Digging deeper

Microsoft went on to outline how each of the three pillars of the ESP will work:

Threat intelligence sharing: Using AI to support analysis of cyber threat activity and glean more insight in real time, helping governments defend proactively. Meanwhile, the capacity of the existing Digital Crimes Unit (DCU) will be expanded to support law enforcement partners through the Cybercrime Threat Intelligence Programme.

At the same time, Microsoft’s Threat Analysis Centre will ramp up its analysis of influence operations in Europe to help governments stay ahead of disinformation campaigns and other hybrid threats targeting the region’s democracies.

Finally, Microsoft will offer prioritised security updates and vulnerability notification and management services to European partners. All participating governments will also receive a dedicated point of contact to coordinate responses and escalate concerns.

Security investment: Microsoft plans to pump additional resources to further its work with governments, civil society bodies and innovators, to strengthen local cyber capabilities and capacity, and improve resilience. It is already piloting a programme alongside the Europol Cybercrime Centre (EC3) to embed DCU personnel at its Netherlands-based HQ to work better together.

Additionally, Microsoft is renewing its existing partnership with the CyberPeace Institute, supporting non-governmental organisations and making more resources available to expand cyber support in eastern Europe via the Western Balkans Cyber Capacity Centre, supporting a geopolitically sensitive and digitally under-resourced part of Europe where malicious actors continue to work to destabilise countries bordering or hoping to join the EU.

More broadly, Microsoft hopes to fund AI security research and innovation, and is already working with the UK Laboratory for AI Security Research, which is supported by Plexal and The Alan Turing Institute, among others, to better support the security of open source development projects, raising the security posture of European projects such as Log4J and Scancode alongside a recently launched GitHub fund.

Expanding partnerships: The final pillar of the ESP will see Microsoft work more closely with law enforcement and regional bodies to identify new and innovative ways to disrupt malicious cyber activity.

Microsoft is already a key player in this regard – only last month, it worked with Europol EC3 on the Lumma infostealer takedown that had compromised nearly 400,000 devices in Europe. On the basis that more of that kind of thing is always a good idea, Microsoft recently launched the Statutory Automated Disruption Programme to automate legal abuse notifications to hosting companies, helping them remove malicious domains and IP addresses quicker. It will also be working with internet service providers on a similar basis.

As part of this expansion, Microsoft will lean more on the DCU, which in recent years has become much more active in running its own legal actions against nation-state threat actors – such as the October 2024 action against Star Blizzard (aka Coldriver), which has seen the group forced to significantly alter its tactics. Smith hinted that more such coordinated disruptions were on the horizon.