Read in   

Today’s business security landscape

Security operations are now facing many challenges. The main ones are:

• Disparate security toolset
• Siloed technologies and apps
• Scarcity of skilled security talent

That is why for a while now, organization have been investing their money and assets in traditional AI and machine learning. This has improved threat intelligence and risk management. However, with the cybercrimes being on the rise, it is time for security industry to step up. The call for more innovative and effective security measures is also highlighted clearly by trends seen in past years. The evolution of hybrid work model, increased adoption of security measures, cloud-native development and multicloud environments as well as macroeconomic conditions – all speak in favor of enhanced security solutions for business across the world. Organizations need an innovative solution that can prevent, detect and disrupt cyberattacks at machine speed. At the same it, the mechanism needs to be as simple as possible to use, approachable and intuitive so that security teams can move faster.

New era of security operations

Microsoft has recently announced first generative AI-powered unified security operations platform with built-in Copilot. It brings together Microsoft Sentinel, Microsoft Defender XDR (previously Microsoft 365 Defender), and Microsoft Security Copilot.

This is a major step forward for business security. This platform combines:

• Security information and event management (SIEM)
• Extended detection and response (XDR)
• Generative AI for security

What does this step-up change mean for security analysts?

• Unified incident experience

End-to-end view of threats

• Easy and quick coordination of response

Thanks to single set of automation rules and playbooks supported with generative AI

• Accurate cyberthreats detection and remediation actions

Thanks to ability to query all SIEM and XDR data in one place

Microsoft Security Copilot now brings together signals across Microsoft Purview, Microsoft Entra, Microsoft Intune, Microsoft Sentinel, Microsoft Defender and Microsoft Defender for Cloud.

• Securing and governing your data – Microsoft Purview

Security Copilot embedded in Microsoft Purview offers capabilities within: Microsoft Purview Data Loss Prevention, Microsoft Purview Insider Risk Management, Microsoft Purview eDiscovery, and Microsoft Purview Communication Compliance workflows.

Effect: data security and compliance teams can now review thousands of complex and varied alerts spread across multiple security tools to gain insights. This accelerates investigation and response times.

• Securing access – Microsoft Entra

Security Copilot embedded in Microsoft Entra fully support you in investigating identity risks associated with password-based attacks, helps with troubleshooting, e.g., issues with MFA or increased user’s risk level.

Effect: IT admins get an instant risk overview with steps to remediate and recommended follow-up actions and guidance. Moreover, with Microsoft Entra ID Governance, admins can use assistance of Security Copilot to streamline process of using user credentials and access right via creation of a specific lifecycle workflow.

• Fortifying security – Microsoft Intune

In the weeks to come, Security Copilot embedded in Microsoft Intune will offer advanced endpoint management and security: unprecedented visibility across security data and full device context

Effect: empowering IT teams to discover and remediate the cause of devise issues much faster and more effectively. This means more informed outcomes for security analysts, reduced complexity of gathering near real-time device, user and app data with AI-driven recommendations.

1. A) Enhancing multicloud security – Microsoft Defender for Cloud

Security Copilot embedded in Microsoft Defender for Cloud generated recommendation summaries, detailed remediation actions, and scripts in a preferred language, and directly delegate remediation actions to key resource users.

Effect: maintaining a strong cloud posture. Cybersecurity teams can now identify critical concerns to resources faster and with guided, step-by-step risk exploration and rich contextual insights (critical vulnerabilities, sensitive data, lateral movement, etc).

1. B) New Microsoft Defender for External Attack Surface Management(EASM) capabilities offered by Security Copilot give thorough insights into external attack surface – regardless of where the assets are located.

Effect: security operations teams gain visibility into vulnerable critical and high priority common vulnerabilities and exposures (CVEs) and can prioritize remediation actions. Vulnerability managers can now better understand if the external attack surface is impacted by a particular (CVE).

Get the scale and protection of Microsoft AI in your security enviroment

Future of security in business

And the security journey does not end here. Microsoft is continuously adding new capabilities across Microsoft Security portfolio that are based on Security Copilot. The aim is clear: to empower security and IT roles to be able to detect and address cyberthreats and prevent cyberattacks at even greater speed. Security Copilot enables all roles and teams to stay thoroughly protected against security risks – and this means higher operational efficiency.