Review: Microsoft Security Copilot Taps Generative AI To Streamline Security

 

The platform is delivered as a service through the Microsoft Azure Cloud and can be tightly integrated with other Microsoft platforms such as Defender XDR, Sentinel, Purview and others. It can also act as a stand-alone product because it incorporates the powerful Microsoft Defender Threat Intelligence feed. But pairing it with other services lets Copilot see more network activities and data points, which can make its responses both more accurate and better tailored to a specific environment.

Microsoft Security Copilot Improves On the Basics

The generative AI that drives the platform is well trained in how computer systems should operate and behave, and what key threats are being levied against them around the world. Users can ask it either general questions about network health or specific ones about an individual attack or incident.

In testing, I found value in asking some general questions: Where are my network’s biggest security vulnerabilities. Which of my users could be insider threats?

After someone poses a question, Copilot can start examining the network and any other security platforms that it’s connected to, pulling in data and examining it, and even ferreting out hidden connections. Users can then receive detailed responses as part of its answer. Copilot’s responses can include text or graphics to help carefully explain a situation, and sometimes even code that can help fix technical issues or solve security challenges.

 

Microsoft Security Copilot Can Respond to More Specifics

For more specific security incidents, Copilot can inform on how a breach or attack unfolded, what the goal of the attack ultimately was, who or what was affected, if any known threat actors were behind it, and how to prevent similar attacks from being successful in the future. It can also provide a summary of an incident and the recommended fixes suitable for sharing with leadership or other team members.

There is even an automation component: Users can set up agents through Microsoft Security Copilot that take automatic actions whenever triggering events occur. For example, a team member can set Copilot to summarize every security incident or perform an impact analysis as events happen. That way, whenever a human analyst has time to review it, all of the reports and recommendations are generated and ready.

Microsoft Security Copilot is not expected to replace human cybersecurity professionals, but it can act as an incredible tool and a force multiplier so analysts can respond to advanced incidents at the speed required, given the increasingly dangerous modern threat landscape. This is especially useful in higher education, where beleaguered defenders may need a highly trained virtual team member that is always on duty.

SPECIFICATIONS

Platform Type: AI-powered security assistant and automation tool
Deployment: Cloud-based Software as a Service via Microsoft Azure Cloud
Number of New Daily Signals Added to Copilot AI: 84 trillion
Supported Microsoft Products: Defender XDR, Entra, Defender for Cloud, Sentinel, Intune, Purview, Defender Threat Intelligence, External Attack Surface Management, Unified Security Operations Platform
Included Threat Intelligence Feed: Microsoft Defender Threat Intelligence