AI Infused with XDR, SIEM, and Threat Intelligence Set to Reshape Cybersecurity – Source: www.databreachtoday.com

Microsoft Security Copilot
,
Next-Generation Technologies & Secure Development

Information Security Media Group

•
March 18, 2024    

Today’s security tools capture a wealth of data. Yet when incidents occur, threat data from siloed platforms can take hours or days to gather, analyze and act upon. Correlating threat data takes time, as does developing the right remediation plans, stopping the attack, and sharing the results with colleagues. Security teams are invariably overwhelmed and understaffed for the volume and sophistication of threats they now face.

See Also: Live Webinar | Attack Surface Management: Actionable Insights Against New, Known and Unknown Threats

Some organizations go the route of hiring additional security analysts to keep up. Innovation and automation have helped move defenses forward as well, but often are just step changes versus true leaps in defensive capabilities.

Microsoft’s Copilot for Security is set to transform cybersecurity by integrating AI functionality across multiple security tools, including XDR (Extended Detection and Response), SIEM, and threat intelligence. As Copilot for Security enriches these foundational security platforms with fast insights and recommendations, it will also be aggregating data from these platforms – including those monitoring email, endpoints, networks, and cloud – for quicker and more comprehensive analysis and remediation that every Copilot for Security user can leverage to speed and streamline their work.

This AI integration will help evolve threat detection from proactive to predictive, supporting analysts throughout the entire cyberattack chain with easier reporting and clear, step by step guidance, from first alert to final reporting.

Copilot for Security quickly surfaces threat patterns not obvious to the human eye, then uses time-saving natural language prompts to give analysts the clarity needed to stop threats. In some cases, when Conditional Access policies are enabled by the user, Copilot can automatically respond, saving precious time. What literally takes hours and days now can be reduced to minutes, tipping the balance of favor to defenders.

Increasing Effectiveness at High Speed

The results for analysts include greater speed, ease and accuracy. In Microsoft’s randomized tests of early adopters, seasoned security analysts using Copilot were 22% faster – equivalent to saving about a day per week on security tasks.

Some additional analyst improvements using Copilot included:

• 39% faster at summarizing incidents
• 49% considered their quality improved
• 93% reported more productivity

Unsurprisingly, 97% of experienced professionals said they want to use Copilot again in the future. They felt more effective, more productive, and more in control. With new analysts, Copilot reduced feelings of insecurity and improved job satisfaction.

“Security Copilot has a tremendous ability to summarize data and create narratives about threats in a polished, professional way,” said Brian Hooper, Principal Research Lead, Defender Experts. “Before Security Copilot, our analysts spent precious time capturing and consolidating attack data and running it through copywrite reviews before publishing. Now with Security Copilot, we can reduce that time by 90%, allowing them to start their next case. This makes a material time savings for all of us, and if I am honest, its ability to copywrite incident summaries is better than anyone on our team, including me.”

XDR, SIEM and Threat Intelligence Integration Benefits

The foundation of integrated XDR, SIEM and threat intelligence makes Copilot for Security exceptionally effective for security teams, both in efficiency and cybersecurity protection.

When a prompt is submitted to Copilot for Security, for instance, it’s enriched by the Microsoft Security product portfolio, including heavy hitters such as Microsoft Defender XDR, Microsoft Sentinel and Microsoft’s dynamic global threat intelligence. Additional correlation data is derived from Microsoft Intune, Microsoft Entra, Microsoft Purview, Microsoft Defender External Attack Surface Management, and Microsoft Defender for Cloud, as well as third party security products.

These platforms, monitoring identity, data, applications, privacy, and other potential attack entry points, provide the high quality input sources from which the AI learns. They provide trillions of pieces of telemetry data into the analysis – 78 trillion signals daily in fact, a number that continues to rise.

With this birds-eye view across platforms and the ability to pick up the faintest signals, correlating it all in real time, security analysts avoid many time-consuming manual steps and increase their accuracy in parallel. The Copilot platform and framework also coordinates response actions across security layers quickly, so every analyst can move to mitigate threats with greater speed.

Copilot for Security also learns as it solves. As new patterns emerge from the organization’s specific environment, Copilot’s capabilities to identify, alert and stop threat activity from succeeding is continuously strengthened. Context-specific guidance improves and with it, the organization’s defense effectiveness.

Better Protection, Better Outcomes

Microsoft Copilot for Security is a pivotal weapon in the battle against fast emerging and fast changing cyber threats, enabling organizations to proactively protect against cyberattacks. AI-enhanced threat intelligence, predictive analytics, and automated response capabilities, along with the ability to detect and neutralize emerging threats, and anticipate potential security breaches before they occur will help organizations transform their cybersecurity protections.

Your organization’s defenses depend on leveraging AI to proactively detect and prevent cyberattacks. With Copilot for Security, you can take the leap into AI with a system that already integrates XDR, SIEM, threat intelligence and other critical security data streams to stay ahead of fast evolving threats and streamline incident response.

To learn more about how Microsoft Copilot for Security can empower security teams and transform your cybersecurity posture for the better, reach out here, or visit here for more detailed information and testimonials.