// UNCLASSIFIED // CLEARED FOR PUBLIC RELEASE //
FILE SPN-170DTG 0600Z
ColdRecon / The Spine / Microsoft
Vendor Spine

Microsoft

90-DAY WINDOW · 22 DEMONSTRATIONS · 1.0% LAB MISS

Microsoft: published miss rate 1.0% (AV-Comparatives, 2026-04-30); 22 in-the-wild demonstrations in the last 90 days. First demonstrations recorded in this 90-day window.

The spine, four columns

Lab, field, breach, trend

Lab baseline
1.0%
AV-Comparatives · 2026-04-30
Demonstrated
22
in-the-wild demos · 90d
Field incidents
0
breaches with product deployed
Trend
NEW
demos vs prior 90d

Four independent measures, laid out side by side. We do not normalize them against each other; each row is the figure published by the labs, the research community, or the disclosure record.

The receipts · demonstrations

In-the-wild bypass and exploitation research

2026-07-09
demonstrated against Vishing Campaign Bypasses Microsoft 365 MFA by Enrolling Attacker-Controlled Entra Passkeys
BleepingComputer
2026-07-07
demonstrated against Attackers Weaponize Microsoft Teams Cross-Tenant Chat to Deliver EtherRAT via Malicious MSI Loader
GBHackers
2026-07-07
demonstrated against ThreatLocker's June Report Validates a Microsoft Defender Zero-Day (RoguePlanet) and a SaaS Trust Abuse Breach
PR Newswire
2026-07-03
demonstrated against CISA Confirms Active Exploitation of Patched Microsoft SharePoint RCE
Bleeping Computer
2026-07-02
demonstrated against CISA Confirms Ransomware Gangs Are Actively Exploiting a Microsoft Defender Privilege Escalation Flaw (BlueHammer)
BleepingComputer
2026-06-22
demonstrated against Gentlemen RaaS Modular Framework: CrowdStrike, SentinelOne, Microsoft, Kaspersky, ESET All Targeted
Rankiteo Blog
2026-06-19
demonstrated against DragonForce Hides Ransomware C2 Inside Microsoft Teams — Network Detection Blind to It
Bleeping Computer
2026-06-18
demonstrated against Microsoft's Defender Has Its Own Zero-Day — and the Patch Isn't Here Yet
BleepingComputer

Every item above is a public, cited record drawn from open-source reporting. ColdRecon publishes the spine as a service to the buyer side: the lab number, the field record, the breach record. No vendor scoring; no recommendation; no editorialization. Microsoft's full lab record →

You sell against Microsoft. Walk in knowing every recent demonstration cold.

ColdRecon delivers a daily intelligence brief from the seller's seat — the spine, the breaches, the capability moves, the field demonstrations, every receipt linked. Request clearance and the first lands tomorrow at 0600.

Request Clearance →