Customer experiences from the limited public preview of Project Perception
Investigating an incident takes time. Analysts have to pull alerts and activity from different places and determine what happened before they can respond. Two global organizations, TÜV SÜD and Insight Enterprises, have been trying Project Perception’s Attack Investigation Agent during the limited public preview to see how much of that work it can take on. Here’s what they found.
How the Attack Investigation Agent works
Starting from a single alert or incident in Microsoft Defender, the Attack Investigation Agent performs the first round of investigation. That’s the work an analyst would normally do manually: querying each data source and piecing the results together.
The Attack Investigation Agent checks alerts and signals across endpoints, identities, email, and cloud resources to determine whether the incident represents a genuine attack. It then builds a timeline of how the attack unfolded, shows which users, devices, accounts, and resources were affected, and filters out unrelated activity. Finally, it suggests next steps, such as locking down compromised accounts, isolating devices, removing unauthorized access, or blocking known indicators.
Each finding is backed by evidence and transparent reasoning. If something needs a closer look, analysts can ask the agent follow-up questions. Decisions about how to respond stay with the team.
TÜV SÜD: Results in 15 minutes on a weekend incident
Founded more than 160 years ago, TÜV SÜD employs more than 30,000 people worldwide. The company tests, inspects, and certifies products, systems, and operations for organizations around the world, and also offers auditing and advisory services.
The company’s security team has been using the Attack Investigation Agent to analyze incidents, so the findings are already there when an analyst picks them up. Karsten Bode, IT Security Architect at TÜV SÜD, explains why that matters:
“Just having the advantage of analyses and results already available when an analyst starts working on an incident is enormously valuable.”
Bode gave the example of a weekend incident when a Kubernetes cluster started raising alarms:
“An administrator and an analyst had already spent around two hours with investigating when we started Project Perception’s [Attack Investigation] agent. The agent returned a result in about 15 minutes, giving the team findings it could use to resolve the issue. The fast and effective results of the Perception Agent saved us additional hours of investigation for our employees.”
Insight Enterprises: Running several investigations at once
Insight Enterprises is a global solutions integrator and top Microsoft partner. To get started, their security team put the Attack Investigation Agent to the test, comparing its findings with their own. In one ClickFix case, the agent reached the same conclusions as the team but cut the time required by about a third, saving roughly 30 minutes on work that would normally take around 90.
Will Pocknell, Director of Cybersecurity at Insight Enterprises, has also been starting several investigations at once through Perception’s MCP connection, rather than opening each one by hand.
“Perception’s MCP server allows me to launch and monitor multiple investigations and then summarize the findings with Copilot,” noted Pocknell.
What early users are seeing
In both cases, the Attack Investigation Agent did the first round of evidence gathering and analysis, and the security teams decided what to do with it. For TÜV SÜD, that meant accelerating a complex two-hour investigation phase by two people down to approximately 15 minutes. For Insight, it meant findings that lined up with a manual review, and an easier way to run several investigations at once. These early experiences show how Project Perception can take on the first round of investigation work, allowing security teams to spend more time making the decisions that matter.
Learn more and join the conversation.
- Explore Project Perception. Visit the Project Perception product page to learn how red, blue, and green agents work together to expose gaps, investigate threats, and remediate issues while keeping defenders in control.
- Join the Project Perception Community. Follow aka.ms/PerceptionBlog for product updates, technical deep dives, and more customer stories. Share feedback and connect with the team building Project Perception.
- See Project Perception at Microsoft Ignite. Join us November 17–20, 2026, at the Moscone Center in San Francisco or online November 17–19 to see Project Perception in action and hear from the team. Register at aka.ms/MSIgniteFY27RegNow.
Microsoft