I wanted one picture that answers a simple question: what does each step from E3 to E5 to E7 add to security?

So I mapped the three suites onto Sounil Yu’s Cyber Defense Matrix. The six NIST CSF 2.0 functions run across the top, and asset classes run down the side. I added a sixth row for AI agents, because agents are identities now and they need the same coverage as people.

Pick a tier and watch the grid fill. Select any cell to see the products behind it.

Cyber Defense Matrix · NIST CSF 2.0 × asset classes

What each step up actually covers#

Matrix coverage0%
Cells fully covered0 / 36
Improved by this step-
No coveragePartialFull from E3Full from E5Full from E7Improved by this step
Coverage climb by asset class

Full cell = 1, partial = ½. Segments show what each tier adds to the row.

Platform layer: what makes every cell work together
Acronym glossary (62 terms)

Hover or focus any dotted acronym above for a quick definition. Alt+click one inside a cell to jump here.

Ratings are my simplified, opinionated view for discussion, not a licensing statement. Recover for networks is out of scope for Microsoft 365 suites; Microsoft 365 Backup is a separate purchase. Palette: NOSHIMEHANA 熨斗目花 from Nippon Colors, climbing KAMENOZOKI → NOSHIMEHANA → KON, with AKE marking what is new.

The floor is better than it was#

The 2026 packaging update moved real security down into E3. Defender for Office 365 Plan 1 now protects every mailbox with Safe Links, Safe Attachments, and anti-phishing. Intune Plan 2, Remote Help, and Advanced Analytics fill out device management. And every Entra tenant gets Entra Agent ID, so your agents have identities from day one.

E5 got stronger in the same update. Security Copilot comes with 400 SCUs a month for every 1,000 users. The rest of the Intune Suite is in now: Endpoint Privilege Management, Enterprise App Management, and Cloud PKI. Microsoft threat intelligence, which used to be a separate MDTI Premium license, is built into Defender. And the ISOC preview brings SIEM features into the Defender portal for teams that don’t run Sentinel.

That’s on top of what E5 already did best: EDR, identity threat detection, cloud app security, exposure management, privileged access, and Insider Risk. Click E5 on the grid and Devices, Apps and Email, and Data fill in almost completely.

E7 covers networks and agents#

The Frontier Suite brings together the Entra Suite, Microsoft 365 Copilot, and Agent 365. Watch the bottom of the grid when you click it. The Networks and AI Agents rows finally fill in.

The Entra Suite replaces the VPN with Private Access and filters web traffic with Internet Access. Agent 365 gives agents the same Entra, Defender, and Purview controls that people already have.

That second part matters more than it looks. Agent ID gives an agent an identity, but Microsoft Learn is clear that “Extending Microsoft Entra security features to agents requires Microsoft Agent 365.” Since June 1, 2026, new Agent 365 purchases need Microsoft 365 E5. If you’re on E3 and building agents, start with that row.

Thanks for reading!