Microsoft Security Copilot is a generative AI assistant and set of agents for security and IT teams. It is sold on its own and is also built into Microsoft Defender, Sentinel, Entra, Intune and Purview. It triages alerts, summarizes incidents, writes queries from plain language and drafts reports.
What the vendor says it does
- triages complex alerts into actionable summaries
- incident investigation with step-by-step remediation guidance
- phishing triage, vulnerability remediation and alert triage agents
- translates natural language into query-language scripts and reverse-engineers malware scripts
- writes stakeholder reports summarizing incidents
- partner-built and no-code custom agents
- embedded in Microsoft Defender, Sentinel, Entra, Intune and Purview
Price
Consumption-based in security compute units (SCUs): provisioned SCUs $4 per SCU per hour (minimum 1, billed monthly); overage SCUs $6 per SCU used. Prices in USD, given as estimates. Microsoft 365 E5/E7 customers get 400 SCUs per month per 1,000 user licenses (up to 10,000 SCUs)., as listed on October 3, 2026. Vendor pricing
Jobs it is used in
- Information Security Analysts: Triages alerts, summarizes incidents and turns plain-language questions into queries across Microsoft security products.
We have not tested these tools. Each entry says what the vendor says its tool does, matched to tasks from this job's official description, with prices as listed on the vendor's site on October 3, 2026. Prices change; check before you buy. No tool pays to be listed and we earn nothing from these links.
Microsoft Security Copilot vendor site