An agent triages security alerts so analysts stop drowning in false positives
Microsoft Security Copilot · 2025–ongoing
What they did
Security operations centers are flooded with alerts, most of them noise; Microsoft built an agentic triage layer into Security Copilot that investigates alerts autonomously — pulling context, correlating signals, and producing a verdict — before a human analyst ever opens the ticket.
What happened
Microsoft reports its Alert Triage Agent identifies 6.5x more malicious alerts, improves verdict accuracy by 77%, and frees analysts to spend 53% more time on real investigation instead of triage. In a named customer deployment, St. Luke's healthcare system reported the agent saving its team nearly 200 hours a month and shifting the team from reactive triage to proactive threat hunting.
The so-what
Alert triage is a well-matched job for an agent: high volume, mostly repetitive, a bounded action space (escalate or dismiss), and a human still reviewing the verdicts that matter — the profile that tends to separate real agentic wins from overreach.