New autonomous AI agents

About a year ago, Microsoft introduced Security Copilot, an AI-powered tool that supports security analysis and threat prevention. By consolidating and analysing data from various sources, it enables precise and efficient threat prevention. Now, the next evolutionary stage has been announced in the form of autonomous AI agents, each specialising in phishing, data security and identity management. This will reduce the workload for security managers and provide them with more effective support against cyber threats.

Phishing Triage AgentThe Microsoft
Defender Phishing Triage Agent independently evaluates phishing alerts and distinguishes real threats from false alarms. It continuously optimises itself based on feedback from administrators.

Alert Triage AgentsMicrosoft
Purview analyses data loss alerts, prioritises incidents according to their criticality, and uses administrator feedback to improve results.

Conditional Access Optimisation
AgentMonitors users or applications that are not protected by policies, identifies necessary updates to fix security vulnerabilities, and proactively recommends solutions that the responsible administrator can implement with a single click.

Vulnerability Remediation AgentAutomatically
identifies vulnerabilities and optimisation opportunities to improve security. Prioritises challenges in app configurations and policies. Accelerates the installation of Windows patches after approval by the responsible administrator.

Threat Intelligence Briefing AgentSecurity
analysts save time with automatic reports on the organisation's threat status from the agent.

A sneak preview – Security Copilot agents at work
Microsoft Security Copilot agents – YouTube

Expanding capabilities through partner solutions
Microsoft plans to integrate agents from partners into Security Copilot. One example of this is the Privacy Breach Response Agent from OneTrust. This evaluates a data breach based on the data type, geographical jurisdiction and regulatory requirements in order to provide the data protection department with appropriate guidance on how to meet these requirements.

When and to whom are the agents available
? Microsoft Security Copilot agents have been available as a preview since April. If you already use Copilot for Security, sign up for the Copilot Customer Connection Programme (CCP). Everyone else can schedule an orientation meeting to see if Copilot for Security offers value to your organisation or what alternative options are available to maximise your attack surface reduction.

Conclusion

According to many experts, the future of IT security lies in autonomous agents. Microsoft is setting an important milestone with its new Security Copilot Agent. This allows us to use AI to detect and ward off threats more efficiently. This innovation takes the pressure off security managers and allows them to concentrate on strategic measures. In times of skills shortages and an increasing number of attacks on companies, this is a welcome support.

Our team of experts will examine whether the promises and the first preview version are already ready for practical use. We will report back promptly.