Home / Cybersecurity / Microsoft Security Copilot
Microsoft (Redmond, United States)Microsoft Security Copilot
Generative AI assistant for security teams that works in Defender, Sentinel, Intune, Entra and Purview, and as a standalone environment. You ask questions in plain language for incident investigation, threat hunting and reporting.
Shared spot10of 13 professional tools with a GDPR profileOur summary of what the provider itself publishes about your data: whether the data is held in the EU (2 points), whether there is a certification or GDPR guarantee (1) and whether the provider is based in the NL or the EU (1). 3 or 4 points is Strong, 2 Good, 1 Limited, 0 Unknown. How we measure in cybersecurity
GDPR: Unknown
- Provider based outside the EU
Priceper SCU, $4/hour (example)per Security Compute Unit (SCU), price per region (calculation example Microsoft: $4 per provisioned SCU/hour, $6 per overage SCU); with Microsoft 365 E5 400 SCUs per month per 1,000 user licences included
Free trialNone foundNot found on the provider's site when checked on 6 November 2026
Based inRedmond, United StatesOutside EU
ModelNot publicuses, according to Microsoft, the Azure OpenAI foundation model. Data stays in the geo you choose when creating a workspace; prompts can be processed in the EU. Sharing data with Microsoft is on by default and can be switched off; data does not go to OpenAI and does not train the foundation model, but with opt-in it trains Microsoft's own security models. Based outside the EU (US).
Last checked: 6 November 2026 · How we check
Is this your tool? Fill in missing detailsWhat it does
Investigate incidents with step-by-step advice
Write KQL queries and analyse suspicious scriptsMap out risks and security posture
Draft and compare security policiesResolve IT problems faster
Reports for stakeholdersPlugins for Microsoft and third-party security tools
Build your own agents
Comparable in cybersecurity
SoSafefrom €625/month (billed annually…
365 Total Protectionon request
Aikido SecurityDeveloper free (2 users, 1…
TinesFree Edition free (3 live workf…
WithSecure Elementson request (Luminen without extra…
HadrianNova from €1,250 per test (bundle…Microsoft Security Copilot compared
Underlying model
GDPR check for cybersecurity uses the Azure OpenAI foundation model, according to Microsoft. Data is stored in the geo you choose when creating a workspace, and prompts can be processed in the EU. Sharing data with Microsoft is on by default and can be switched off; data is not sent to OpenAI and does not train the foundation model, but with opt-in Microsoft's own security models are trained. Headquartered outside the EU (US).
Questions about Microsoft Security Copilot
- Which AI model does Microsoft Security Copilot use?
- The maker of Microsoft Security Copilot does not publish which AI model sits underneath. According to Microsoft, it uses the Azure OpenAI foundation model. Data is stored in the geo you choose when creating a workspace, and prompts can be processed in the EU. Sharing data with Microsoft is on by default and can be switched off; data is not sent to OpenAI and does not train the foundation model, but with opt-in Microsoft's own security models are trained. Headquartered outside the EU (US).
- How much does Microsoft Security Copilot cost?
- per Security Compute Unit (SCU), price per region (calculation example for Microsoft: $4 per provisioned SCU/hour, $6 per overage SCU); with Microsoft, 365 E5 400 SCUs per month are included per 1,000 user licences. Check the current price on the provider's website; rates change often.
- Who is Microsoft Security Copilot for?
- Microsoft Security Copilot focuses on cybersecurity. It fits work such as detection and triage: assessing, grouping and summarising alerts from endpoints, network, cloud and email; investigation and response: finding out what happened in incidents, building search queries and proposing or carrying out countermeasures; and attack surface and pentesting: mapping reachable systems and testing for vulnerabilities with AI agents.
- What should I watch out for with AI in cybersecurity?
- A security tool sees everything: log files, emails, usernames and network traffic. That is personal data, so you need a data processing agreement and must know where the data is stored. Also ask whether the AI assistant is trained on your data. WithSecure (Finland) says it processes data for Luminen in AWS in Europe and does not train foundation models on customer data. Sekoia stores data in Germany or elsewhere in the EU/EEA and is ISO 27001 certified. SoSafe (France) can run self-hosted. With Microsoft Security Copilot you choose the geo of your workspace, but sharing data with Microsoft is on by default. For Charlotte AI, ESET LiveAI and Mindgard the hosting location is not public. Never let an agent act on production systems without analyst approval, and record who makes the 24-hour report under the Cybersecurity Act when an incident occurs.
Every Friday: what changed in AI for cybersecurity
New models, prices, oversight and tools, with sources and what it means for you. One email a week, unsubscribe with one click.