Microsoft has announced its AI security assistant, Copilot for Security, will be generally available from 1 April 2024, promising to streamline work streams for cyber professionals.
The assistant will support security analysts in triaging, classifying, and remediating cyber incidents, and is embedded across Microsoft’s entire security portfolio.
Copilot for Security offers incident summarization features that saves analysts from getting bogged down in time-consuming documentation steps.
During a briefing call, Andrew Conway, VP of security marketing at Microsoft, said much like developers, security analysts tend not to enjoy mundane tasks like generating summaries and reports as it takes them away from more stimulating investigative work.
Microsoft claims Copilot for Security can carry out these documentation tasks 46% faster than its human counterparts, with better accuracy too.
Another pain point for security analysts, particularly those who are less-experienced, is manually reverse engineering malicious scripts. Threat actors often obfuscate the scripts used in their attacks in order to conceal their tactics, techniques, and intentions.
Usually, threat analysts would manually reverse engineer the obfuscated script to understand how the attack works, but with talent shortages plaguing security teams across the world, finding staff who can do this effectively and efficiently is difficult, the company said.
Copilot for Security, meanwhile, can translate the code and provide a natural language explanation for the entire script, breaking down what each individual piece of code is doing.
Microsoft hopes the tool can help businesses address their skills shortage problems by providing less experienced junior analysts with actionable insights on an individual script, without the arduous manual reverse engineering process.
Mario Ferket, CISO at chemicals company Dow, said he has seen improvements in the time it takes junior analysts to ‘get up to speed’ when trialing the security copilot.
“Recently we hired a few junior analysts and what we’ve seen is, to get those folks up to speed, with Copilot, the speed is tremendous”, he explained.
“If you want to create a complex KQL script, you can now use natural language. This levels the playing field because, in the past, the junior analysts would have needed help from senior analysts to do that type of work.”
Copilot for Security will help seize the initiative from threat actors
The assistant also uses AI-driven analytics to assess the potential scope of security incidents. The system will offer holistic impact analysis with insights on the specific systems affected by an attack.
Security professionals will be able to generate impact analyses for each individual incident, as well as receive actionable, step-by-step guidance on how they should respond to an attack, including support on triage, containment, and remediation.
Moreover, Microsoft will also allow customers to create and save their own natural language prompts for their most frequent work streams.
In its testing, Microsoft found experienced security analysts using Copilot were 22% faster at common security tasks, while also increasing their accuracy by 7%.
Create alignment across your teams and transform the way you manage risk
Moreover, 97% of experienced security analysts said they wanted to use Copilot again, with Microsoft highlighting the fact that AI has the potential to not only improve an individual’s work, but also their job satisfaction by taking care of many of the mundane tasks that might typically frustrate them.
With Copilot for Security, Microsoft has signaled its belief in AI’s ability to bring measurable improvements to security ops in enterprises across the globe.
Conway said he believes AI is beginning to turn the tables on threat actors, allowing them to seize the initiative from attackers in the digital arms race.
“Security has emerged as the most serious use case for AI right now… "organizations have traditionally faced a disadvantage against threat actors, but can now use AI to gain the upper hand”.
