Microsoft's AI-powered incident prioritization for its Defender platform is now available in public preview for all customers. The capability, first announced at Microsoft Ignite in November, aims to address a core challenge facing security operations centers: determining which incidents require immediate attention when alerts arrive in overwhelming volumes.
The new feature assigns each incident a priority score from 0 to 100, using machine learning to analyze multiple risk factors and surface the most critical threats. Rather than treating all high-severity alerts equally, the system considers additional context, including automatic attack disruption signals, asset criticality, ransomware indicators, nation-state activity markers, and threat intelligence data.
Microsoft has redesigned the incident queue interface around this prioritization model, color-coding incidents by score range: red for top priority (above 85%), orange for medium (15–85%), and gray for low (below 15%). Analysts can select any incident to view a summary pane explaining the factors behind its ranking, along with recommended actions and related threat information.
- Why Unified Communications Is Your Next Big Security Blind Spot
- Unified Communications Compliance 101: Are Your Chats Really Governed?
How the Enhanced Prioritization Model Works
The Defender platform already aggregates related alerts and automated investigations into unified incidents, correlating activity across multiple products and data sources. This consolidation helps analysts understand attack narratives rather than chase isolated alerts. The previous prioritization approach relied on alert severity levels, tags, and MITRE ATT&CK technique classifications to rank incidents.
Microsoft has now expanded this foundation with additional high-signal inputs designed to provide more accurate risk assessment. The enhanced model incorporates automatic attack disruption signals that indicate active threat activity requiring immediate response. It evaluates asset criticality to elevate incidents affecting high-value systems and infrastructure. The model also flags high-profile threats such as ransomware campaigns and nation-state operations based on current threat intelligence.
Importantly, this prioritization works across signals from Microsoft Defender, Sentinel, and custom alerts created by security teams. This unified approach ensures consistent priority assessment regardless of which tool or sensor detected the activity. It also eliminates gaps that can occur when different systems use different prioritization logic.
The explainability component transforms the priority score from an opaque number into actionable intelligence. When analysts select an incident row in the queue, the summary pane displays the specific factors that influenced the ranking. This transparency helps security teams understand the system's reasoning, build trust in the recommendations, and make consistent triage decisions across shifts and team members.
Addressing the Growing Strain on Security Operations
This release comes as organizations face mounting pressure from escalating cyberattack volumes, increasingly fueled by AI-enabled threat actors. Attackers now leverage automation and machine learning to launch campaigns at unprecedented scale and speed, generating massive alert volumes that can overwhelm traditional security operations center workflows.
