Microsoft Security Copilot, the tech giant's AI assistant for security teams, is now available in early access for qualified customers.
First announced in March 2023 as part of the broader reveal of Microsoft's AI-powered productivity tool, Copilot, Security Copilot is a generative AI security solution enabling businesses' protection with machine speed and scale.
The Early Access Programme includes new capabilities, including a Security Copilot experience residing within Microsoft's extended detection and response (XDR) platform, Microsoft 365 Defender. This embedded offering guides analysts with actionable insights and recommendations through a single unified interface. Microsoft Defender Threat Intelligence is also included with Security Copilot for no extra cost.
"Security Copilot is an AI assistant for security teams that builds on the latest in large language models and harnesses Microsoft's security expertise and global threat intelligence to help security teams outpace their adversaries," wrote Vasu Jakkal, Corporate Vice President of Security, Compliance, Identity, and Management at Microsoft in an accompanying blog.
Security Copilot is already helping our preview customers save up to 40 percent of their time on core security operations tasks with capabilities such as writing complex queries based only on natural language questions and summarizing security incidents. Security Copilot can effectively up-skill a security team, regardless of its expertise, save them time, enable them to find what previously they might have missed, and free them to focus on the most impactful projects."
Additionally, organisations collaborating with Managed Security Service Providers (MSSPs) and in the Early Access Programme can extend access to their Security Copilot environment. This empowers MSSPs to collaborate with them using Security Copilot.
XDR and Threat Intelligence Features in Greater Detail
The complementary integration of Microsoft 365 Defender and Security Copilot minimises the drudge work of security analysis and allows analysts to focus on essential tasks.
For example, an incident can be summarised into natural language to allow security operations teams to understand bad actors more quickly or to share with executives. To further streamline workflows, the integration can inform security analysts of any skill level through cyber threat remediation and response process, thanks to the support of generative AI within Microsoft 365 Defender. This feature critically reduces the time to respond to threats.
Users can also use natural language prompts to simplify hunting for cyber threats and attack techniques or extend existing incidents. Natural language queries can automatically generate Kusto Query Language (KQL) to be more time-efficient and help upskill an organisation's security analysts. Security Copilot also means it's simpler for security analysts to assess and understand complex PowerShell command line scripts and document the flow, producing more accessible real-time malware analysis.
Microsoft Defender Threat Intelligence and access to its API is also now available to every Security Copilot customer with no extra fee.
"Defender Threat Intelligence is a threat intelligence workbench with deep integrations across Microsoft Security products empowering security teams with knowledge of the cyber threat landscape, including actors, tools, vulnerabilities, and infrastructure," wrote Jakkal.
