Microsoft Security Copilot

Microsoft Security Copilot is an AI assistant for security work, sold as part of Microsoft's security tools. Analysts ask it questions in plain English about alerts, threats, and incidents. It can summarize a threat, explain an attack path, and draft an incident report. It plugs directly into Microsoft Defender, Microsoft Sentinel, Entra ID, Intune, and Purview. Some tasks run through built-in agents that handle phishing triage or vulnerability checks on their own. Admins turn it on inside the Microsoft security portal and control who can use it. Microsoft says the tool draws on more than 100 trillion threat signals a day.

This fits a company that already runs Microsoft Defender and Sentinel and wants a small security team to do more without adding staff. A good starting point is a pilot with your security operations group: turn it on for a few analysts first, then expand. Pricing runs on Security Compute Units, near $4 an hour when used standalone; Microsoft 365 E5 customers get a monthly allowance of free compute units. Treat these numbers as planning estimates and confirm current rates with Microsoft. Two things to watch: costs can climb fast if analysts leave heavy queries running, and the tool still needs a trained analyst to check its answers before anyone acts on them. It works best next to your team, not instead of it.