alert when they are accessed or interacted with.
Because these assets have no legitimate business purpose, any activity associated with them should always be treated as requiring investigation. This makes Canary Tokens a simple but effective way to introduce high-confidence alerts into a wider security monitoring strategy.
Over the last few years, organisations have significantly improved their security posture – stronger authentication, better endpoint protection, and more advanced detection. And so, attackers have adapted accordingly…
Rather than relying on noisy exploits, they are now:
This “living off the land” approach works because it doesn’t immediately stand out.
And that raises a difficult question: if activity looks legitimate, how do you spot the problem?
If used correctly, this has the potential to reduce administrative overhead, improve productivity, and accelerate decision-making. However, it also introduces new considerations around governance, permissions, and oversight.
As AI gains the ability to act rather than simply advise, ensuring appropriate controls are in place becomes increasingly important.
Canary Tokens are decoy assets placed within an environment to help identify unauthorised activity. They are designed to appear legitimate but have no genuine business use, meaning any interaction with them can provide a valuable indication that further investigation is needed.
Common examples include:
Developer productivity was another major focus throughout the event.
Microsoft shared examples of how AI-assisted development is helping teams accelerate software delivery, automate repetitive tasks, and focus more time on higher-value work. Internally, Microsoft highlighted its own adoption of agentic AI and Copilot capabilities across development teams.
This reflects a broader industry shift. Developers are increasingly moving from writing every line of code manually to orchestrating AI-generated outputs and validating the results.
While this creates significant efficiency gains, it also reinforces the need for robust security testing, code review processes, and governance frameworks.
As we explored in our recent article on AI-generated code and digital trust, AI can accelerate software development, but speed must still be balanced with security and quality assurance.
While AI dominated the agenda, Microsoft also emphasised the importance of trust, governance, and organisational readiness as foundational requirements for successful adoption.
As organisations connect AI systems to business data, applications, and workflows, identity becomes increasingly important.
Questions such as:
become critical considerations.
This aligns closely with Microsoft’s broader Zero Trust strategy, where identity, access control, and continuous verification underpin security across modern environments.
The message from Build was clear: AI innovation and security maturity must progress together.
For most organisations, Build 2026 was not about preparing for a distant future. Many of the capabilities showcased are already being integrated into products and services businesses use every day.
The key challenge is no longer access to AI technology. It is understanding where AI can deliver meaningful business value while maintaining appropriate levels of governance, security, and operational control.
Organisations should be considering:
Those that approach AI strategically are likely to realise the greatest benefits over the coming years.
If Build 2025 was about demonstrating what AI could become, Build 2026 was about showing how Microsoft intends to make it part of everyday work.
The convergence of AI, automation, identity, and security is accelerating. For organisations already invested in the Microsoft ecosystem, understanding how these technologies fit together will be essential to maximising value while managing risk.
As Microsoft’s AI capabilities continue to mature, the focus for businesses should remain on practical outcomes, strong governance, and ensuring technology adoption supports broader business objectives rather than becoming an objective in itself.
If you’re ready to take Copilot and broader AI adoption seriously – whether that’s governance, training, benchmarking, or building an AI-ready foundation – our team can connect you with the right experts and our proven AI readiness approach.
We’re here to help you move forward with clarity and confidence, reach out here to request more information.
