{"stable_id":"ab97170e2a37456b","slug":"microsoft-security-copilot-analyst-rct","company":"Microsoft","workflow_name":"Copilot-assisted incident summarization, script analysis, reporting, and guided response","function_code":"it_operations","pattern_codes":["creator_to_judge"],"changed_assumption":"Analysts can query security telemetry through a generative assistant while retaining response responsibility.","evidence_strength":"reported","publication_tier":"showcase","freshness":"current","reviewed_at":"2026-08-23","updated_at":"2026-08-22","source_quality_summary":"1 vendor; publication outcomes are reported.","caveat_summary":"Microsoft-run controlled task environment, not independently verified production SOC performance. Microsoft developed the product, conducted the trial, and published the results.","freshness_caveat":null,"workflow_summary":{"before":[{"actor":"Security analyst","action":"Investigates incident telemetry, scripts, and evidence manually in Defender XDR.","actor_type":"human"},{"actor":"Security analyst","action":"Writes the summary and recommended response.","actor_type":"human"}],"hinge":"Analysts can query security telemetry through a generative assistant while retaining response responsibility.","after":[{"actor":"Security analyst with Copilot","action":"Uses generated summaries and explanations to analyze incidents and scripts.","actor_type":"human"},{"actor":"Security analyst","action":"Validates findings and authors or approves the incident report and response.","actor_type":"human"}],"decision_mode":"shared","decision_marker":"Human moves from creator to judge"},"before":[{"order":1,"actor":"Security analyst","action":"Investigates incident telemetry, scripts, and evidence manually in Defender XDR.","handoff_to":"Incident report","control":"SOC playbooks and analyst judgment."},{"order":2,"actor":"Security analyst","action":"Writes the summary and recommended response.","handoff_to":"Incident commander","control":"Human review."}],"after":[{"order":1,"actor":"Security analyst with Copilot","action":"Uses generated summaries and explanations to analyze incidents and scripts.","handoff_to":"Analyst decision","control":"Source telemetry remains available for verification."},{"order":2,"actor":"Security analyst","action":"Validates findings and authors or approves the incident report and response.","handoff_to":"Incident commander","control":"Human response authority."}],"decision_rights":"Analysts retain conclusions and response authority.","exception_path":"Analysts ignore incorrect output, return to source evidence, and follow conventional incident procedures.","removed_work":["Initial incident summarization","First-pass script explanation","Report drafting"],"outcomes":[{"metric":"Experienced analyst task speed","baseline":"Control analysts completed the same four Defender XDR tasks without Copilot.","result":"Microsoft reports that Copilot users finished overall tasks 22% faster.","period":"December 2023-January 2024 vendor-run randomized trial.","scale":"Experienced security professionals performing four controlled SOC tasks.","attribution_caveat":"Microsoft-run controlled task environment, not independently verified production SOC performance.","evidence_label":"reported"},{"metric":"Experienced analyst accuracy","baseline":"Control-group accuracy on the same tasks.","result":"Microsoft reports that Copilot users were 7% more accurate across scored tasks.","period":"December 2023-January 2024 vendor-run randomized trial.","scale":"Incident summarization, script analysis, incident reporting, and guided response.","attribution_caveat":"Microsoft developed the product, conducted the trial, and published the results.","evidence_label":"reported"}],"executive_lesson":"Measure both speed and accuracy, and keep the assistant upstream of irreversible containment actions.","anti_pattern":"Equating controlled-task gains with autonomous SOC readiness.","questions_for_leaders":["Which actions can Copilot only recommend?","How are hallucinations exposed against source telemetry?","What production outcomes will be measured?"],"collections":["human-still-decides"],"bundle_version":"1.0.0","bundle_fingerprint":"sha256:c23c6cc2b88153d008ea8fda928f632ce0011fc2d4c5036672a16e5d895bab93","canonical_url":"https://brianletort.ai/transformations/microsoft-security-copilot-analyst-rct"}