![\"copilotapp5gettyimages-2233012551\"](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2025\/11\/copilotapp5gettyimages-2233012551.jpg\")
Thomas Trutschel\/Contributor\/Photothek via Getty Images<\/p>\n Thomas Trutschel\/Contributor\/Photothek via Getty Images<\/p>\n
Follow ZDNET: Add us as a preferred source<\/a> on Google.<\/p>\n ZDNET’s key takeawaysMicrosoft announced new or improved AI security agents at Ignite.Security agent functionality is surfaced within Microsoft’s relevant management portal.The agents are free to all Copilot Security customers with 365 E5 subscriptions.<\/p>\n Earlier this week at Microsoft’s Ignite conference in San Francisco, the overwhelming onslaught of artificial intelligence-related announcements made it easy to miss some of the company’s more significant “all-AI all-the-time” news.\u00a0<\/p>\n Also: Microsoft’s new AI agents create your Word, Excel, and PowerPoint projects now<\/a><\/p>\n The word “Copilot” — representative of Microsoft’s flagship AI brand — made thousands of appearances across virtually every functional area of the technology firm’s offerings, a testimony to an AI-first strategy that also blanketed its portfolio of security-related solutions.\u00a0<\/p>\n AI enters the cat-and-mouse security game<\/p>\n Cybersecurity has always resembled a cat-and-mouse game. Just when the IT department manages to close off one form of intrusion, the adversaries evolve to find another, and the vicious cycle continues. Such has been the case with an ever-evolving series of tactics, techniques, and procedures (TTPs) used by the threat actors who’ve been exfiltrating billions of customer records<\/a> from the Salesforce instances belonging to some of the world’s biggest and most well-known brands.\u00a0<\/p>\n Naturally, it’s only a matter of time before hackers start to harness the scalability and speed of AI to more successfully pursue their exploits. For example, Anthropic — developer of the popular Claude LLM — published a report<\/a> earlier this month that revealed the following:<\/p>\n “In mid-September 2025, we detected suspicious activity that later investigation determined to be a highly sophisticated espionage campaign. The attackers used AI’s ‘agentic’ capabilities to an unprecedented degree — using AI not just as an advisor, but to execute the cyberattacks themselves.”<\/p>\n It should come as no surprise that, as a part of the cat-and-mouse game, Microsoft and other companies are now looking to AI to help their customers even the playing field. Buried in the noise of all of Microsoft’s Ignite AI announcements — including how AI agents will help us code software<\/a> and enable data centers for autonomous self-repair<\/a>\u00a0— was news of a slew of Microsoft and partner-provided AI agents designed to close off new security vulnerabilities before threat actors are able to discover or exploit them.\u00a0<\/p>\n Also: Microsoft’s new recovery tools rebuild Windows when it glitches \u2013 here’s how<\/a><\/p>\n Microsoft had previously issued AI agents to improve customer agility in the race against threat actors. However, in this latest round of additional agent announcements and improvements, Microsoft is also standardizing on how those agents are made contextually available across its existing security and management tools.<\/p>\n “We are introducing a dozen new and enhanced Microsoft Security Copilot agents, available in Microsoft Defender<\/a>, Microsoft Entra<\/a>, Microsoft Intune<\/a>, and Microsoft Purview<\/a>, to empower security teams to shift from reactive responses to proactive strategies and help transform every aspect of organizational security,” wrote corporate vice president for Microsoft Security Vasu Jakkal<\/a> in a blog post<\/a>. “These adaptive agents run side by side with security teams to triage incidents, optimize conditional access policies, surface threat intelligence, and maintain secure, compliant endpoints more easily.”\u00a0<\/p>\n This table shows a partial list of various Microsoft-developed security-oriented AI agents and the security dashboard into which the company is contextually exposing their functionalities.\u00a0<\/p>\n Screenshot by David Berlind\/ZDNET<\/p>\n As shown in the table above, the specific roles of the various agents determine which of the security management tools they’re exposed in. For example, whereas agents specific to identity management will contextually appear in Microsoft’s Entra identity management solution, agents specific to endpoint security will be integrated into Microsoft Intune.<\/p>\n Availability of Microsoft-built agents \u00a0<\/p>\n The availability of new Microsoft-built agents — along with additional partner-provided agents — will be surfaced through storefronts (all powered by a central Microsoft security store that was\u00a0previewed on September<\/a>\u00a030<\/a>) that are also contextually embedded into the appropriate Microsoft security and management dashboards.\u00a0<\/p>\n Also:\u00a0Microsoft’s new AI agents won’t just help us code, now they’ll decide what to code<\/a><\/p>\n As shown in the screenshot below, agents such as Microsoft’s Phishing Triage Agent (lower right) are being surfaced in a storefront that’s built into the company’s Defender security operations solution.\u00a0<\/p>\n Microsoft and partner-provided AI agents are contextually surfaced within the relevant management portal.<\/p>\n Microsoft<\/p>\n The Phishing Triage Agent went into public preview in March 2025 and its general availability was announced at Ignite. According to Microsoft, the Phishing Triage Agent “autonomously handles user-submitted phishing reports at scale. The agent classifies incoming alerts and resolves false positives, escalating only the malicious cases that require human expertise.”<\/p>\n Reflecting Microsoft’s standardized approach to contextually surfacing agents within the appropriate management console, the company’s Threat Intelligence Briefing agent, first introduced in March<\/a>, is now embedded into the Microsoft Defender portal. The agent not only gathers timely briefings from a variety of different threat intelligence sources, but it also assesses the risk of each briefing, makes recommendations on how to address it, and links to the specific assets within the organization that correspondingly require immediate attention.\u00a0<\/p>\n Also: Apple, Microsoft, or Google: Whose platform authenticator rules our passkey future?<\/a><\/p>\n Within Entra, Microsoft has improved its Copilot Conditional Access Optimization Agent<\/a>, designed to monitor policies across devices and identities. Many of these will be AI agents themselves as the company pursues a strategy where agent identities are treated with the same first-class citizenship that human identities get within an organization’s digital infrastructure. (This approach is advocated by the OpenID Foundation<\/a> as well as Okta, a competitor to Microsoft on the identity management front<\/a>.) For example, the agent can identify a spike in sign-in failures, investigate the policy that may have triggered the issue, and recommend steps to resolve the problem before other users are affected.\u00a0<\/p>\n There are many other new and improved agents — too many to enumerate here. However, importantly, the Microsoft-provided agents will be made available to existing Security Copilot customers with Microsoft 365 E5 subscriptions at no additional charge, and eventually, to non-Copilot customers, who will be notified 30 days in advance of when they can activate them.\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"Thomas Trutschel\/Contributor\/Photothek via Getty Images Follow ZDNET: Add us as a preferred source on Google. ZDNET’s key takeawaysMicrosoft…\n","protected":false},"author":2,"featured_media":300690,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[62,276,277,49,48,61],"class_list":["post-300689","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-ca","tag-canada","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/300689","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/comments?post=300689"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/posts\/300689\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media\/300690"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/media?parent=300689"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/categories?post=300689"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ca\/wp-json\/wp\/v2\/tags?post=300689"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}} <\/p>\n
<\/p>\n