St. Luke’s University Health Network is using Microsoft Security Copilot as an AI layer across its existing Microsoft security stack to unify visibility and speed up response. They already had tools like Microsoft Defender, Sentinel, Entra, and Purview, but these were operating in silos. Security Copilot now acts as the “connective tissue” across these platforms, giving analysts a consolidated, real-time view of:

• Alerts across endpoints, email, identity, apps, and cloud workloads
• Access controls and conditional access policies
• Vulnerabilities and data loss prevention alerts

With Security Copilot embedded directly into daily workflows, analysts can:

• Correlate threats across systems instead of pivoting between multiple portals
• Move from reactive triage to more proactive threat hunting
• Generate incident reports in minutes instead of hours

For St. Luke’s, this AI-first approach is helping them reimagine security operations as a more predictive, proactive function, rather than a purely reactive one, while still working within the tools they already use.

St. Luke’s is seeing clear, measurable impact from Security Copilot agents, particularly in phishing triage and incident handling. Key outcomes include:

• ~200 hours saved every month in phishing alert triage, thanks to the Phishing Triage Agent in Microsoft Defender.
• The agent autonomously handles and closes thousands of false positive alerts, so analysts no longer need to manually review each one.
• Incident reports that previously took hours to compile can now be created in minutes within Defender using Security Copilot.

The Phishing Triage Agent uses advanced language model–based analysis to understand the content and intent of user-reported emails and classify them as genuine phishing or false alarms. Over time, the St. Luke’s team has gained enough confidence in the agent’s accuracy that they no longer double-check every decision. As a result:

• SOC analysts spend less time on repetitive triage work
• They can focus more on real threats and proactive threat hunting
• Analyst satisfaction improves and burnout risk is reduced

Beyond phishing, St. Luke’s is also piloting other agents, such as:

• Conditional Access Optimization Agent in Entra
• Vulnerability Remediation Agent in Microsoft Intune
• Alert Triage Agents in Purview DLP and IRM

Together, these agents help the team operate at scale across thousands of endpoints, identities, and cloud workloads.

Security Copilot gives St. Luke’s AI-powered visibility that goes beyond traditional dashboards and manual analysis. This helps the team both see threats faster and understand their own weaknesses more clearly. Key benefits include:

• Real-time threat identification: Copilot summarizes millions of daily security signals into actionable insights, so analysts can quickly see what matters most.
• Context-rich guidance: The system provides plain-text explanations for why an email or alert is classified as malicious or benign, supporting faster, data-driven decisions.
• Gap analysis: Leaders use Copilot to understand “where we’re not seeing things” and identify blind spots in coverage, which then inform security roadmaps and investment priorities.
• Embedded in existing workflows: Instead of adding another standalone tool, Copilot is integrated into Defender and other Microsoft security products, so analysts work in one place rather than jumping between multiple portals and tabs.

For a large healthcare network with 15 campuses, 300 outpatient sites, more than 23,000 employees, and over 2.5 petabytes of data and patient records in motion, this unified, AI-driven view helps St. Luke’s:

• Respond more quickly to phishing and DDoS threats
• Maintain compliance with clear, sequential incident reporting
• Build a self-improving, AI-first security ecosystem that can adapt as threats and business needs evolve

In practice, the team describes Security Copilot as almost like having an additional expert on staff—a mentor that guides analysts, helps them mature their processes, and supports a more resilient, end-to-end security posture.