Security Copilot embeds generative AI across Microsoft’s security stack, helping defenders investigate incidents, write queries, and respond at machine speed.
Security Copilot combines a security-tuned foundation model with the vast signal corpus of Microsoft’s security products. Analysts ask questions in natural language and receive guided investigations across endpoints, identity, email, and cloud, complete with KQL queries they can inspect and adapt. The system summarizes incidents, drafts remediation steps, and generates reports that would otherwise consume hours of analyst time. Because it integrates with Sentinel, Defender, and Entra, it operates on the telemetry these tools already collect rather than a disconnected dataset. Promptbooks let teams encode repeat investigation procedures, and role-based controls govern what data each analyst can surface. The result is faster triage and a lower skill floor for complex investigations. Microsoft continues to embed Copilot capabilities directly into individual security products, so the assistant appears wherever defenders work rather than as a separate destination. Documentation and learning paths help teams adopt prompt-based investigation steadily, building organizational fluency alongside technical capability.
Security Copilot is licensed through Microsoft enterprise agreements, with pricing based on compute units consumed by investigations. Organizations typically combine it with existing Microsoft security product licensing.
Security operations teams running Microsoft security products who want AI assistance embedded in their existing workflows, and enterprises standardizing investigation processes across analyst skill levels. It is especially compelling for Microsoft-centric environments where signal integration, rather than raw model capability, is the limiting factor in investigation speed. Junior analysts gain a guided path through investigations that once required years of accumulated platform experience.