At a glance
The challenge
A threat on one device can spread across a business fast. Investigating properly takes time, and on average it took four hours to get from the first alert to agreed containment.
The impact
We paired an AI investigation agent with automated response playbooks. Containment now takes under 45 minutes, with an experienced analyst approving every action.
Key services
AI-assisted investigation
Endpoint security
Security automation
Containment playbooks
Technologies
Microsoft Sentinel
Microsoft Defender
A threat on one laptop doesn't stay there for long
Attackers rarely stop at the first device they reach. Once they're in, they look for the next one. Investigating suspicious activity properly takes time, though, and while our analysts worked through process logs and alerts, the business stayed exposed.
On average, it took four hours to get from the first alert to agreed containment. That's a long time to leave a door open.
Closing the gap between knowing and stopping
We paired an AI investigation agent with automated response playbooks for our SOC. The goal was simple: close the gap between understanding a threat and stopping it, without taking human approval out of the loop.
The agent reviews process activity and alerts from the customer's devices, finds every affected device, and recommends how to contain the threat. One of our analysts checks the evidence. Once they sign it off, our automation runs the isolation actions you've already approved, usually within five minutes.
How it works
Suspicious activity spotted
:A device shows signs of a threat, such as an unusual process.
AI investigates
:The agent reviews the activity and finds every affected device.
Containment recommended
The agent proposes how to isolate the threat, with the evidence attached.
Analyst approves
One of our analysts signs it off, and pre-approved actions run automatically.
Automation you can trust
Isolating a device can stop someone working, so it's not a decision to hand over to a machine. Customers agree the actions in advance, and an analyst approves every one in the moment. The automation simply makes sure that, once the decision's made, nothing slows it down.
What's changed
We've cut the average time to contain an endpoint threat from four hours to under 45 minutes. We find affected devices 70% faster, so our customers can stop an incident spreading before it disrupts their business. And an experienced analyst still approves every containment action.
"Speed matters, but so does getting it right. The AI gets us to a confident decision faster, and the automation makes sure we act on it straight away."
Head of Security Operations, ITPS
Why it matters
Every minute a threat goes uncontained is a minute it can spread, steal data, or disrupt the business. Cutting that window from hours to minutes changes what an incident means for our customers: a short interruption on one device, rather than a problem across the whole organisation.
Interested?
Find out how we'll spot a compromised account fast, and help you shut misuse down before it spreads.
