Netskope is able work with Defender to ensure that one solution has confirmed as valid attack indicators, both know – reducing the time to respond to sophisticated attacks launched against or from endpoint or cloud resources. Netskope does this by automatically exchanging indicators of compromise with Microsoft Defender for Endpoint on a periodic, as-configured basis. Shared indicators include malicious URL, IP addresses used maliciously, and malware filehashes. An additional reduction in the attack surface is brought about by detecting and acting on the presence or absence of the Defender endpoint software for policy decisions, dial the amount of cloud and data access based on the protection posture of the endpoint.