Healthcare: alert triage by agents with Microsoft Security Copilot

A large hospital network runs fifteen campuses and more than three hundred outpatient sites, employs over twenty thousand people and manages several petabytes of data. Healthcare is one of the most heavily attacked sectors in the world, and phishing is the most common way in.

The problem was not a lack of security. The tooling was strong, but it sat in silos. Analysts worked through hundreds of alerts a day across multiple portals, and the vast majority of user-reported phishing turned out to be harmless. Writing an incident report took hours. The team's attention went into ruling out noise rather than into the alerts that actually mattered.

Microsoft Security Copilot sits across the existing security estate and adds agents inside the portals where the work already happened. That is the core of the design: no new console appears, the agent runs in the product where the alert originates.

In Microsoft Defender, the Security Alert Triage Agent, until recently the Phishing Triage Agent, takes over the first assessment of phishing that users report themselves. The agent investigates the submission, classifies it and records the reasoning behind that verdict. What is clearly harmless is closed autonomously; the rest goes to an analyst with the investigation already attached.

Around it, other agents do the same for their own domain. In Microsoft Entra ID, the Conditional Access Optimization Agent flags users and applications that fall outside existing access policy and proposes changes. In Microsoft Intune, the Vulnerability Remediation Agent puts endpoint vulnerabilities in order. In Microsoft Purview, triage agents assess alerts from data loss prevention and insider risk management.

The output lands in the chain that was already there. Defender delivers the protection and the signals, Microsoft Sentinel correlates them with the rest of the estate, and the analyst sees one incident instead of four separate alerts in four portals.

The scarce resource in a SOC is not tooling but analyst hours. Every alert a person does not have to open is time that goes into investigation. That is also why triage was handed over first and not response: triage is volume work with a repeatable verdict, response is context and accountability.

The second reason is that the agents run inside the existing products. A separate AI platform alongside the SOC would have been a fifth portal, and the problem was precisely that there were already too many portals.

Hiring more analysts is the classic route and it was seriously considered. It failed on availability rather than on budget: the market for security specialists in healthcare is tight, and alert volume grows faster than a team can.

Writing your own rules in the SIEM was the second option. That works well for patterns you know in advance, and that is exactly the problem with phishing: the pattern changes with every campaign. A rule set tuned to the last wave does not catch the next one.

The third variant is letting alerts sit and working on samples. It happens more often than anyone admits, and it is not a design but a consequence.

• An agent that closes autonomously will occasionally close something an analyst would have opened. That is bearable as long as the agent records why it closed and a human can review that reasoning afterwards. Without that record, autonomous closure cannot be explained to an auditor.
• Agents consume Security Copilot capacity, billed in security compute units. Turning on more agents is therefore a cost decision and not a given; it pays to start where the volume is highest.
• An agent is only as good as the signals underneath it. Wherever Defender, Entra ID, Intune and Purview are not fully rolled out, the agent sees less than an analyst would.
• Time saved only becomes a gain if the team spends it somewhere else. Without an agreement on what happens to the freed-up hours, the effect disappears into the backlog.

Microsoft Security Copilot (Security Alert Triage Agent, Conditional Access Optimization Agent, Vulnerability Remediation Agent, triage agents for Purview), Microsoft Defender XDR, Microsoft Sentinel, Microsoft Intune, Microsoft Entra ID, Microsoft Purview.

• Start with the alert type that has the highest volume and the lowest hit rate. User-reported phishing meets both criteria in almost every organisation.
• Have the agent record its reasoning and sample-check it with an analyst during the first weeks. Trust in an agent is something you build with evidence, not with a setting.
• Keep the agents in the portals where the work already takes place. A separate agent console reproduces the exact problem you set out to solve.
• Measure triage lead time before and after. Hours saved only count as a result once you have recorded the starting point.

The biggest gain was not the number of alerts closed but the lead time of an incident report. That went from hours to minutes, which moved the point at which a manager heard about something from the next day to the same hour.

What stood out is that the agents forced a conversation about coverage. As soon as an agent found less in a given domain than expected, the underlying rollout there turned out to be incomplete. In that sense the agent was as much a measuring instrument for your own configuration as an assistant.

• Microsoft Security Copilot agents
• Security Copilot agents in Microsoft Defender
• Security Alert Triage Agent in Microsoft Defender
• Conditional Access optimization agent in Microsoft Entra