Microsoft Security Copilot Announced (Mar 2023): Generative AI Comes to the SOC

Retrospective: this article looks back at events from March 2023, written in 2026 with the benefit of hindsight.

On March 28, 2023, Microsoft announced Microsoft Security Copilot, a generative AI assistant for security teams built on OpenAI's GPT-4 and Microsoft's security-specific model and threat intelligence.

What it promised

• Incident summaries in natural language from complex alerts.
• Guided investigation: asking questions about incidents, users and devices in plain English.
• Script and query analysis: explaining malicious scripts and generating KQL queries.
• Report drafting for incidents and executive summaries.
• Integration with Defender, Sentinel, Intune, Entra and Purview.

Security Copilot became generally available in April 2024 with consumption-based pricing (Security Compute Units), and Microsoft later integrated it more deeply into the Defender portal and other products.

Why it mattered

Security operations teams face a shortage of skilled analysts and a growing volume of alerts. Generative AI promised to make junior analysts more productive and senior analysts faster. Other vendors — Google, CrowdStrike, SentinelOne, Palo Alto Networks — launched similar assistants.

The questions it raised

• Accuracy: AI can produce confident but wrong answers. Analysts must verify.
• Data handling: what security data goes to the model, and how is it protected?
• Cost: consumption pricing made budgeting harder.
• Skills: would AI deskill analysts or help them learn?

In hindsight

AI in the SOC proved useful for summarization, query writing and triage assistance, while still requiring human judgment. By 2026, the bigger question had shifted: not just AI helping defenders, but AI agents acting autonomously — on both sides — as the OpenAI–Hugging Face incident showed.