Microsoft has released the latest edition of its twice-annual Security Intelligence Report, its survey of the security landscape and threats around the world. The survey has a ton of data about what malware is infecting people, which parts of the world are seeing more attacks, and more.
For the first time, this report includes data that Microsoft has collected from its cloud operations. Azure Active Directory, handling logins for corporate Office 365 customers, has some 550 million users across 8.24 million customers and handles 1.3 billion logins a day. The Microsoft Account system used for consumer products handles more than 13 million logins per day.
This generates a ton of data, and Microsoft uses this data in machine learning systems to build models of what normal user behavior looks like and detect anomalies. Capabilities like this are used in the new Windows Defender Advanced Threat Protection, and today's SIR gives some quantification to them.