Microsoft
Company-reportedCreator to judgeAnalysts can query security telemetry through a generative assistant while retaining response responsibility.
IT operations · United States
Collections: Human still decides
Executive brief
Measure both speed and accuracy, and keep the assistant upstream of irreversible containment actions.
AI value · Experienced analyst task speed
Company-reportedMicrosoft reports that Copilot users finished overall tasks 22% faster.
Microsoft-run controlled task environment, not independently verified production SOC performance.
Before
Investigates incident telemetry, scripts, and evidence manually in Defender XDR. → Writes the summary and recommended response.
After
Uses generated summaries and explanations to analyze incidents and scripts. → Validates findings and authors or approves the incident report and response.
Human boundary
Analysts retain conclusions and response authority.
Why it matters
Analysts can query security telemetry through a generative assistant while retaining response responsibility.
This case is company-reported. Use it for the operating-model shift; do not treat the numbers as independently measured.
Before
How the work ran before the change.
Security analyst
Investigates incident telemetry, scripts, and evidence manually in Defender XDR.
Security analyst
Writes the summary and recommended response.
What changed
Analysts can query security telemetry through a generative assistant while retaining response responsibility.
Decision rightHuman moves from creator to judge
After
How the same work runs now.
Security analyst with Copilot
Uses generated summaries and explanations to analyze incidents and scripts.
ControlSource telemetry remains available for verification.
Security analyst
Validates findings and authors or approves the incident report and response.
ControlHuman response authority.
Exception path
Analysts ignore incorrect output, return to source evidence, and follow conventional incident procedures.
Work removed
Decision authority
Analysts retain conclusions and response authority.
Before
Security analyst
Investigates incident telemetry, scripts, and evidence manually in Defender XDR.
Control: SOC playbooks and analyst judgment.
Security analyst
Writes the summary and recommended response.
Control: Human review.
After
Security analyst with Copilot
Uses generated summaries and explanations to analyze incidents and scripts.
Control: Source telemetry remains available for verification.
Security analyst
Validates findings and authors or approves the incident report and response.
Control: Human response authority.
Work that left the path
Human role before
Analysts manually synthesized telemetry and drafted reports.
Human role after
Analysts verify AI synthesis, investigate anomalies, and retain response decisions.
AI roleDecision mode: assistive analysis. Summarizes incidents, explains scripts, drafts reports, and guides response; it does not execute containment in the study.
Control analysts completed the same four Defender XDR tasks without Copilot.→Microsoft reports that Copilot users finished overall tasks 22% faster.
December 2023-January 2024 vendor-run randomized trial. · Experienced security professionals performing four controlled SOC tasks.
Microsoft-run controlled task environment, not independently verified production SOC performance.
Control-group accuracy on the same tasks.→Microsoft reports that Copilot users were 7% more accurate across scored tasks.
December 2023-January 2024 vendor-run randomized trial. · Incident summarization, script analysis, incident reporting, and guided response.
Microsoft developed the product, conducted the trial, and published the results.
Anti-pattern
Equating controlled-task gains with autonomous SOC readiness.
Questions
Portability conditions
Reputation risk
medium
Evidence and authority
Current · updated
1 vendor; publication outcomes are reported.
Bundle 1.0.0 · reviewed 2026-08-23 · stable ID ab97170e2a37456b
Google · Creator to judge
Large migrations can combine machine-found locations, LLM edits, automated checks, and engineer review.
Rising Academies schools · Creator to judge
Students can receive adaptive, low-bandwidth math practice without a scarce one-to-one tutor.
The Permanente Medical Group · Creator to judge
Ambient tools can draft clinical notes, while physicians remain the editors and signers.
Twenty-eight South-East Queensland long-term care facilities · Creator to judge
Hinge: a responsive social robot can provide repeatable short engagement sessions as an adjunct to care, without replacing clinical assessment or human relationships.