Stairway to DAX and Power BI - Level 29: The DAX Combine & Aggregate Functions (2026-10-28)

• Stairway to DAX and Power BI - Level 29: The DAX Combine & Aggregate Functions
• Take the 2027 State of the Database Landscape Survey
• From the SQL Server Central Blogs - A Pursuit of Lifelong Learning
• From the SQL Server Central Blogs - Announcements from the Microsoft Fabric Community Conference — Barcelona 2026
• Microsoft Power BI Performance Best Practices: Learn practical techniques for building high-speed Power BI solutions Microsoft Power BI Performance Best Practices

• SQL Server 2025 Server-level Roles

AI Is Improving Security

I was updating the SQL Server build lists the other day. I typically get a notification from Microsoft when new builds are released. This is something that happens every month as a new CU appears. For the older versions (2022, 2019, 2017), we get a CU every other month. Since SQL Server 2025 is new, we're getting a CU a month, which will slow down next year. However, I've also seen this for the versions:

• Oct 2026 - GDR
• Sep 2026 - GDR
• Jul 2026 - GDR
• May 2026 - GDR
• Apr 2026 - GDR
• Mar 2026 - GDR

That's a lot of out-of-band patches. In the last decade of SQL Server, there have been relatively few GDRs. Often the main CU comes a day or two later (or a month later for older versions). If you react and start to plan patching, you might find yourself trying to decide if you apply CU9+GDR or wait for CU10, or do both.

There have been few GDRs in the last , but before that, relatively few: three in 2025, two in 2024, and two in 2023. I suspect that AI is being used to discover bugs in existing software, and this is forcing Microsoft to perform remediation work. Brent posted a similar thing, noticing a large number of security fixes and speculating that AI is finding issues.

That's good, right?

Or is it? If Microsoft can find security issues, can't malicious actors? Including nation-state-sponsored hackers? I'm not even sure that Microsoft is finding most of these, as there are lots of CVE issues, which can be discovered by anyone and sent to Microsoft. This might be to obtain a bug bounty payment, as Microsoft and other vendors will pay security researchers.

Or it could be that a hacker finds an issue and exploits it. A customer then notices an issue and reports a problem to support. Microsoft realizes there is a vulnerability, works on a fix and reports the issue to the CVE database.

AI is great for security, as it can scan software and look for known issues. We have decades of security bugs that have to be included in the frontier LLM training, so using AI to scan your code is a good idea. I am sure code scanning tools are adding AI review to their systems. I'm also sure those vendors are worried you'll use AI on your own to scan code and find your own issues.

You can do that, but ensuring your AI does a good job scanning isn't necessarily easy. Or fast. Deterministic systems, like SonarQube and Flyway can find code issues quickly, in a deterministic fashion, and likely with less cost than AI. That's not to say AI doesn't have a place, but it's likely an out-of-pipeline review that takes place less often than every CI build.

Security is a constant battle, and it's hard. The age of AI makes it easier and harder (and more expensive) to manage security, but I think that's a good thing. We're seeing lots of vulnerabilities, but also more patches. Perhaps the better outcome is that there is more awareness and focus on security from vendors who now know if they don't scan their code carefully, someone else will. Perhaps someone they don't want finding issues.

Steve Jones - SSC Editor

Join the debate, and respond to today's editorial on the forums

Bill Pearson from SQLServerCentral

Business Intelligence Architect, Data Analyst, CPA, and author Bill Pearson continues a subseries surrounding the DAX Text Functions, and breaks out the next operational group within Text functions, the “Combine and Aggregate Functions” group, including the CONCATENATE(), CONCATENATEX, and COMBINEVALUES() functions as the focus of this Level. He identifies and examines each functional member of this “Combine and Aggregate” group, discussing for each its respective syntax, uses, and operation, while providing hands-on exposure to it in Power BI.

Press Release from SQLServerCentral

Share your view on the database landscape and you could win USD$500.

K. Brian Kelley from Databases – Infrastructure – Security

The following came across my YouTube feed today. It’s an interview with General James Mattis, USMC, Retired, talking about lifelong learning, the expectations of learning in the Marine Corps,...

James Serra from James Serra's Blog

Microsoft shared a broad set of Fabric, Power BI, and SQL updates at FabCon and SQLCon Barcelona 2026, with approximately 5,000 attendees at the conference. I’ve tried to make...

Steve Jones - SSC Editor from SQLServerCentral

In a world dominated by data, organizations heavily rely on business intelligence tools like Power BI for deriving insights and informed decision-making. Yet, as data volumes grow and user demands increase, achieving optimal performance becomes challenging.

Today's question (by Steve Jones - SSC Editor):

Think you know the answer? Click here, and find out if you are right.

Here's a few of the new posts today on the forums. To see more, visit the forums.