Windows has adapted to emerging threats for decades, all while operating at unparalleled scale. It's our responsibility to bring clarity, transparency and sustained investment so customers understand what is happening, what Microsoft is doing and how they can reduce their exposure. The pace of vulnerability discovery is changing with advances in AI making it possible to find more issues, faster, across more code, with new mechanisms that can accelerate both discovery and analysis. The fastest way to reduce customer exposure is to find issues before attackers can use them. Windows is expanding its ability across the platform to find issues earlier, accelerate the engineering work to fix them, strengthen validation and deliver timely, high-quality updates that keep customers protected.

Finding vulnerabilities earlier and at greater scale

By applying AI across security analysis, we can identify patterns faster, prioritize risk and scale vulnerability discovery across the Windows codebase. This helps reduce the time between discovery and customer protection. It includes using Microsoft Security’s multi-model agentic scanning harness (MDASH), which utilizes multiple models including leading third-party AI vulnerability discovery models. To run MDASH at Windows scale, Windows set up dedicated cloud infrastructure for scanning and proving. A scanner pipeline scans critical binaries and validates candidates using multi-model debate across multiple model families. Confirmed candidates then flow to a separate, Windows-specific prove pipeline that helps eliminate remaining false positives, so only the highest-confidence findings reach the engineering team. This automation helps handle a larger volume of potential vulnerabilities and shortens the review window for new ones, shrinking the attack window for zero-day exploits. This effort extends beyond Windows as we work across Microsoft to drive broader adoption of these tools and practices throughout both the company and the wider ecosystem. We partner closely with AI-powered scanning teams across Microsoft’s product divisions, sharing insights, comparing best practices and aligning on key findings. In parallel, we collaborate with the Microsoft Security Response Center (MSRC) to continuously refine the end-to-end process from vulnerability discovery and issue filing to remediation and validation. We also regularly reassess our prioritization and rollout strategy based on lessons learned and feedback gathered through our Chief Information Security Officers’ (CISOs) engagements with customers. We continue to evolve our internal systems and practices so that vulnerability discovery is not treated as a separate activity, but as part of how we build, review and improve Windows before new features or updates are released. As a part of this we are updating our Secure Development Lifecycle (SDL) best practices to ensure our secure-by-design approach explicitly accounts for potential AI-enabled attack techniques and exploit paths. That means using AI to help identify potential issues earlier in the development process, while relying on human expertise to evaluate findings, make risk-based decisions and ensure fixes meet the quality bar customers expect. As AI helps defenders discover more issues, customers will see a higher volume of security updates included in each security release. This is evidence that defenders are getting better at identifying and addressing issues. Our focus is to effectively utilize these AI tools to support faster protection, stronger engineering systems and more actionable guidance for customers.

Fixing responsibly with AI and engineering discipline

Windows is evolving our engineering and validation systems to reduce the time from discovery to protection, with areas where customer risk is greatest. As we build our end-to-end system from discovery to remediation of vulnerabilities on Windows, we’re making the following investments to help ensure that we are not compromising update quality as we gain speed:

• We are integrating AI into our process to compress the path from discovery to a validated fix, helping engineers understand failures faster, propose candidate fixes consistent with the surrounding code, surface related issues elsewhere in the codebase and select the regression tests most likely to be affected by a change.
• Windows updates undergo validation across a range of testing environments, including the Security Update Validation Program (SUVP) and internal validation designed to help evaluate compatibility, reliability and real-world usage scenarios. This broad validation helps identify functional, application compatibility and quality issues before updates are broadly released.
• We’re also investing in new technology, including Windows-specific tools and agentic harnesses, to enable end-to-end generation and validation of fixes using AI, keeping humans in the loop when it comes to code review.

Customers rely on Windows updates to protect their environments, and they also need confidence that updates will deploy smoothly across diverse devices, applications and configurations. That is why quality remains central to this work. As we increase the pace of vulnerability discovery and remediation, we are also committed to giving customers practical ways to test, deploy and monitor updates in their own environments. In cases where customers see signals of potential issues or regressions, they can connect with Microsoft Customer Service and Support to report the issue and/or learn if it is a known issue. In the event of an issue, we are able to employ Known Issue Rollback (KIR), a mitigation technology that allows customers to quickly revert a targeted change, fix, functionality or feature that caused the problem, to its previous behavior. This approach allows the customer’s security protections to stay in place instead of uninstalling an entire update to fix an issue.

Helping customers safely stay current

The most important guidance is to stay current and take security updates as soon as possible. Timely patching is one of the most effective ways to reduce exposure, especially as AI accelerates the speed at which vulnerabilities can be discovered and exploited. We also recognize that every customer's situation is different. Many organizations need to assess risk, validate updates, sequence deployments and prioritize critical assets. When Microsoft releases security updates, we share Common Vulnerabilities and Exposure (CVE) information and high-level guidance about the vulnerabilities addressed in the Security Update Guide, including available context on risk and mitigations where applicable. Customers should use that information to build a risk map for their own estate, prioritize protections for high-value targets and accelerate deployment where exposure is greatest. To help organizations prepare with less disruption, we also provide production-quality optional non-security preview ("D") releases ahead of the planned security update release for the following month for testing. These cumulative releases include new features and quality improvements. We target optional non-security preview releases for the fourth week of the month, two weeks before they'll see these features become part of the next monthly security update. These previews enable compatibility testing across a broad set of devices, applications and environments, helping identify issues earlier and increasing confidence in the quality and deployment readiness of the subsequent monthly security updates. Security is not just about responding faster to vulnerabilities. It is also about reducing exposure to security attacks. Windows is designed with multiple layers of protection enabled by default, strong identity protection with Windows Hello, the ability to reduce reliance on administrator privileges, trusted application experiences and hardware-rooted security. Together, these capabilities help organizations reduce exposure, strengthen resilience and provide a more secure foundation as organizations assess, test and deploy updates across their environment. To learn more about Windows security, see the Windows 11 Security Book or the Windows Server 2025 Security Book for your Server fleet. Windows also works closely with Microsoft Defender and the broader security ecosystem to help protect customers during the window between vulnerability disclosure and full deployment of security updates. Where possible, Microsoft Defender provides detections and protections that add another layer of defense. Through programs such as Microsoft Active Protections Program (MAPP), Microsoft also collaborates with security protection and antivirus partners so they can prepare protections for customers as security updates are released. We recommend that customers update their security endpoint software to the latest version and take daily signature updates for best protection. Intune helps teams identify gaps, enforce compliance and deploy fixes across endpoints, and Azure Arc makes it easy to connect Windows Servers outside Azure to Microsoft Defender for Cloud.

Tools that make patching easier

A holistic patch strategy depends on tools that help teams move across the full lifecycle: automate what can move fast, identify what still needs attention and limit exposure when devices or apps fall behind. Modern management capabilities such as Windows Autopatch with hotpatch enabled, available in Microsoft Intune, can help accelerate security updates and minimize disruptions for your Windows 11 devices. With Autopatch, customers can configure the automatic deployment of Windows security updates, driver updates and firmware updates, across rings with the option to pause based on reliability signals, so issues can be contained before they spread. Autopatch now surfaces a security-risk and compliance overview with device-level drill-down, so customers can see where their estate is exposed and how to reconfigure their policies to stay more secure. Windows Servers can be hotpatched as well through Azure Arc, enabling rebootless security updates for your critical infrastructure and VMs across the fleet, manageable at scale with Azure Update Manager. Intune Enterprise Application Management helps keep apps current. Microsoft Defender Vulnerability Management, Windows and Intune insights help teams understand remaining exposure and prioritize remediation. Compliance policies, Conditional Access and security baselines help enforce the desired state across the endpoint estate, or harden devices when updates can’t be applied right away. Together, these capabilities help customers move from a time-based patching cadence to a more continuous, risk-based approach. For practical guidance on operationalizing patching across endpoint estates, see the Microsoft Intune blog on building a patch strategy for today’s threat pace. https://www.youtube.com/watch?v=QdjSkbKXoJw

Building trust through continuous improvement

The threat environment will continue to evolve as AI advances, with researchers continuing to find new classes of issues and attackers looking for ways to move faster. Our response is to keep strengthening the systems that help us find vulnerabilities earlier, fix them responsibly and support customers through safe, timely updates. As the pace of vulnerability discovery increases, customers shouldn’t have to choose between speed and stability. Our job is to help customers stay protected while deploying updates with confidence. Windows will continue investing in the systems, engineering practices and platform protections needed to reduce exposure responsibly at global scale.

Today at NVIDIA GTC, Microsoft and NVIDIA announced the world’s most powerful and efficient thin-and-light Windows PCs ever. Accelerated by NVIDIA RTX Spark, these new PCs unlock incredible momentum for developers, creators and power users, and are purpose-built for the new wave of agents. This marks a key milestone in the rich, full‑stack collaboration between Microsoft and NVIDIA spanning gaming, AI and cloud – from DirectX and RTX to NVIDIA‑accelerated AI workloads on Azure – driving end-to-end innovation for our shared customers. These next-generation Windows PCs represent the next step on that journey. Builders and creators today are reimagining how things get done, and they need reimagined hardware, silicon and platform capabilities to support them. They need PCs capable of running graphically intensive tasks efficiently, highly capable AI models, and a platform that simply and securely runs agents locally. It’s the combination of Windows’ platform and ecosystem leadership, with NVIDIA's silicon innovation and industry-leading graphics and AI leadership, that has resulted in a collection of powerhouse laptops that will redefine how developers and creators interact with their PCs.

“NVIDIA and Microsoft share a vision that agents are the future of personal computing,” said Jeff Fisher, senior vice president of personal computing at NVIDIA. “RTX Spark combines NVIDIA's full technology stack with Microsoft Windows and is purpose-built for creators, gamers and AI developers in the personal AI era.”

Taking Windows to the next level on RTX Spark

RTX Spark delivers 1 petaflop of AI performance, industry-leading performance-per-watt, full stack NVIDIA AI and RTX graphics technology, with up to 6144 Blackwell RTX cores, up to 20 power-efficient cores built with the Arm architecture and up to 128GB of unified memory. Paired with Windows, it unlocks the capabilities creators and developers need to run advanced workloads, build with the tools they depend on and even play their favorite games. Bringing Windows to RTX Spark enables you to do the work that matters on silicon that delivers the performance you demand. Great silicon deserves deep platform work. We optimized Windows to bring out the full performance of RTX Spark.

Performance and power management

To get the most out of Windows on RTX Spark’s powerful, heterogeneous architecture, we implemented workload profile scheduling (WPS) and optimized it for RTX Spark, enabling the Windows scheduler to more efficiently scale workloads across all 20 cores. Whether you’re checking your email or running an agent locally to debug code, the Windows scheduler on RTX Spark will ensure you get the best performance and efficiency out of your CPU. We also worked with NVIDIA to enable the Microsoft Power and Thermal Framework (MPTF) on RTX Spark, to maximize performance and power on the go. MPTF standardizes one of the most complex parts of a modern PC and will enable RTX Spark based PCs to deliver industry-leading power efficiency while staying cool under intense workloads. Beyond its industry-leading performance per watt for creative, AI and gaming workloads, RTX Spark is positioned to take advantage of our advancements to DirectX 12, including support for neural rendering and optimized ray tracing performance, and has been tuned to maximize the performance of its Blackwell GPU, making it one of the best places to play on Windows. In addition, Microsoft and NVIDIA have worked to unlock the power of the GPU for local AI workloads through Windows ML, enabling AI developers to leverage TensorRT natively in Windows.

Unified memory optimizations

To realize the potential of up to 128GB of unified memory on RTX Spark, we have focused on improving how Windows supports unified memory systems, starting with a new higher, smarter limit on total system memory accessible by the GPU. This updated limit increases the memory available to the GPU on high-memory systems, unlocking the ability to load larger local AI models or render more complex projects. Memory intensive workloads across powerful creator apps, AI workloads and games put a variety of demands on the system and require a versatile memory system to achieve peak performance.  In addition to increasing the memory available to the GPU, we are also enhancing how Windows manages page sizes in shared memory regions on unified memory systems.  These changes ensure that larger memory pages are available for greater performance on heavier workloads, while giving developers the flexibility to optimize for the needs of their memory workloads between CPU and GPU.

Prism emulation enhancements

Prism, our emulator for running 32-bit and 64-bit x86 apps on Windows on Arm, will also be present and optimized for RTX Spark powered PCs.  Prism ensures apps run well on these devices even if those apps haven't been built for the Arm architecture. We have continued to enhance the Prism emulator with additional performance and compatibility features, building on the Prism optimizations delivered last year that added support for the AVX/AVX2 instruction set extensions. Prism has been tuned for the microarchitecture of RTX Spark and when combined with the raw power of the silicon, unlocks great performance for developers, creators and gaming workloads running under emulation.

Windows quality investments

This year, we've been laser focused on raising the bar on performance, reliability and craft across Windows 11. As the Windows foundation strengthens, we are also pushing forward on this next era of Windows computing and delivering meaningful improvements to system performance that will benefit all Windows 11 PCs including these new PCs powered by RTX Spark. This includes changes like more fluid and responsive app interactions by moving many core Windows experiences to the WinUI3 framework and elevating the Windows Subsystem for Linux (WSL) experience, along with baseline reliability improvements across the operating system and more control and personalization, including alternate taskbar positions. These quality-focused updates will continue to roll out throughout the year.

Delivering a better platform for agents with Windows on RTX Spark

This week at Microsoft Build, you will see how we are optimizing the Windows platform for building and running agents securely with OS-enforced identity, containment and manageability. With a powerful GPU and up to 128 GB of unified memory, RTX Spark will be great hardware to build and run agentic workloads locally, with security and containment features designed to help protect users. NVIDIA is bringing NVIDIA OpenShell to Windows, built on new Windows security and containment primitives. Hermes Agent and OpenClaw will be integrating OpenShell and these new Windows primitives inside of their Windows application. This enables customers to run agents and integrate them into developer and creative workflows, with the performance headroom to reason over large contexts without round-tripping to the cloud. Control is a fundamental principle for AI on Windows. You choose when and how agents act on your behalf, with controls to help provide visibility into what they can access.

Enabling the Windows ecosystem for RTX Spark

From the app developers optimizing their software for this architecture, to our OEM partners building these new powerful PCs, the Windows ecosystem has come together to ensure RTX Spark delivers a complete, performant experience from day one.

App ecosystem growth

Silicon and OS optimization matters, but what you can actually run on the device is what customers experience. We have partnered across the ecosystem to ensure these new PCs powered by RTX Spark will launch with broad application support. Over the last two years, Microsoft and NVIDIA have worked with a breadth of app developers to make significant advancements to optimize the apps people want and rely on for Arm-based devices. As a result, PC users on RTX Spark will immediately benefit from an expansive ecosystem of native and performant apps. For creatives, top tools like Blender, DaVinci Resolve, Maxon Cinema4D, Maxon Redshift, Topaz Photo, CapCut, Cubase, Bitwig Studio, Affinity by Canva and more all run natively on Arm today, as do the audio, video, MIDI and control peripherals they require. Adobe’s flagship applications including Photoshop and Premiere are likewise native, and have partnered with NVIDIA and Microsoft on additional optimizations for the RTX Spark. Apps for technical creators are also optimizing for this platform, including MATLAB, one of the most popular, which now officially supports Windows on Arm via Prism. Across apps, RTX SPARK can unlock new capabilities and speed for workflows like video compositing, rendering complex 3D geometries, or using the latest AI-driven tools for content analysis and transformation. Game developers have also laid a strong foundation for RTX Spark’s arrival. Today, anti-cheat solutions from partners like Epic’s Easy Anti-Cheat and BattlEye, expanded Prism emulator compatibility, and XBOX PC app support means players will have access to a deep catalog of Windows PC games. RTX Spark will bring even higher levels of gaming performance to AAA titles on Arm. Riot Games, one of the world’s leading game developers and publishers, has confirmed that League of Legends and VALORANT are coming to the platform. PUBG: Battlegrounds, the iconic battle royale title from KRAFTON, will also be joining the expansive catalog of compatible titles including PRAGMATA, Alan Wake 2, Naraka: Bladepoint, War Thunder and more. Top agentic and AI developer workloads like GitHub Copilot, Claude Code, ComfyUI, Cursor and more now run across all modern PC silicon – making Windows the ideal platform for AI-assisted development, or for leveraging the power of the GPU to train, optimize and evaluate models. For developers, our partnership with NVIDIA on RTX Spark plans to bring additional exciting technologies like CUDA-accelerated PyTorch, Ilama.cpp, TensorRT, Hugging Face frameworks, Unsloth, Kohya and more.

PC ecosystem adoption

Windows and RTX Spark bring to life the most powerful and efficient thin-and-light PCs with all-day battery life¹, optimized for developers and creators who need to trust that they can power through advanced workflows, in a portable package. These PCs will join the Copilot+ PC category, with powerful NPUs for local AI processing in addition to the GPU, unlocking rich AI-powered experiences. Beginning this Fall, RTX Spark will power a full range of Windows laptops and small form factor desktop PCs, starting with Microsoft Surface, ASUS, Dell, HP, Lenovo and MSI.

Introducing Surface Laptop Ultra

Surface Laptop Ultra. Built for world makers and creative pros, Surface Laptop Ultra brings cutting-edge AI performance into a thin, precision-engineered laptop designed for sustained high performance. From rendering to compiling to local AI workflows, this is uncompromising craft meets raw power – a new kind of performance for the people who create what's next. To learn more, visit the Devices blog by Brett Ostrum, Corporate Vice President, Surface. We are also proud to support the announcements of our PC partners:

• ASUS: The ASUS ProArt P16 and ASUS ProArt P14 combine powerful AI performance with slim and lightweight designs built for creators on the go. Available in 16-inch and 14-inch models with elegant Nano Black and new Neo White color options, the laptops feature ASUS Lumina Pro OLED displays and exceptional all-day battery life for premium creative experiences anywhere.
• Dell Technologies: The XPS 16 Creator Edition delivers serious GPU power built for creative work with smoother playback on 4K timelines, faster exports and a more seamless experience with AI tools. The Tandem OLED display with True Black HDR 600 ensures your visuals look exactly as intended. Add in a built-in SD card reader and HDMI port, and you've got a machine that's as capable in the field as it is back at your desk.
• HP Inc.: The HP OmniBook Ultra 16and HP OmniBook X 14 laptops are built for creators, gamers and AI developers, providing powerful local AI performance and experiences that help users accelerate workflows.
• Lenovo: The Lenovo Yoga Pro 9n marries Lenovo Yoga's creator-focused features with NVIDIA's newest chip to deliver a laptop that is portable, powerful and can last for extended periods away from an outlet.
• MSI: The Prestige N16 Flip AI+ combines a premium thin-and-light 2-in-1 design, a 16-inch UHD+ Tandem OLED display, NVIDIA AI acceleration and a 99.9Wh battery. It delivers immersive visuals, advanced AI experiences, and exceptional mobility for creators, professionals and gamers.

We can't wait for developers and creators to experience what's possible when stunning graphics, incredible performance and cutting-edge AI come together in these powerful, portable PCs.

Scaling the power of Windows to NVIDIA DGX Station

Today's announcement is an important step on our journey to unleash the full power of Windows to NVIDIA silicon, from powerful laptops to data center class workstations. Together with NVIDIA, we’re scaling Windows from RTX Spark through to DGX Station for Windows, up to a trillion-parameter AI supercomputer powered by the NVIDIA GB300 Grace Blackwell Ultra Desktop Superchip, later this year. This unlocks breakthrough AI performance on Windows, the platform enterprises trust for manageability, security and compatibility, with seamless access to the Linux AI ecosystem through Windows Subsystem for Linux (WSL). With NVIDIA GB300‑class capability on Windows, we are making a step‑function leap in performance, fundamentally changing where advanced AI work can happen – enabling developers and organizations to run frontier‑class models and agentic workloads locally that were previously primarily available in the cloud or data centers. Pairing the GB300 Superchip with an additional NVIDIA RTX PRO™ Blackwell Workstation GPU enables developers to combine frontier AI compute with ray-traced visualization and simulation in a single deskside system — delivering the performance needed for agents to perceive, simulate and interact with the physical world. By bringing AI on‑device, organizations can keep data close and shape how it’s used to meet their own compliance and data boundary requirements, complementing cloud workloads. This shift opens new possibilities, lowers the barrier to experimentation, and makes unmetered, always‑available AI compute a native part of Windows workflows. We are building toward a future where Windows provides a unified foundation for AI, from the device in your hands to the infrastructure behind it. Stay tuned over the next couple of days. We look forward to sharing more on our vision of Windows for developers at Microsoft Build. ^{1 Based on internal testing of pre‑release units. Battery life varies significantly based on usage, settings and other factors.}