Hanso Heartbeat — January 2026

Welcome to the first issue of Hanso Heartbeat. The plan is simple: once a month I sit down, look at what actually moved in the Microsoft 365 / Azure / enterprise IT world over the last 30 days, and write up the bits that matter for organisations between five people and five thousand. Not every roadmap entry, not every product reskin — only the items where I’d actually pick up the phone if you were a client. Plus a few stories from the wider world that I just want to talk about.

December 2025: Microsoft Ignite shaped the month, the final Patch Tuesday of the year landed quieter than expected, and the AI calendar refused to take a holiday. Here we go.

---

Microsoft 365 & Copilot

1. Wave 3 of Microsoft 365 Copilot lands

At Microsoft Ignite in mid-November, Microsoft announced what it’s calling Wave 3 of M365 Copilot — and the features started rolling through December. The framing is a deliberate pivot from "assistant" to "embedded agentic capability": Copilot is no longer just a sidebar that drafts text, it now coordinates multi-step work across Word, Excel, PowerPoint, Outlook, and Copilot Chat, grounded in your tenant’s data via Work IQ. Whether the marketing language holds up depends on your specific workloads, but the architectural shift is real. If your organisation has been waiting for "Copilot, but useful," this is the version to pilot in Q1.

2. Copilot Cowork enters Frontier preview

Bundled into the Wave 3 announcements: Copilot Cowork, positioned as the execution layer for long-running, multi-step work — delegate a task, the agent coordinates the workflow, you stay in control. It’s available through Microsoft’s Frontier early-access program. The honest read: this is Microsoft’s answer to ChatGPT’s project mode and Claude’s agentic workflows, ported into the M365 envelope. Worth signing up for the Frontier program if you have technical staff who’ll experiment.

3. Anthropic models enabled by default in M365 Copilot

A quiet but significant change rolled out via MC1193290: Anthropic models are now enabled by default in Microsoft 365 Copilot. Tenants get them in the model picker without admin opt-in. This is the structural move that lets users pick Claude over OpenAI for specific tasks (and which we’ll see expand into Word and Excel over the coming months). If you have a strict data-residency or model-governance posture, your admins should review the default and decide whether to constrain it.

4. GPT-5.2 hits M365 Copilot

In parallel, GPT-5.2 reached priority access in M365 Copilot on December 11 for licensed users, with broad rollout following. It improves code generation and multilingual capabilities — the latter actually matters for our German clients. If you’ve been frustrated by Copilot’s handling of corporate German (the Steuerberater-Deutsch tone, the technical compounds), give it another spin. It’s noticeably better.

5. Work IQ memory: Copilot starts to remember

Work IQ — the intelligence layer underneath Copilot — gained the ability to recall memories from past Copilot conversations across apps. So if you told Copilot last week that "Project Alpha" means the Q4 marketing launch, it remembers next week. This reduces prompting friction but creates a real privacy and compliance question: what is Copilot remembering, where does it live, and can you wipe it on demand? Microsoft’s answer is "in the user’s personalisation settings" — worth verifying with your legal team before broad rollout.

6. Microsoft Publisher to retire October 2026

Long-promised, now confirmed: Publisher will be removed from Microsoft 365 after October 2026. After that, you cannot open or edit .pub files in Publisher. If your marketing team still has flyers and newsletters in Publisher format (and there are more of you than you’d admit), now is the time to migrate the content into Word, PowerPoint, Designer, or PDF before the deadline.

M365 Licensing & Pricing

7. Microsoft 365 E7 (Frontier Suite) announced — GA May 1, 2026

The headline licensing announcement of December: Microsoft 365 E7, the new top-tier suite, becomes generally available on May 1, 2026. E7 bundles E5 + Microsoft 365 Copilot + Microsoft Entra Suite + Agent 365 (the new control plane for managing AI agents). The pitch: a productivity suite for a "human-led, agent-operated enterprise." Whether it’s worth the bundle depends on whether you actually run AI agents at scale, which most enterprises don’t yet. But the licensing chess is real — expect Microsoft account managers to start E5→E7 conversations through 2026.

8. M365 commercial price increase — effective July 1, 2026

In the same announcement, Microsoft confirmed list-price increases across Business Basic, Business Standard, Business Premium, Office 365 E1/E3, and Microsoft 365 E3/E5 effective 1 July 2026. Renew before that date and you lock current pricing. If you have a renewal coming up in the first half of 2026, bring it forward. The "we’ll just renew at expiry" reflex costs you 10–15% for no reason. Hanso clients: we’ll reach out to anyone with renewals between now and August.

9. Security Copilot now included in Microsoft 365 E5

From November 18, Security Copilot is included for E5 customers at no extra cost, along with 12 new Microsoft-built agents across Defender, Entra, Intune, and Purview. Eligible customers get 400 Security Compute Units per month per 1,000 user licenses, capped at 10,000 SCU/month. If you’re on E5 and haven’t turned this on, you’re leaving licensed capability on the table. The agents are limited (Microsoft will expand the catalogue through 2026), but the alert triage and identity-investigation agents alone are worth piloting.

10. Copilot Business SMB bundles with December–March promo

Microsoft introduced three streamlined Copilot Business bundles for SMB customers — Basic + Copilot, Standard + Copilot, Premium + Copilot — with promotional pricing through 31 March 2026: 35% off Standard+Copilot, 25% off Premium+Copilot, 15% off standalone Copilot Business. For German Mittelstand customers under 300 seats experimenting with Copilot, this is the cleanest path. The 50% off Purview Suite for Business Premium add-on, available through the same promo, is the security-forward sibling worth pairing.

Microsoft Security & Patch Tuesday

11. December Patch Tuesday: 57 CVEs, three zero-days, one in active exploitation

Microsoft’s final Patch Tuesday of 2025 addressed 57 CVEs including three zero-days. The actively-exploited one is CVE-2025-62221, a privilege escalation in the Windows Cloud Files Mini Filter Driver — the component that lets cloud sync apps (OneDrive, etc.) interact with the local filesystem. CISA added it to the KEV catalog with a 30 December remediation deadline. Microsoft patched a total of 1,129 CVEs in 2025 — the second-largest annual total ever. Your patching cadence needs to keep up; auto-updates aren’t enough on their own.

12. BlueHammer’s quieter cousin — PowerShell and GitHub Copilot CVEs

The other two December zero-days were both publicly disclosed before the patch dropped: CVE-2025-54100, a PowerShell remote code execution flaw via Invoke-WebRequest that let crafted web pages run scripts in user context, and CVE-2025-64671, a command injection in GitHub Copilot for JetBrains via cross-prompt injection in untrusted files or MCP servers. The Copilot CVE is the more interesting one — it’s the first published example of a class of vulnerabilities that the original researcher (Ari Marzuk) calls "IDEsaster": prompt injections that escape the AI assistant and hit the IDE itself. Expect more of these.

13. Office Preview Pane bugs strike again

Two critical RCEs in Office (CVE-2025-62554 and CVE-2025-62557, both CVSS 8.4) in the December drop, both exploitable via the Outlook Preview Pane. User receives a malicious email, hovers over it in the preview pane, code runs. No click required. The Preview Pane has been a source of critical RCEs almost every month of 2025. If you’re still running Outlook in default configuration with auto-preview enabled, you’re carrying a known-exploited attack surface every month. Worth a Group Policy review.

Azure

14. Premium SSD v2 expands; PostgreSQL Flexible Server gets PgBouncer 1.25

Quieter Azure month, but two updates worth noting: Premium SSD v2 expanded to additional regions (lower IOPS pricing for managed databases), and PgBouncer 1.25.1 reached general availability on Azure Database for PostgreSQL Flexible Server, fixing the long-standing connection-pooling pain point that had teams running it as a sidecar. If you operate Postgres on Azure, the v1.25.1 Flexible Server feature replaces the cobbled-together PgBouncer-on-VM setup most teams had been running.

15. Azure Linux VM heap overflow — CVE-2025-62550

Buried in the Patch Tuesday list: a remote code execution flaw in Azure Monitor Agent running on Linux VMs (CVE-2025-62550, CVSS 8.4 critical). Network-adjacent attacker triggers a heap overflow, escalates to syslog user, executes code. If you run Linux VMs on Azure with Azure Monitor Agent (and most do — it’s the default), update the agent. This is the kind of bug that sits silently in fleets for months because nobody thinks of "update the monitoring agent" as a security task.

Broader Cybersecurity

16. CISA Cisco SD-WAN warning — CVE-2025-20354 active exploitation

CISA flagged active exploitation of a maximum-severity authentication bypass in Cisco Catalyst SD-WAN Controller and Manager. If you run Cisco SD-WAN, patch immediately — same vendor, same product family, same theme that returns in 2026 with renewed urgency. Anyone still on unpatched SD-WAN Manager in 2026 should expect to be in someone’s incident report.

17. The 2025 ransomware year in review

December tied off a record year for ransomware activity. The most notable trend reported in year-end roundups: groups are increasingly skipping encryption and going straight to extortion-only attacks (RansomHouse, ShinyHunters style). Easier to execute, faster to monetise, and crucially harder to recover from because you can’t simply restore from backup — the attacker just publishes your data. Your backup-and-recovery strategy was built for ransomware-as-encryption. Time to update the threat model.

18. The Tycoon 2FA platform’s relentless growth

Microsoft Threat Intelligence noted that the Tycoon 2FA phishing-as-a-service platform reached over 500,000 organisations targeted per month by late 2025. The platform sells phishing kits that defeat standard MFA (SMS, push notifications, OTP) by intercepting the session token after the user completes the real MFA challenge. The fix isn’t more MFA — it’s phishing-resistant MFA: FIDO2 hardware keys, passkeys, Windows Hello for Business. If your 2026 plan doesn’t include rolling out phishing-resistant credentials to every privileged account, you’re betting against the trend.

AI Industry

19. Anthropic donates Model Context Protocol to the Linux Foundation

The most consequential AI infrastructure move of December: Anthropic donated MCP — its open standard for connecting AI agents to tools and data — to the Linux Foundation’s newly-formed Agentic AI Foundation. OpenAI and Microsoft have publicly embraced MCP, Google is building its own MCP servers, and the standard is rapidly becoming the "USB-C of AI." For enterprises, this matters because it means agentic workflows are no longer locked to a single vendor’s protocol. Pick your model, plug into the same MCP servers everyone else is using.

20. Pentagon AI deals — and Anthropic’s exclusion

Reported but only formally landing in the new year: the Pentagon signed AI contracts with SpaceX, OpenAI, Google, Microsoft, Nvidia, AWS, and Reflection — and explicitly excluded Anthropic. The reason: Anthropic refused to allow its Claude models to be used for "all lawful purposes," which would include autonomous weapons. The Pentagon labelled Anthropic a "supply chain risk" — terminology previously reserved for foreign-adversary-linked vendors. Anthropic sued and a federal judge blocked the designation. For enterprises, the takeaway isn’t the geopolitics — it’s that AI-vendor neutrality is now a measurable axis of corporate procurement.

21. OpenAI revenue ~$25B annualised; Anthropic ~$19B

Year-end revenue estimates landed: OpenAI crossed $25B annualised, Anthropic crossed $19B. For context, that’s faster scaling than any SaaS company in history at the same stage. The takeaway: enterprise AI adoption has moved well past the experimental phase. Procurement teams that were still treating LLM spend as discretionary in 2024 should re-baseline as a line item.

Enterprise Software & Industry

22. The "tech layoffs are AI-driven" narrative hardens

Year-end tracker totals: ~245,000 tech jobs cut globally in 2025, ~70% from US-headquartered companies, ~55,000 explicitly attributed to AI. December layoffs continued at Intel, Microsoft, Amazon, Salesforce. The honest read: some of this is genuine AI substitution, some is post-pandemic over-hiring being reversed, some is cover for performance management. Don’t over-index on the "AI did it" framing — but the direction is clear, and the entry-level developer pipeline is being thinned. If you hire developers in 2026, the candidate pool looks very different than it did in 2024.

23. EWS retirement timeline confirmed

Microsoft confirmed the Exchange Web Services retirement plan: phased disablement begins 1 October 2026, permanent shutdown 1 April 2027. Migration target is Microsoft Graph. Most ISVs and integrations have already moved, but if you have legacy line-of-business apps that still call EWS (which is more common than you’d think — older mail-archiving tools, PSA integrations, custom mail processing), 2026 is the year to remediate. The new EWS usage report in the M365 admin centre is the first place to look.

Drei aus Dezember

Three from December I kept circling back to. None of them need anything from you.

24. The Agentic AI Foundation forms under Linux Foundation

Beyond Anthropic’s MCP donation: the Agentic AI Foundation itself is a new entity, formed in December under the Linux Foundation umbrella, with founding contributions from MCP (Anthropic), AGENTS.md (OpenAI), and the goose framework (Block). When competing AI labs jointly contribute infrastructure to a neutral standards body, something real is happening. This is the open-source moment for agents. Worth tracking even if you don’t write code — it’ll shape what your tools can plug into for the next decade.

25. xAI’s Colossus 2 supercluster comes online

Late in December, Elon Musk’s xAI confirmed Colossus 2, reaching full operational capacity at 1.5 gigawatts of compute. For comparison, that’s roughly the power draw of a mid-sized European city, dedicated to training a single company’s models. Whether xAI’s models actually benefit from this scale is an open question (Grok 4 is competitive but not dominant), but the infrastructure race is now visibly a race of physical infrastructure: land, power, cooling, transformer supply chains. The rate-limiting step in AI in 2026 is no longer chips. It’s electrical substations.

26. OpenAI begins quiet IPO preparation

Year-end reporting from multiple outlets (Bloomberg, FT, Reuters) confirmed that OpenAI has begun early-stage preparation for a public listing, potentially as soon as late 2026. The framing was carefully managed — bank meetings, governance review, structural housekeeping — but combined with the $25B annualised revenue figure, the direction is clear. The strategic implication for enterprise procurement: an IPO’d OpenAI is one with quarterly earnings pressure, which historically means more aggressive enterprise pricing, more focus on margins, and more visible behaviour around contract renewals. If you negotiate API spend with OpenAI, the next 18 months are when leverage shifts.

Coming up

A few dates to put in the diary:

• Mid-January: January Patch Tuesday — expect a busier release than December.
• 31 March: Copilot Business SMB promo expires (35% / 25% / 15%). Lock in renewals before.
• 2 February: EU AI Act AI literacy obligations + prohibited-AI rules become enforceable.
• March: Microsoft 365 Public Sector pricing changes — watch if you have public-sector customers.
• 1 May: M365 E7 (Frontier Suite) and Agent 365 GA.
• 1 July: M365 commercial price increase takes effect.

That’s the month. If something here applies to you and you’re not sure what to do about it, hit reply.

Best, Julian

---

How this gets made: end of every month I go through everything I bookmarked or filed during the previous 30 days, keep what’s likely useful for clients or just interesting enough to share, and hand the pile to my AI agent ("Paul") for categorisation and first-draft summaries in my voice. Then I read it all again, fix what needs fixing, and send. Editorial taste and any mistakes are mine.