Analysts can query security telemetry through a generative assistant while retaining response responsibility.
Collections: Human still decides
Executive brief
Measure both speed and accuracy, and keep the assistant upstream of irreversible containment actions.
AI value · Experienced analyst task speed
Company-reportedMicrosoft reports that Copilot users finished overall tasks 22% faster.
Microsoft-run controlled task environment, not independently verified production SOC performance.
Before
Investigates incident telemetry, scripts, and evidence manually in Defender XDR. → Writes the summary and recommended response.
After
Uses generated summaries and explanations to analyze incidents and scripts. → Validates findings and authors or approves the incident report and response.
Human boundary
Analysts retain conclusions and response authority.
Why it matters
Analysts can query security telemetry through a generative assistant while retaining response responsibility.
This case is company-reported. Use it for the operating-model shift; do not treat the numbers as independently measured.
Before
How the work ran before the change.
Security analyst
Investigates incident telemetry, scripts, and evidence manually in Defender XDR.
Security analyst
Writes the summary and recommended response.
What changed
Analysts can query security telemetry through a generative assistant while retaining response responsibility.
Decision rightHuman moves from creator to judge
After
How the same work runs now.
Security analyst with Copilot
Uses generated summaries and explanations to analyze incidents and scripts.
ControlSource telemetry remains available for verification.
Security analyst
Validates findings and authors or approves the incident report and response.
ControlHuman response authority.
Exception path
Analysts ignore incorrect output, return to source evidence, and follow conventional incident procedures.
Decision authority
Analysts retain conclusions and response authority.
| # | Actor | Action | Control |
|---|---|---|---|
| 01 | Security analyst | Investigates incident telemetry, scripts, and evidence manually in Defender XDR. | SOC playbooks and analyst judgment. |
| 02 | Security analyst | Writes the summary and recommended response. | Human review. |
| # | Actor | Action | Control |
|---|---|---|---|
| 01 | Security analyst with Copilot | Uses generated summaries and explanations to analyze incidents and scripts. | Source telemetry remains available for verification. |
| 02 | Security analyst | Validates findings and authors or approves the incident report and response. | Human response authority. |
Work that left the path
Human role before
Analysts manually synthesized telemetry and drafted reports.
Human role after
Analysts verify AI synthesis, investigate anomalies, and retain response decisions.
AI role
Decision mode: assistive analysis. Summarizes incidents, explains scripts, drafts reports, and guides response; it does not execute containment in the study.
Control analysts completed the same four Defender XDR tasks without Copilot.Microsoft reports that Copilot users finished overall tasks 22% faster.
December 2023-January 2024 vendor-run randomized trial. · Experienced security professionals performing four controlled SOC tasks.
Microsoft-run controlled task environment, not independently verified production SOC performance.
Control-group accuracy on the same tasks.Microsoft reports that Copilot users were 7% more accurate across scored tasks.
December 2023-January 2024 vendor-run randomized trial. · Incident summarization, script analysis, incident reporting, and guided response.
Microsoft developed the product, conducted the trial, and published the results.
Anti-pattern
Equating controlled-task gains with autonomous SOC readiness.
Questions
Portability conditions
Reputation risk
medium