Phishing attacks and manual reporting strained Toyota Leasing Thailand’s SOC. The team needed faster triage, clearer collaboration, and stronger Zero Trust alignment.
Integrated with Defender, Entra, and Purview, Security Copilot unified visibility, automated reporting, and improved communication between security and IT teams.
Response times dropped from hours to minutes, collaboration improved across teams, and morale rose as analysts gained confidence and better work-life balance.
“We turned to Microsoft Security Copilot because it integrates with our Microsoft stack. Analysts can ask questions in human language and get context they can act on, which speeds up the handoff between the SOC and our IT team.”
Kalunyu Sopha, Security Manager, Toyota Leasing Thailand
Toyota Leasing Thailand provides financing, insurance, and mobility services to customers across the country. As a financial services subsidiary of Toyota, the company is entrusted with sensitive personal data and a brand reputation built on reliability. In the words of Pradist Kamphoi, Vice President and Chief Information Security Officer, “Customer trust is central to our business. We handle sensitive personal data, and service continuity matters to our customers and our brand.”
In financial services, trust comes from the confluence of reputation and operational continuity. Every second of downtime or delay in detection risks undermining that confidence.
Unfortunately, frequent cyberattacks, especially phishing, put that trust under constant pressure. The financial industry is a perennial target, and Toyota Leasing Thailand found that traditional tools created blind spots and left analysts overwhelmed. Investigations dragged on a bit too long, reports to leadership required time-intensive manual preparation, and morale flagged under the weight of repetitive work.
The leadership team knew they needed a step change in both speed and consistency, so they turned to Microsoft Security Copilot, integrating it with Defender, Entra, and Purview in their Microsoft security stack.
For Kalunyu Sopha, Security Manager, the choice was clear: “We turned to Microsoft Security Copilot because it integrates with our Microsoft stack. Analysts can ask questions in human language and get context they can act on, which speeds up the handoff between the SOC and our IT team.”
In this case, speed and productivity go hand-in-hand. Security Copilot quickly became a trusted assistant for the team, automatically summarizing phishing incidents, classifying alerts, and even generating leadership-ready reports. “During a severe phishing situation,” Kalunyu recalls, “Copilot summarized incidents, classified them, generated user notifications, analyzed scripts, and produced a report that leadership could use.” That meant more time for taking action and less time on recording activity. By consolidating insights into a single interface, Copilot reduced tool-switching and provided leadership with a streamlined overview of incidents and responses. Now, when they brief leadership, “we can show the entire chain from risks to action to outcome, all in one place,” Kalunyu observes.
“Collaboration has improved across SOC and IT. Copilot gives us a shared interface and a clearer way to explain risks, actions taken, and next steps. Reports that once required long evenings are now generated nearly instantly.”
Kalunyu Sopha, Security Manager, Toyota Leasing Thailand
Phishing response time cut from hours to minutes
The results have been tangible. Response times to phishing incidents dropped from hours to minutes, transforming stressful spikes into systematic responses. Kalunyu explains that with the new setup, “we’ve cut down average time to first action on phishing cases from hours down to just a few minutes.” Junior analysts have gained more confidence, thanks to Copilot guiding them step by step, clarifying the reasoning behind each action. Kalunyu notes that this helps them understand which actions are needed and why.
That guidance is obviously useful for individual analysts, but it has also improved collaboration across the organization. Kalunyu explains: “Collaboration has improved across SOC and IT. Copilot gives us a shared interface and a clearer way to explain risks, actions taken, and next steps. Reports that once required long evenings are now generated nearly instantly.” Pradist emphasizes how this changes things on a cultural level, noting that “in the past we sometimes worked until 10 p.m. or midnight to prepare reports. Now we can finish by 5 p.m. Now we even have time for small team gatherings. Work-life balance is a model we value at Toyota, and happier staff bring more energy to our mission.”
Of course, the benefits extend beyond efficiency and organizational culture. With Copilot supporting Thailand’s PDPA compliance and Toyota’s global Zero Trust strategy, Toyota Leasing Thailand has elevated its defensive posture. Compliance with Thailand’s Personal Data Protection Act (PDPA) requires continuous vigilance across data access, storage, and incident response, all of which Copilot now supports.
As Pradist put it, “For the overall security strategy, the main thing we focus on is Zero Trust. Never trust, always verify, assume breach. Microsoft solutions cover all the pillars we focus on—data, identity, network, applications, and databases—and Security Copilot ties them together.” By tying together data, identity, and device insights across their Microsoft ecosystem, TLT has operationalized Zero Trust principles into everyday workflows rather than treating them as abstract policies.
With Security Copilot, Toyota Leasing Thailand has created a model for how financial institutions can pair AI assistance with human judgment to protect both customer data and employee well-being.
“For the overall security strategy, the main thing we focus on is Zero Trust. Never trust, always verify, assume breach. Microsoft solutions cover all the pillars we focus on—data, identity, network, applications, and databases—and Security Copilot ties them together.”
Pradist Kamphoi, Vice President and Chief Information Security Officer, Toyota Leasing Thailand
Follow Microsoft