Toyota Leasing Thailand improves collaboration, reduces risk, and better protects customers with Security Copilot

Toyota Leasing Thailand provides financing, insurance, and mobility services to customers across the country. As a financial services subsidiary of Toyota, the company is entrusted with sensitive personal data and a brand reputation built on reliability. In the words of Pradist Kamphoi, Vice President and Chief Information Security Officer, “Customer trust is central to our business. We handle sensitive personal data, and service continuity matters to our customers and our brand.”  

In financial services, trust comes from the confluence of reputation and operational continuity. Every second of downtime or delay in detection risks undermining that confidence. 

Unfortunately, frequent cyberattacks, especially phishing, put that trust under constant pressure. The financial industry is a perennial target, and Toyota Leasing Thailand found that traditional tools created blind spots and left analysts overwhelmed. Investigations dragged on a bit too long, reports to leadership required time-intensive manual preparation, and morale flagged under the weight of repetitive work.  

The leadership team knew they needed a step change in both speed and consistency, so they turned to Microsoft Security Copilot, integrating it with Defender, Entra, and Purview in their Microsoft security stack. 

Speed and productivity go hand-in-hand

For Kalunyu Sopha, Security Manager, the choice was clear: “We turned to Microsoft Security Copilot because it integrates with our Microsoft stack. Analysts can ask questions in human language and get context they can act on, which speeds up the handoff between the SOC and our IT team.”

In this case, speed and productivity go hand-in-hand. Security Copilot quickly became a trusted assistant for the team, automatically summarizing phishing incidents, classifying alerts, and even generating leadership-ready reports. “During a severe phishing situation,” Kalunyu recalls, “Security Copilot summarized incidents, classified them, generated user notifications, analyzed scripts, and produced a report that leadership could use.” That meant more time for taking action and less time on recording activity. By consolidating insights into a single interface, Security Copilot reduced tool-switching and provided leadership with a clear chain from risk to action to outcome. Now, when they brief leadership, “we can show the entire chain from risks to action to outcome, all in one place,” Kalunyu observes.

The team’s engagement with Security Copilot agents is particularly promising. For example, they’ve used the Conditional Access Optimization Agent and Microsoft Entra to enhance identity and access management through policy recommendations and automated compliance checks. In addition, they’re finding substantial time savings from a number of agents that detect phishing, sign-in, and collaboration risks.

Reducing time spent and improving collaboration with Security Copilot agents

The results have been tangible. Response times to phishing incidents dropped from hours to minutes, transforming stressful spikes into systematic responses. Kalunyu explains that with the new setup, “we’ve cut down average time to first action on phishing cases from hours down to just a few minutes.” Junior analysts have gained more confidence, thanks to Security Copilot guiding them step by step, helping them understand the reasoning behind each action. Kalunyu notes that this helps them clarify which actions are needed and why.

That guidance is obviously useful for individual analysts, but it has also improved collaboration across the organization. Kalunyu explains: “Collaboration has improved across SOC and IT. Security Copilot gives us a shared interface and a clearer way to explain risks, actions taken, and next steps. Reports that once required long evenings are now generated nearly instantly.” Pradist emphasizes how this changes things on a cultural level, noting that “in the past we sometimes worked until 10 p.m. or midnight to prepare reports. Now we can finish by 5 p.m. Now we even have time for small team gatherings. Work-life balance is a model we value at Toyota, and happier staff bring more energy to our mission.”

Of course, the benefits extend beyond efficiency and organizational culture. With Security Copilot supporting Thailand’s PDPA compliance and Toyota’s global Zero Trust strategy, Toyota Leasing Thailand has elevated its defensive posture. Compliance with Thailand’s Personal Data Protection Act (PDPA) requires continuous vigilance across data access, storage, and incident response, all of which Security Copilot now supports.

As Pradist put it, “For the overall security strategy, the main thing we focus on is Zero Trust. Never trust, always verify, assume breach. Microsoft solutions cover all the pillars we focus on—data, identity, network, applications, and databases—and Security Copilot ties them together.” By tying together data, identity, and device insights across their Microsoft ecosystem, TLT has operationalized Zero Trust principles into everyday workflows rather than treating them as abstract policies.

With Security Copilot, Toyota Leasing Thailand has created a model for how financial institutions can pair AI assistance and agents with human judgment to protect both customer data and employee well-being.