St. Luke’s University Health Network uses Microsoft Security Copilot as an AI layer across its existing security stack (including Microsoft Defender, Sentinel, Entra, Purview, and Intune) to unify and automate key security workflows.

Two areas show clear, measurable impact:

• Phishing alert triage: The Phishing Triage Agent in Microsoft Defender now autonomously handles and closes thousands of false positive alerts. This shift saves St. Luke’s nearly 200 hours every month that were previously spent manually reviewing user-reported suspicious emails.
• Incident reporting: Creating incident reports used to take hours of manual effort. With Security Copilot embedded in Defender, reports are generated in minutes instead of hours, and the team simply adds context before sharing with leadership or forensics.

By consolidating alerts, access controls, and vulnerabilities into a single, AI-powered view, Security Copilot helps analysts move from reactive triage to more proactive threat hunting, while reducing repetitive work and analyst burnout.

St. Luke’s University Health Network operates 15 campuses, 300 outpatient sites, and manages more than 2.5 petabytes of data and patient records in motion. In this environment, the security team faced several key challenges:

• Fragmented visibility: Although they already used tools like Microsoft Defender, Sentinel, Entra, and Purview, these solutions were largely disconnected. The team lacked unified, real-time visibility across platforms to anticipate and disrupt attacks earlier.
• High-volume phishing and DDoS risk: Healthcare is described as the number one cyberattack target, with phishing as the biggest threat vector and DDoS attacks capable of shutting down systems and disrupting patient care and revenue.
• Manual, time-consuming triage: Analysts were inundated with hundreds of alerts and user-reported suspicious emails every day. Triage required digging through multiple portals and tabs, taking hours to understand and prioritize alerts.
• Difficulty spotting subtle threats: With millions of daily signals and increasingly sophisticated, AI-driven attacks, it was hard to apply behavioral analytics at scale using manual methods and traditional dashboards alone.

St. Luke’s adopted Security Copilot and its agents to reimagine how their SOC operates: unifying data, embedding AI-guided insights into daily workflows, and automating repetitive tasks. This helps them identify gaps in coverage, respond faster to real threats, and maintain resilience while supporting uninterrupted patient care.

St. Luke’s is an early adopter of several Security Copilot agents that work across Microsoft’s security ecosystem to automate tasks and improve decision-making:

• Phishing Triage Agent (Microsoft Defender):
  • Uses advanced language model analysis to understand the content and intent of user-reported emails.
  • Determines whether an email is a genuine phishing attempt or a false positive.
  • Saves nearly 200 hours monthly by autonomously handling and closing thousands of false positive alerts.
  • Provides plain-text explanations for its decisions, giving analysts confidence to focus on real threats instead of re-checking every case.
• Conditional Access Optimization Agent (Microsoft Entra):
  • Helps refine and optimize conditional access policies.
  • Supports better control over identities and access without adding unnecessary friction for clinicians and staff.
• Vulnerability Remediation Agent (Microsoft Intune):
  • Assists in identifying and prioritizing vulnerabilities across thousands of endpoints.
  • Guides remediation efforts so the team can address the most important issues first.
• Alert Triage Agents (Microsoft Purview DLP and IRM):
  • Help sort and prioritize data loss prevention and information protection alerts.
  • Reduce noise so analysts can focus on incidents that truly matter.

Together, these agents act as an AI-powered assistant embedded in the SOC’s daily workflow. They consolidate information in one place, shorten triage from hours to minutes, improve collaboration, and support a more proactive, AI-first security strategy.