• Microsoft is boosting cybersecurity help for European governments.
• The program offers AI insights, early warnings, and support against state-backed attacks.

Microsoft has launched a new initiative aimed at helping European governments strengthen their defences against cyberattacks, particularly from state-backed groups.

The European Security Program builds on the company’s existing Government Security Program, which is already available at no cost to EU member states, countries in the European Free Trade Association, and others including the UK, Monaco, and the Vatican.

The move comes as Microsoft continues to see frequent cyber activity linked to Russia and China, with some attacks also coming from actors in Iran and North Korea. According to the company, these groups are mainly focused on spying, often using stolen credentials or known software flaws to get into both corporate and government networks.

AI adds new risks—and new defences

Artificial intelligence is now a tool used by both sides in cyber conflict. Microsoft says it’s seeing threat groups use AI to scout targets, write scripts, avoid detection, and even run social engineering attacks. In response, Microsoft has stepped up monitoring of how its own AI tools are being used and blocks access to those known to be involved in malicious activity.

The new program centres on using AI to detect and stop attacks faster. Countries enrolled in the program will receive real-time AI-generated insights, as well as access to Microsoft’s internal threat intelligence from its Digital Crimes Unit and Threat Analysis Center.

The company will also provide updates on disinformation campaigns using deepfakes and give early warnings about newly discovered security flaws, along with advice on how to address them.

Teaming up to fight cybercrime

The program places a strong focus on working with others to respond to threats. Microsoft has started a pilot with Europol’s European Cybercrime Centre (EC3), placing its own investigators at EC3’s office in The Hague. The goal is to improve information sharing and speed up joint operations to stop cybercriminals targeting European institutions and people.

Microsoft is also continuing a three-year partnership with the CyberPeace Institute to support non-profits. Around 100 Microsoft employees are volunteering their time to help these organisations stay safe online. This includes tracing ransomware attacks and investigating links to government-backed groups.

In the Western Balkans, Microsoft is teaming up with the Western Balkans Cyber Capacity Centre (WB3C) to help countries in the region build stronger cybersecurity systems. The effort is meant to support nations near the EU that have long faced digital threats but lack the resources to respond effectively.

Supporting research and secure development

To help tackle future threats, Microsoft is putting more resources into AI-focused security research and training. It’s working with the UK’s Laboratory for AI Security Research (LASR) to study how AI can be safely used in areas like critical infrastructure. The two groups are launching a joint research program on cybersecurity risks tied to more advanced AI systems.

Microsoft is also backing open-source projects with the GitHub Secure Open Source Fund. The idea is to improve the security of tools that power government and business systems, especially those important to the AI supply chain. European projects like Log4J and Scancode are among those being supported to help reduce the risk of future vulnerabilities.

Action against malware

One recent case that shows the company’s approach is its role in disrupting the Lumma info-stealer malware. The operation, which took place over two months, targeted a tool that had infected nearly 400,000 devices—many of them in Europe. Microsoft and its partners were able to block or take down more than 2,300 domains used to control infected systems.

The malware had hit systems in several European countries, including Spain, France, Poland, Germany, Italy, and the UK. Following the takedown, Microsoft is working with Europol to keep the momentum going and look for ways to further weaken cybercrime operations.