New tools aim to automate threat detection and response
Microsoft announced a new AI‑driven security model and a complementary agentic platform designed to automate threat detection and response, marking a significant expansion of its cybersecurity portfolio.
Microsoft today unveiled its first AI‑powered security model, a new tool that leverages large language models to analyze and prioritize security alerts across enterprise environments.
The model, announced as part of the company's broader AI strategy, is designed to ingest logs, alerts, and threat intelligence, then output actionable recommendations for security teams.
In a public statement, Microsoft emphasized that the model is intended to augment human analysts, not replace them, by automating routine triage and providing deeper context around anomalies.
The company also introduced an agentic cybersecurity system, a platform that employs autonomous agents to monitor, investigate, and remediate threats in real time.
These agents are built on top‑of‑the‑line reinforcement learning techniques, allowing them to adapt to new attack patterns without explicit re‑training.
According to Microsoft, the agentic system can execute containment actions—such as isolating compromised hosts or blocking malicious traffic—within seconds of detection.
Analysts note that the combination of an AI security model with an agentic platform could reduce mean time to detect and respond for large enterprises.
The new offerings come as cyber‑attacks continue to grow in scale and sophistication, prompting vendors to seek more automated defense solutions.
Microsoft said that the AI security model will be available to existing customers through its Azure security services, with a phased rollout planned over the next 12 months.
The company also highlighted that the agentic system will integrate with its existing security products, such as Microsoft Defender for Endpoint and Azure Sentinel, to provide a unified threat‑management experience.
Microsoft today unveiled its first AI‑powered security model, a new tool that leverages large language models to analyze and prioritize security alerts across enterprise environments.
The model, announced as part of the company's broader AI strategy, is designed to ingest logs, alerts, and threat intelligence, then output actionable recommendations for security teams.
In a public statement, Microsoft emphasized that the model is intended to augment human analysts, not replace them, by automating routine triage and providing deeper context around anomalies.
The company also introduced an agentic cybersecurity system, a platform that employs autonomous agents to monitor, investigate, and remediate threats in real time.
These agents are built on top‑of‑the‑line reinforcement learning techniques, allowing them to adapt to new attack patterns without explicit re‑training.
According to Microsoft, the agentic system can execute containment actions—such as isolating compromised hosts or blocking malicious traffic—within seconds of detection.
Analysts note that the combination of an AI security model with an agentic platform could reduce mean time to detect and respond for large enterprises.
The new offerings come as cyber‑attacks continue to grow in scale and sophistication, prompting vendors to seek more automated defense solutions.
Microsoft said that the AI security model will be available to existing customers through its Azure security services, with a phased rollout planned over the next 12 months.
The company also highlighted that the agentic system will integrate with its existing security products, such as Microsoft Defender for Endpoint and Azure Sentinel, to provide a unified threat‑management experience.
