Security Copilot: Expanding and Expensive

• Security Copilot can help admins using Microsoft 365 management tools to perform security-related tasks faster.
• A plugin architecture lets the Copilot integrate with other services, including their administrative consoles.
• Licensing is independent from Microsoft 365 services, and other Copilots and can be expensive if used heavily.

Security Copilot is a set of capabilities that integrates into Microsoft 365 services to help investigate, summarize, and report on security incidents more rapidly. Security Copilot features its own stand-alone console but is also integrated into the Microsoft Defender XDR portal and consoles of numerous other Microsoft 365 services. Security Copilot offers potential value by speeding the work of experienced analysts while helping new analysts rapidly learn the intricacies of disparate security and management tools. Security Copilot is not included in Microsoft 365 suites or other Copilot licenses. Instead, it uses a complex new metering system that charges for hourly usage. Security Copilot agents, in preview and available later in 2025, will increase this cost.