From Vision to Sentinel: How Microsoft Built the World's Most Beloved Cloud-Native SIEM
Talking Security: Insights from Microsoft Security ExpertsShow Notes
Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! In this special Talking Security episode, recorded live from Microsoft HQ during the MVP Summit, hosts Frans Oudendorp and Pouyan Khabazi sit down with Ofer Shezaf, the mastermind behind Microsoft Sentinel—the first truly cloud-native SIEM.
With over 30 years in cybersecurity, Ofer takes us on a journey through the evolution of InfoSec, shares the origin story of Sentinel, and unpacks what it takes to grow a billion-dollar product. From the early days of SIEM to the role of AI in modern detection and response, this episode is packed with insights, strategy, and a few fun stories along the way.
Whether you're a seasoned SOC analyst, a cloud architect, or just curious about how Sentinel became a cornerstone of modern cyber defense—this one’s for you.
👉 Topics covered: - Why existing SIEMs weren’t enough—and how Sentinel changed the game - Lessons from building and scaling a $1B+ cybersecurity product - Real vs. perceived risk in product strategy - The role of community and open-source in shaping the future of cyber defense - Ofer’s advice for the next generation of cybersecurity leaders
Grab your Favorito drink, and let’s talk security! 🔐
More from Talking Security: Insights from Microsoft Security Experts
Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! How do you secure AI agents in Microsoft Entra? Security MVP Derk van der Woude explains agent identity blueprints, classic vs modern agents and Agent 365. In the relaunch of MVP Security Insights, Frans and Pouyan talk with Derk about AI agent security from both the attacker and the defender side.
Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! Join Frans Oudendorp and Pouyan Khabazi in this special episode of Talking Security – Let’s Talk, where we sit down with Javier Soriano, Principal Product Manager for Microsoft Sentinel. We dive deep into: - The evolution of Sentinel from day zero to today - The new Sentinel Data Lake and how it transforms long-term log retention and investigations - Why Sentinel Graph matters for SOC teams - The Model Context Protocol (MCP) and its role in agentic AI workflows - What’s next for cloud-native security: automation, AI, and new operating models If you’re curious about the future of Microsoft Sentinel and want practical insights for your security team, this episode is packed with value.
Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! In this episode of Talking Security – MVP Security Insights, we sit down with Ronny de Jong to explore his remarkable journey from cybersecurity MVP to his current role at Microsoft. Ronny shares insights on: 💎 His career path and what inspired him to join Microsoft 💎 The unique cybersecurity challenges facing governments and public institutions 💎 How Microsoft’s security portfolio supports national resilience 💎 Balancing innovation, compliance, and operational realities in the public sector 💎 Future trends in threat intelligence and security operations 💎 Practical advice for aspiring cybersecurity professionals 💎 The meaning of true cyber resilience and moving from reactive to proactive security
Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! In this episode of Let’s Talk, part of the Talking Security podcast, Frans Oudendorp and Pouyan Khabazi break down the biggest announcements from Microsoft Secure 2025. We explore how Microsoft Sentinel is evolving into an agentic AI platform, the introduction of Sentinel Graph and Model Context Protocol (MCP), and how Security Copilot agents are changing the game for SecOps automation. You’ll also hear about: Graph-based context and why it matters for threat detection Developer extensibility for custom connectors and AI agents Sentinel Data Lake for affordable long-term storage Real-world use cases for agentic AI in security operations Plus, we share community highlights, upcoming events like YellowHat 2025 and KustoCon, and a fun geeky quiz to wrap things up. 👉 Question for you: If you could build your own Security Copilot agent, what would it do? Let us know! 🎙️ Stay safe, stay secure, and keep talking security!
Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! In this episode of Talking Security – MVP Security Insights, Frans Oudendorp and Pouyan Khabazi sit down with Eric Woodruff—Chief Identity Architect at Semperis and long-time identity expert—to explore his journey from managing Active Directory in the public sector to shaping cutting-edge identity strategies in the cloud era. Eric shares what it means to truly be “in” cybersecurity, the evolving role of Entra ID, and the significance of identity research like the UnOAuthorized project. We also dive into global challenges in identity management, the balance between strong security and business agility, and how community collaboration through IDPro is driving vendor-agnostic progress. Whether you're new to identity or a seasoned expert, this conversation is packed with real-world insights, practical advice, and forward-looking trends shaping the future of identity and access management.