One of the advantages for security teams is their view of the data field\u2014they know how the infrastructure, user posture, and applications, are set up before a cyberattack begins. To further tip the scale in favor of cyberdefenders, Microsoft Security offers a very large-scale data advantage\u201465 trillion daily signals, expertise of global threat intelligence, monitoring more than 300 cyberthreat groups, and insights on cyberattacker behaviors from more than 1 million customers and more than 15,000 partners.1<\/sup> <\/p>\n\n\n\n Our new generative AI solution\u2014Microsoft Security Copilot<\/a>\u2014combined with our massive data advantage and end-to-end security, all built on the principles of Zero Trust, creates a flywheel of protection to change the asymmetry of the digital threat landscape and favor security teams in this new era of security.<\/p>\n\n\n\n To learn more about Microsoft Security\u2019s vision for the future and the latest generative AI announcements and demos, watch the Microsoft Ignite keynote \u201cThe Future of Security with AI<\/a>\u201d presented by Charlie Bell, Executive Vice President, Microsoft Security, and I on Thursday, November 16, 2023, at 10:15 AM PT. <\/p>\n\n\n\n One of the biggest challenges in security is the lack of cybersecurity professionals. This is an urgent need given the three million unfilled positions in the field, with cyberthreats increasing in frequency and severity.3<\/sup> <\/p>\n\n\n In a recent study to measure the productivity impact for “new in career” analysts, participants using Security Copilot demonstrated 44 percent more accurate responses and were 26 percent faster across all tasks<\/strong>.4<\/sup> <\/p>\n<\/div><\/div>\n\n\n\n According to the same study:<\/p>\n\n\n\n Check out the Security Copilot Early Access Program<\/a>\u2014with Microsoft Defender Threat Intelligence included at no additional charge\u2014that adds speed and scale for scenarios like security posture management, incident investigation and response, security reporting, and more\u2014now available to interested and qualified customers. For example, one early adopter from Willis Towers Watson (WTW)<\/a> said \u201cI envision Microsoft Security Copilot as a change accelerator. The ability to do threat hunting at pace will mean that I\u2019m able to reduce my mean time to investigate, and the faster I can do that, the better my security posture will become.\u201d\u202f Keep reading for a full list of capabilities.<\/p>\n\n\n Security operations teams struggle to manage disparate security toolsets from siloed technologies and apps. This challenge is only exacerbated given the scarcity of skilled security talent. And while organizations have been investing in traditional AI and machine learning to improve threat intelligence, deploying AI and machine learning comes with its unique challenges and its own shortage of data science talent. It\u2019s time for a step-change in our industry, and thanks to generative AI, we can now close the talent gap for both security and data professionals. Securing an organization today requires an innovative approach that prevents, detects, and disrupts cyberattacks at machine speed, while delivering simplicity and and approachable, conversational experiences to help security operations center (SOC) teams move faster, and bringing together all the security signals and threat intelligence currently stuck in disconnected tools. Today, we are thrilled to announce the next major step in this industry-defining vision: combining the power of leading solutions in security information and event management (SIEM), extended detection and response (XDR), and generative AI for security into the first <\/strong>unified security operations platform<\/strong><\/a>.<\/p>\n\n\n\n By bringing together Microsoft Sentinel, Microsoft Defender XDR (previously Microsoft 365 Defender), and Microsoft Security Copilot, security analysts now have a unified incident experience that streamlines triage and provides a complete, end-to-end view of threats across the digital estate. With a single set of automation rules and playbooks enriched with generative AI, coordinating response is now easier and quicker for analysts of every level. In addition, unified hunting now gives analysts the ability to query all SIEM and XDR data in one place to uncover cyberthreats and take appropriate remediation action. Customers interested in joining the preview of the unified security operations platform should contact their account team.<\/p>\n\n\n\n Further, Microsoft Security Copilot is natively embedded into the analyst experience supporting both SIEM and XDR and equipping analysts with step-by-step guidance and automation for investigating and resolving incidents, without the reliance of data analysts. Complex tasks, such as analyzing malicious scripts or crafting Kusto Query Language (KQL) queries to hunt across data in Microsoft Sentinel and Defender XDR, can be accomplished simply by asking a question in natural language or accepting a suggestion from Security Copilot. If you need to update your chief information security officer (CISO) on an incident, you can now instantly generate a polished report that summarizes the investigation and the remediation actions that were taken to resolve it.<\/p>\n\n\n\n To keep up with the speed of cyberattackers, the unified security operations platform catches cyberthreats at machine speed and protects your organization by automatically disrupting advanced attacks. We are extending this capability to act on third-party signals, for example with SAP signals and alerts. For SIEM customers who have SAP connected, attack disruption will automatically detect financial fraud techniques and disable the native SAP and connected Microsoft Entra account to prevent the cyberattacker from transferring any funds\u2014with no SOC intervention. The attack disruption capabilities will be further strengthened by new deception capabilities in Microsoft Defender for Endpoint<\/a>\u2014which can now automatically generate authentic-looking decoys and lures, so you can entice cyberattackers with fake, valuable assets that will deliver high-confidence, early stage signal to the SOC and trigger automatic attack disruption even faster.<\/p>\n\n\n\n Lastly, we are building on the native XDR experience<\/a> by including cloud workload signals and alerts from Microsoft Defender for Cloud\u2014a leading cloud-native application protection platform (CNAPP)\u2014so analysts can conduct investigations that span across their multicloud infrastructure (Microsoft Azure, Amazon Web Services, and Google Cloud Platform environments) and identities, email and collaboration tools, software as a service (SaaS) apps, and multiplatform endpoints\u2014making Microsoft Defender XDR one of the most comprehensive native XDR platforms in the industry.<\/p>\n\n\n\n Customers who operate both SIEM and XDR can add Microsoft Sentinel into their Microsoft Defender portal experience easily, with no migration required. Existing Microsoft Sentinel customers can continue using the Azure portal. The unified security operations platform is now available in private preview and will move to public preview in 2024.<\/p>\n\n\n\n Security is a shared responsibility across teams, yet many don\u2019t share the same tools or data\u2014and they often don\u2019t collaborate with one another. We are adding new capabilities and embedded experiences of Security Copilot across the Microsoft Security portfolio<\/strong> as part of the Early Access Program to empower all security and IT roles to detect and address cyberthreats at machine speed. And to enable all roles to protect against top security risks and drive operational efficiency, Microsoft Security Copilot <\/strong>now brings together signals across Microsoft Defender, Microsoft Defender for Cloud, Microsoft Sentinel, Microsoft Intune, Microsoft Entra, and Microsoft Purview into a single pane of glass.<\/p>\n\n\n\n Microsoft Purview<\/strong><\/a>: <\/strong>Data security and compliance teams review a multitude of complex and diverse alerts spread across multiple security tools, each alert containing a wealth of rich insights. To make data protection faster, more effective, and easier, Security Copilot is now embedded in Microsoft Purview, offering summarization capabilities directly within Microsoft Purview Data Loss Prevention<\/a>, Microsoft Purview Insider Risk Management<\/a>, Microsoft Purview eDiscovery<\/a>, and Microsoft Purview Communication Compliance workflows<\/a>, making sense of profuse and diverse data, accelerating investigation and response times, and enabling analysts at all levels to complete complex tasks with AI-powered intelligence at their fingertips. Additionally, with AI translator capabilities in eDiscovery, you can use natural language to define search queries, resulting in faster and more accurate search iterations and eliminating the need to use keyword query language. These new data security capabilities are also available now in the Microsoft Security Copilot standalone experience.<\/p>\n\n\n\n Microsoft Entra<\/strong><\/a>: Password-based attacks have increased dramatically in the last year, and new attack techniques are now trying to circumvent multifactor authentication. To strengthen your defenses against identity compromise, Security Copilot embedded in Microsoft Entra<\/a> can assist in investigating identity risks and help with troubleshooting daily identity tasks, such as why a sign-in required multifactor authentication or why a user\u2019s risk level increased. IT administrators can instantly get a risk summary, steps to remediate, and recommended guidance for each identity at risk, in natural language. Quickly get to the root of an issue for a sign-in with a summarized report of the most relevant information and context. Additionally, in Microsoft Entra ID Governance, admins can use Security Copilot to guide in the creation of a lifecycle workflow to streamline the process of creating and issuing user credentials and access rights. These new capabilities to summarize users and groups, sign-in logs, and high-risk users are also available now in the Microsoft Security Copilot standalone experience.<\/p>\n\n\n\n Microsoft Intune<\/strong><\/a>: The evolving device landscape is driving IT complexity and risk of endpoint vulnerabilities\u2014and IT administrators play a critical security role in managing these devices and protecting organizational data. We are introducing Security Copilot embedded in Microsoft Intune<\/a> in the coming weeks for select customers of the Early Access Program, marking a meaningful advancement in endpoint management and security. This experience offers unprecedented visibility across security data with full device context, provides real-time guidance when creating policies, and empowers security and IT teams to discover and remediate the root cause of device issues faster and easier. Now IT administrators and security analysts are empowered to drive better and informed outcomes with pre-deployment, AI-based guard rails to help them understand the impact of policy changes in their environment before applying them. With Copilot, they can save time and reduce complexity of gathering near real-time device, user, and app data and receive AI-driven recommendations to respond to threats, incidents, and vulnerabilities, fortifying endpoint security.\u202f<\/p>\n\n\n\n Microsoft Defender for Cloud<\/strong><\/a>: Maintaining a strong cloud security posture is a challenge for cybersecurity teams, as they face siloed visibility into risks and vulnerabilities across the application lifecycle, due to the rise of cloud-native development and multicloud environments. With Security Copilot now embedded in Microsoft Defender for Cloud<\/a>, security admins are empowered to identify critical concerns to resources faster with guided risk exploration that summarizes risks, enriched with contextual insights such as critical vulnerabilities, sensitive data, and lateral movement. To address the uncovered critical risks more efficiently, admins can use Security Copilot in Microsoft Defender for Cloud to guide remediation efforts and streamline the implementation of recommendations by generating recommendation summaries, step-by-step remediation actions, and scripts in a preferred language, and directly delegate remediation actions to key resource users. These new cloud security capabilities are also available now in the Microsoft Security Copilot standalone experience. <\/p>\n\n\n\n Microsoft Defender for External Attack Surface Management<\/strong><\/a> (EASM)<\/strong>: <\/strong>Keeping up with tracking assets and their vulnerabilities can be overwhelming for security teams, as it requires time, coordination, and research to understand which assets pose a risk to the organization. New Defender for EASM capabilities are available in the Security Copilot standalone experience and enable security teams to quickly gain insights into their external attack surface, regardless of where the assets are hosted, and feel confident in the outcomes. These capabilities provide security operations teams with a snapshot view of their external attack surface, help vulnerability managers understand if their external attack surface is impacted by a particular common vulnerability and exposure (CVE), and provide visibility into vulnerable critical and high priority CVEs to help teams know how pervasive they are to their assets, so they can prioritize remediation efforts.<\/p>\n\n\n\n Custom plugins to trusted third-party tools<\/strong>: Security Copilot provides more robust, enriched insight and guidance when it is integrated with a broader set of security and IT teams’ tools. To do so, Security Copilot must embrace a vast ecosystem of security partners. As part of this effort, we are excited to announce the latest integration now available to Security Copilot customers with ServiceNow. For customers who want to bring onboard their trusted security tools and integrate their own organizational data and applications, we’re also introducing a new set of custom plugins that will enable them to expand the reach of Security Copilot to new data and new capabilities.<\/p>\n\n\n\n As organizations quickly adopt generative AI, it is vital to have robust security measures in place to ensure safe and responsible use. This involves understanding how generative AI is being used, protecting the data that is being used or created by generative AI, and governing the use of AI. As generative AI apps become more popular, security teams need tools that secure both the AI applications and the data they interact with. In fact, 43 percent of organizations said lack of controls to detect and mitigate risk in AI is a top concern.5<\/sup> Different AI applications pose various levels of risk, and organizations need the ability to monitor and control these generative AI apps with varying levels of protection.<\/p>\n\n\n\n Microsoft Defender<\/strong>: Microsoft Defender for Cloud Apps is expanding its discovery capabilities to help organizations gain visibility into the generative AI apps in use, provide extensive protection and control to block risky generative AI apps, and apply ready-to-use customizable policies to prevent data loss in AI prompts and AI responses. This new feature supports more than 400 generative AI apps, and offers an easy way to sift through low- versus high-risk apps. <\/p>\n\n\n\n Microsoft Purview<\/strong>: New capabilities in Microsoft Purview help comprehensively secure and govern data in AI, including Microsoft Copilot and non-Microsoft generative AI applications. Customers can gain visibility into AI activity, including sensitive data usage in AI prompts, comprehensive protection with ready-to-use policies to protect data in AI prompts and responses, and compliance controls to help easily meet business and regulatory requirements. Microsoft Purview capabilities are integrated with Microsoft Copilot, starting with Copilot for Microsoft 365, strengthening the data security and compliance for Copilot for Microsoft 365.<\/p>\n\n\n\n Further, to enable customers to gain a better understanding of which AI applications are being used and how, we are announcing the preview of AI hub in Microsoft Purview<\/a>. Microsoft Purview can provide organizations with an aggregated view of total prompts being sent to Copilot and the sensitive information included in those prompts. Organizations can also see an aggregated view of the number of users interacting with Copilot. And we are extending these capabilities to provide insights for more than 100 of the most commonly used consumer generative AI applications, such as ChatGPT, Bard, DALL-E, and more. <\/p>\n\n\n Keeping up with daily protection requirements is a security challenge that can\u2019t be ignored\u2014and the struggle to stay ahead of cyberattackers and safeguard your organization\u2019s data is why we\u2019ve designed our security features to evolve with the digital threat landscape and provide comprehensive protection against cyberthreats.<\/p>\n\n\n\n Strengthen your code-to-cloud defenses<\/strong> with Microsoft Defender for Cloud<\/strong>. To cope with the complexity of multicloud environments and cloud-native applications, security teams need a comprehensive strategy that enables code-to-cloud defenses<\/a> on all cloud deployments. For posture management, the preview of Defender for Cloud\u2019s integration with Microsoft Entra Permissions Management helps you apply the least privilege principle for cloud resources and shows the link between access permissions and potential vulnerabilities across Azure, AWS, and Google Cloud. Defender for Cloud also has an improved attack path analysis experience, which helps you predict and prevent complex cloud attacks\u2014and provides more insights into your Kubernetes deployments across Amazon Elastic Kubernetes Service (EKS) and Google Kubernetes Engine (GKE) clusters and APIs insights to prioritize cloud risk remediation. <\/p>\n\n\n\n To strengthen security throughout the application lifecycle, preview of the GitLab Ultimate integration gives you a clear view of your application security posture and simplifies code-to-cloud remediation workflows across all major developer platforms\u2014GitHub, Azure DevOps, and GitLab within Defender for Cloud. Additionally, general availability of Defender for APIs, which offers machine learning-driven protection against API threats and agentless vulnerability assessments for container images in Microsoft Azure Container Registries. Defender for Cloud now offers a unified vulnerability assessment engine spanning all cloud workloads, powered by the strong capabilities of Microsoft Defender Vulnerability Management.<\/p>\n\n\n\n Leverage Microsoft Defender Threat Intelligence <\/strong>for elevating your threat intelligence. Available in Microsoft Defender XDR, Microsoft Defender Threat Intelligence<\/a> offers valuable open-source intelligence and internet data sets found nowhere else. These capabilities now enhance Microsoft Defender products with crucial context around threat actors, tooling, and infrastructure at no additional cost to customers. Available in the Threat Intelligence blade of Defender XDR, Detonation Intelligence <\/strong>enables users to search, look up, and contextualize cyberthreats as well as detonate URLs and view results to quickly understand a malicious file or URL. Defender XDR customers can quickly submit an indicator of compromise (IoC) to immediately view the results. Vulnerability Profiles <\/strong>put intelligence collected from the Microsoft Threat Intelligence team about vulnerabilities all in one place. Profiles are updated when new information is discovered and contains a description, Common Vulnerability Scoring System scores (CVSS), a priority score, exploits, and deep and dark web chatter observations.<\/p>\n\n\n\n Use Microsoft Purview to extend data protection capabilities<\/strong><\/a> across structured and unstructured data types.<\/strong> In the past, securing and governing sensitive data across these diverse elements of your digital estate would have required multiple providers, adding a heavy integration tax. But today, with Microsoft Purview, you can gain visibility across your entire data estate, secure your structured and unstructured data, and detect risks across clouds. Microsoft Purview\u2019s labeling and classification capabilities are expanding beyond Microsoft 365, offering access controls for both structured and unstructured data types. Users will have the ability to discover, classify, and safeguard sensitive information hosted in structured databases such as Microsoft Azure SQL and Azure Data Lake Storage (ADLS)\u2014also extending these capabilities into Amazon Simple Storage Service (S3) buckets.<\/p>\n\n\n\n Detect insider risk with Microsoft Purview Insider Risk Management<\/strong><\/a>, which offers ready-to-use risk indicators to detect critical insider risks in Azure, AWS, and SaaS applications, including Box, Dropbox, Google Drive, and GitHub. Admins with appropriate permissions will no longer need to manually cross-reference signals in these environments. They can now utilize the curated and preprocessed indicators to obtain a more holistic view of a potential insider incident.<\/p>\n\n\n\n Simplify access security with Microsoft Entra<\/strong>. Securing access points is critical and can be complex when using multiple providers for identity management, network security, and cloud security. With Microsoft Entra, you can centralize all your access controls together to more fully secure and protect your environment. Microsoft\u2019s Security Service Edge<\/a> solution is expanding with several new features. <\/strong><\/p>\n\n\n\n Unify, simplify, and delight users by the Microsoft Intune Suite.<\/strong> We\u2019re adding three new solutions to the Intune Suite, available in February 2024. These solutions further unify critical endpoint management workloads in Intune to fortify device security posture, power better experiences, and simplify IT and security operations end-to-end. We will also be able to offer these solutions coupled with the existing Intune Suite capabilities to agencies and organizations of the Government Community Cloud (GCC) in March 2024.<\/p>\n\n\n\n There are several partners participating in our engineer-led Security Copilot Partner Private Preview<\/a> to validate usage scenarios and provide feedback on functionality, operations, and APIs to assist with extensibility. If you are joining us in person at Microsoft Ignite, watch the demos at the Customer Meet-up Hub, presented by Microsoft Intelligent Security Association (MISA)<\/a> members sponsoring at Microsoft Ignite. And if you\u2019re a partner interested in staying current, join the Security Copilot Partner Interest Community<\/a>.<\/p>\n\n\n\n Embracing innovation has never been more important for an organization, not only with respect to today\u2019s cyberthreats but also in anticipation of those to come. Recently, to create a more secure future, we launched the Secure Future Initiative<\/a>\u2014a new initiative to pursue our next generation of cybersecurity protection.<\/p>\n\n\n\n Join Vasu Jakkal and Charlie Bell at Microsoft Ignite to watch “the Future of Security and AI” on November 16, 2023, at 10:15 AM PT.<\/p>\n\n\n\n AI is changing our world forever. It is empowering us to achieve the impossible and it will usher in a new era of security that favors security teams. Microsoft is privileged to be a leader in this effort and committed to a vision of security for all. <\/p>\n\n\n\n To learn more about Microsoft Security solutions, visit our website<\/a>. Bookmark the Security blog<\/a> to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security<\/a>) and X (formerly known as Twitter) (@MSFTSecurity<\/a>) for the latest news and updates on cybersecurity.<\/p>\n\n\n\n 1<\/sup>Microsoft Digital Defense Report 2023<\/a>.<\/p>\n\n\n\n 2<\/sup>Cybercrime To Cost The World $10.5 Trillion Annually By 2025<\/a>, Cybercrime Magazine. November 13, 2020.<\/p>\n\n\n\n 3<\/sup>Cybersecurity Workforce Study<\/a>, ISC2<\/sup>. 2022.<\/p>\n\n\n\nChanging the paradigm with Microsoft Security Copilot<\/h2>\n\n\n\n
![\"Graphic](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/11\/Picture2-1.webp\")
<\/figure>\n
![\"Graphic](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/11\/Picture1-3-1024x571.webp\")
<\/figure>\n\n\n\nIntroducing the industry’s first generative AI-powered unified security operations platform with built-in Copilot<\/h2>\n\n\n\n
![\"Screenshot](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/11\/Picture2-1024x576.jpg\")
<\/figure>\n\n\n\nExpanding Copilot for data security, identity, device management, and more <\/h2>\n\n\n\n
New capabilities in Security Copilot creating a force multiplier for security and IT teams<\/h3>\n\n\n\n
Securing the use of generative AI for safeguarding your organization<\/h2>\n\n\n\n
![\"Microsoft](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/11\/Compliance_and_Purview-1-1024x576.jpg\")
<\/figure>\n\n\n\n![\"New](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/11\/Picture1-4-1024x848.webp\")
<\/figure>\n\n\n\nExpanding end-to-end security for comprehensive protection everywhere<\/h2>\n\n\n\n
\n
\n
Partner opportunities and news<\/h2>\n\n\n\n
![\"MISA](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/11\/Picture3.jpg\")
<\/figure>\n\n\n\nJoin us in creating a more secure future<\/h2>\n\n\n\n
Microsoft Ignite 2023<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/11\/Security-Copilot-Perspective-YellowBg-Diagonal-2.jpg\")
\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t\t<\/div>\n<\/div>\n<\/div>\n\n\n\nLearn more<\/h2>\n\n\n\n
\n\n\n\n