Microsoft Copilot for Security uses AI to accelerate threat investigation, incident summarisation, and policy analysis. Here's what it can do and where it fits in an MSP's security operations.
Key takeaways
- 1Incident summarisation — converts a complex Defender incident with dozens of alerts and events into a plain-language summary of what happened, which systems are affected, and what
- 2Guided investigation — suggests next investigation steps based on the incident context
- 3Script and code analysis — explains malicious PowerShell scripts or macros in plain language
- 4Threat intelligence — queries Microsoft's threat intelligence to provide context on threat actors and attack techniques observed in an incident
- 5Policy analysis — reviews Conditional Access or Intune policies and explains gaps or improvement opportunities
Microsoft Copilot for Security launched in April 2024 as the first AI-powered security operations tool built on GPT-4 and Microsoft's security-specific threat intelligence. Unlike general-purpose AI tools, Copilot for Security is trained on Microsoft's security graph — 65 trillion daily signals from Defender, Entra, Purview, and Sentinel.
What Copilot for Security does
- Incident summarisation — converts a complex Defender incident with dozens of alerts and events into a plain-language summary of what happened, which systems are affected, and what actions have been taken
- Guided investigation — suggests next investigation steps based on the incident context
- Script and code analysis — explains malicious PowerShell scripts or macros in plain language
- Threat intelligence — queries Microsoft's threat intelligence to provide context on threat actors and attack techniques observed in an incident
- Policy analysis — reviews Conditional Access or Intune policies and explains gaps or improvement opportunities
- KQL query generation — generates advanced hunting queries from natural language descriptions
The MSP efficiency impact
Microsoft's early data from Copilot for Security shows experienced security analysts work 22% faster and are 7% more accurate with Copilot assistance. For less experienced analysts, the improvement is even larger — Copilot bridges the skill gap by providing expert-level context for every investigation. For an MSP managing security across dozens of client tenants, this efficiency multiplier is significant.
Current availability
Copilot for Security is currently available as a standalone add-on (priced per Security Compute Unit) and is being embedded progressively into the Defender portal, Purview, and Entra. Optimyze is evaluating its deployment as part of our SOC operations tooling.
