Unleashing the power of Microsoft Purview with Security Copilot

With cyber threats escalating in scale and complexity, generative AI (GenAI) is redefining data security by enabling faster, smarter threat detection and response. Unlike traditional security systems, which often rely on rigid rules and past patterns, GenAI continuously learns and adapts, identifying anomalies and suspicious activities that would otherwise remain undetected. Recent research underscores this shift, showing that organizations using AI-powered security solutions can cut data breach costs by as much as 22%[1] and reduce incident response times by up to 50%[2], marking a major leap forward in protecting critical data.

GenAI is also transforming the way investigations are conducted, helping security teams delve deeper into complex incidents with speed and precision. By automating the analysis of massive datasets, GenAI can uncover critical insights in minutes, rather than days. This rapid investigative power not only enhances response times but also strengthens predictive security measures, empowering organizations to stay ahead of emerging threats in an increasingly volatile cyber landscape.

That’s why today we’re thrilled to announce the most recent integrations of Security Copilot with Microsoft Purview, taking data security teams’ experience and investigations to the next level.

Fortifying data security posture with the power of generative AI

Visibility into data and user activities is considered vital for most organizations to understand the efficacy of their data security programs. Today we are excited to announce the public preview of Microsoft Purview Data Security Posture Management (DSPM), that for the first time brings together insights from Microsoft Purview Information Protection, Data Loss Prevention, and Insider Risk Management in a centralized place, providing visibility into data security risks and recommending controls to protect data. DSPM offers contextual insights into data, its usage, and continuous risk assessment of your evolving data landscape, and it can be enhanced by Security Copilot for deeper investigations and uncovering unseen risks with AI-powered insights.

With Security Copilot embedded in DSPM, organizations can gain more out of DSPM by accessing GenAI-powered insights in natural language. Data Security teams can conduct deeper investigations to better understand potential risks to their data. DSPM with the embedded Security Copilot capabilities will help teams get started and prioritize their efforts through:

1. Starting suggested prompts: These are contextually relevant insights for the top data risks in your organizations such as ‘Which sensitive files were shared outside the org from SharePoint last week?”. Right in the DSPM experience, your teams can see five categories such as ‘alerts to prioritize’, ‘sensitive data leaks detected’, ‘devices at risk’, and ‘risky sequenced activity’.
2. Suggested prompts: Building on the response to these starting prompts or user-entered open prompt, Copilot provides suggested prompts to guide you through a recommended path of investigation.
3. Open prompts: You can further customize your analysis by using open prompts allowing you to explore investigations in many directions across data sets, alerts, users, and activities.

Figure 1: Security Copilot supercharging and guiding investigation with starting insights and follow-up prompts, and enabling open prompts

Security Copilot in DSPM enables teams to discover previously unseen risks and accelerate data security by suggesting scenarios and prompts that can help triage and prioritize risks. Through these guided investigations, Copilot makes it easy to onboard newer team members and drive greater efficiency for experienced team members.

Learn more about DSPM in our documentation and deep dive video. This capability will be available in public preview within the coming weeks.

New enhancements to embedded Security Copilot experiences in Purview Data Loss Prevention

We are also excited to announce new Security Copilot skills in public preview that are embedded in Purview DLP to assist admins. These capabilities augment the embedded & standalone Security Copilot-powered alert summarization experiences that are already available in Purview DLP.

The new enhanced hunting prompts in Security Copilot allow for a deeper dive into DLP alert summaries (to complement enhanced hunting prompts in IRM summary that are already in preview)  providing detailed exploration of data and users involved in incidents. This includes actions taken on the data and the specific sensitive information type (SIT) that triggered the alert. Additionally, Security Copilot now guides admins through analyzing insights within Activity Explorer. Pre-built prompts offer a birds-eye view of top activities detected over the past week, such as DLP rule matches or sensitive data used in M365 Copilot interactions. With Security Copilot, admins can also use natural language to apply the correct investigation filters to pinpoint specific activities or data.

Figure 2: Security Copilot enabling deep dive investigations and filters in DLP Activity Explorer with natural language

One of the persistent challenges for DLP admins has been quickly and easily grasping the full extent of their DLP policies' coverage across the environment. The new Security Copilot-powered policy insights skill addresses this by summarizing the intent, scope, and resulting matches of existing DLP policies in natural language. This skill provides insights such as the DLP policies deployed for each workload (like SharePoint or Exchange), the sensitive information types they aim to detect, and the number of rule matches associated with those policies. With this information, security admins can swiftly identify and address any protection gaps. You might ask something like “do my DLP policies cover my organization for PII information” or “What policies protect my OneDrive sites".

Figure 3: Example insights from the Security Copilot-powered policy insights skill

Upskilling data security, compliance and governance with generative AI

We are also thrilled to announce new Security Copilot and Purview capabilities for beyond just data security.

The eDiscovery quick case summarization feature is designed to streamline case management by providing an intuitive, at-a-glance overview. This new capability allows users to quickly access a comprehensive summary of eDiscovery cases, holds, and searches, eliminating the need to navigate through multiple tabs. It consolidates information into a single, easy-to-understand summary, displaying status, statistics of completed actions, pending tasks, and ongoing jobs. This feature significantly reduces the time needed for investigations when dealing with large amounts of evidence data. eDiscovery also leverages AI to build search queries by generating keyword query language from natural language (NL2KeyQL) -already in Public Preview

Figure 4: eDiscovery Case summary

Other capability we’re making available now is the Knowledge Base Copilot, crafted to improve user experience by offering instant answers to general questions about the Purview platform and its solutions, utilizing public Microsoft documentation. The prompt cards are dynamically displayed based on the page context. It supports both open-prompt and zero-prompt interactions, allowing users to either submit any prompt they wish or engage with pre-defined prompts for immediate responses. This Copilot experience aims to resolve customer complaints about navigating documentation by providing direct answers to their questions, minimizing the need to open multiple tabs and search through links. Knowledge Base Copilot is a global capability accessible through the Purview portal and provides answers to queries related to all Purview solutions and capabilities.

Figure 5: guided experience in Microsoft Purview with Knowledge Based Copilot

Get started

• Learn more about Copilot for Security in Purview with Microsoft Documentation.
• If you are a security partner interested in using Microsoft Security Copilot with your solutions, please sign up to join the Security Copilot Partner Ecosystem.
• Stay up to date on our Microsoft Purview features through the Microsoft 365 Roadmap for Microsoft Purview.
• Learn more about these solutions in the Microsoft Purview compliance portal. Visit your Microsoft Purview compliance portal to activate your free trial and begin using our new features. An active Microsoft 365 E3 subscription is required as a prerequisite to activate the free trial.
• Join the community - https://aka.ms/JoinCCP
• Get started with Microsoft Copilot for Security - Get started with Microsoft Copilot for Security - Training | Microsoft Learn
• Copilot for Security Ninja - How to Become a Microsoft Copilot for Security Ninja: The Complete Level 400 Training
• Microsoft Copilot for Security Community Github - GitHub - Azure/Copilot-For-Security: Microsoft Copilot for Security is a generative AI-powered security solution that helps increase the efficiency and capabilities of defenders to improve security outcomes at machine speed and scale, while remaining com

[1] AI reduces data breach lifecycles and costs, Security Intelligence (2023)

[2] Secureworks Threat Score Ushers In a New Age of Cybersecurity AI | Secureworks (2024)