New investments to reduce on

A new on-premises security initiative is being launched, focusing initially on server workloads to address increased threats from AI-assisted attacks. The initiative aims to help customers understand and prioritize risks, reduce the on-premises footprint where possible, and strengthen critical workloads that must remain on-premises without disrupting operations. Guidance will be available via Secure Now, including an AI readiness checklist in Microsoft Security Exposure Management.
The core approach involves three pillars: Understand, Identify, and Secure. This translates into actions to prioritize risks, move workloads to the cloud when feasible, and secure remaining workloads more effectively. A specific focus is placed on making supported on-premises products inherently more secure through a "Baseline Security Mode." This mode works across Patch, Configure, and Protect dimensions.
For patching, the plan includes faster release of security updates now and aiming for automatic application of updates in Q1 2027 for connected server environments. In terms of configuration, tools will assess current settings and introduce hardened defaults, with a goal to identify configuration drift. For protection against emerging threats, an Emergency Mitigation Service is available, and a more advanced version (2.0) is planned for Exchange Server/Skype for Business Server in December 2026, extending to SharePoint Server in January 2027. The overall message emphasizes modernizing where possible while ensuring the security of necessary on-premises components.

* On-premises servers are attractive targets for attackers.
* AI accelerates the analysis of software, malicious tool development, and attack workflow repetition.
* A new on-premises security initiative focuses initially on server workloads.
* The initiative includes guidance, migration, and product investments.
* Guidance will be available through Secure Now, including an AI readiness checklist in Microsoft Security Exposure Management.
* The initiative focuses on understanding risks, reducing the on-premises footprint, and strengthening critical workloads.
* The initiative starts by understanding where to focus and making supported on-premises products more secure by default.
* Within the Secure pillar, On-Premises Baseline Security Mode is being implemented for Exchange Server, SharePoint Server, and Skype for Business Server workloads.
* Baseline Security Mode aims to reduce manual configuration by establishing a secure-by-default configuration while preserving administrator control.
* The work in Baseline Security Mode progresses across Patch, Configure, and Protect areas.
* Patch: Critical updates are released outside the traditional schedule since September 2026.
* Next (Patch): Automatic application of security updates is targeted for Q1 2027 in connected SharePoint Server, Exchange Server, and Skype for Business Server environments.
* Configure: Tenant Configuration Management assesses permissions on SharePoint, Exchange, and Skype for Business Server environments.
* Next (Configure): Hardened default configurations are planned for SharePoint Server, Exchange Server, and Skype for Business Server in Q1 2027 to establish Microsoft-recommended settings by default and identify configuration drift.
* Protect: Emergency Mitigation Service automatically applies interim mitigations for emerging vulnerabilities.
* Next (Protect): Emergency Mitigation Service 2.0 is planned for Exchange Server and Skype for Business Server in December 2026, with an extension to SharePoint Server planned for January 2027.
* Microsoft continues to recommend moving workloads to Microsoft 365 where possible.

The narrative frames the shift from reactive defense to inherent security by design within the on-premises ecosystem, directly responding to the accelerating threat posed by AI-augmented adversaries. The underlying tension is between legacy operational dependencies and the imperative for modern, automated security posture management. The phased approach—starting with risk understanding and moving toward product hardening—suggests an acknowledgment that brute-force patching is insufficient against rapid, automated exploitation methods.
The structure moves from high-level strategy (Understand, Move, Secure) to specific implementation details within the product suite (Patch, Configure, Protect). This progression signals a strategic pivot: accepting that the physical location of data does not dictate security outcomes, but rather that the complexity of manual management creates exploitable gaps. The commitment to embedding security defaults into products is a critical move away from relying solely on perimeter controls or external tooling for risk mitigation.
The pattern of temporal targeting—setting concrete dates (September 2026, Q1 2027, December 2026) for incremental, automated changes—is designed to create momentum and perceived inevitability. This functions as a form of authoritative pacing, suggesting that the necessary security evolution is an engineered process rather than a purely organic response to external pressure. The implication is that inaction results in greater exposure, forcing organizations into a prescribed migration path where cloud adoption is implicitly favored for resilience and innovation. The core risk lies in whether this progression adequately addresses the complexity of existing operational inertia versus the mandate for rapid security change at scale.
Bridge Questions: If the focus remains on server workloads, how will the guidance sufficiently address the unique risk profiles introduced by applications running on those servers, rather than just the operating systems themselves? What metrics will be used to measure the success of shifting responsibility from manual administrator configuration to inherent product defaults? How does this initiative account for the potential resistance that arises when optimizing for baseline security conflicts with established, mission-critical legacy configurations?