BT says it now blocks around four million attempted cyber-attacks every day, a figure the UK operator disclosed as it launched a Security Operations Centre-as-a-Service (SOCaaS) offering built on Microsoft Sentinel for British businesses and public sector organisations.

The expanded partnership between the two companies targets a threat environment that Microsoft's Digital Defense Report 2026 says has accelerated sharply. According to the report, the average time between the discovery of a security vulnerability and its exploitation has fallen to well under 24 hours.

BT said the UK-managed service will help organisations detect and respond to cyber threats more quickly, while reducing the complexity and cost of running their own security operations.

What does the deal change for customers?

The service wraps Microsoft's cloud-native Sentinel platform inside BT's managed security operations. BT will contribute its network insights and its experience running security operations at national scale, while Microsoft supplies the detection technology.

For BT Business, the commercial logic is straightforward: UK enterprises and public bodies face AI-accelerated attacks but many lack the in-house teams to monitor them around the clock. A managed offering shifts that burden onto the operator, which already filters millions of intrusion attempts daily across its own network.

BT Business CEO Jon James said: "AI is transforming the cyber threat landscape at unprecedented speed, and our customers need protection that stays one step ahead."

He added: "By extending our partnership with Microsoft, we're combining cutting-edge security technology with BT's cyber expertise and threat intelligence to deliver stronger, more proactive protection. It's the latest example of how we're helping organisations build resilience and defend against the next generation of AI-powered threats."

Vendors frame AI as both weapon and shield

Microsoft UK and Ireland CEO Darren Hardman framed the partnership in similar terms. "AI is increasing the speed, scale and sophistication of cyber threats," he said. "By combining Microsoft Sentinel with BT's managed security expertise and UK cyber operations, we can help organisations simplify security, strengthen resilience and respond with greater confidence."

Both statements are marketing language as much as threat analysis. What is measurable is the underlying data point from Microsoft's report: attackers now exploit vulnerabilities in less than a day, which compresses the window that enterprise security teams have to patch and respond. That compression is the strongest argument for the outsourced, always-on monitoring model BT is selling.

The four-million-per-day figure BT cites covers attacks blocked on its own network, not attacks on the customer base the new service will protect. The distinction matters when assessing the claim, although the number does indicate the volume of hostile traffic a UK-tier operator routinely absorbs.

The launch deepens a security relationship that already existed between BT and Microsoft, and it positions BT to compete with other UK managed security providers at a moment when regulators and government agencies are pressing organisations to raise their cyber resilience.

Neither company disclosed contract values, pricing for the SOCaaS tiers, or customer targets. The service is available to UK organisations from launch, and its uptake will test whether operator-grade threat intelligence proves a decisive advantage in the crowded managed detection and response market.