Microsoft Security Copilot

Microsoft Security Copilot is designed for security operations teams that need to move faster from alert to understanding to action. It applies generative AI to security workflows by letting analysts ask natural language questions about incidents, threats and remediation, and it can summarize investigation context into reports that are easier to share with stakeholders. Microsoft positions it as a companion to existing Microsoft security products, where features such as incident summarization in Microsoft Defender and guidance for investigations in tools like Microsoft Sentinel can be combined with Copilot prompts and promptbooks. The service is capacity based and uses Security Compute Units, or SCUs, to measure the compute required to run prompts and related features. On the official pricing page, provisioned capacity has a minimum of 1 SCU, is priced per hour and billed monthly, and an example shows charging at $4 per provisioned SCU for an hourly block. Organizations can also set overage limits to handle spikes, and Microsoft provides a web based calculator to estimate SCU needs. Security Copilot can be extended through plugins and Microsoft has documentation describing custom plugins that can connect to data sources and APIs, including Microsoft Graph based integrations across parts of the Microsoft security ecosystem. Security Copilot is most useful when you already rely on Microsoft security telemetry and want faster triage, consistent narratives and guided remediation steps. It is not a replacement for a SIEM or XDR, but an AI layer that helps analysts query and act on those systems with less manual context switching.