St. Luke’s University Health Network used Microsoft Security Copilot as an AI layer across its existing Microsoft security stack to unify operations and gain real-time visibility. Before Security Copilot, the team relied on strong but disconnected tools, including Microsoft Defender, Microsoft Sentinel, Microsoft Entra, and Microsoft Purview. Analysts had to move between multiple portals and dashboards to understand what was happening, which slowed investigations and made it harder to see how individual alerts were related. Security Copilot in Microsoft Defender became the “connective tissue” across these platforms. It: - Consolidates alerts, access controls, and vulnerability data into a single, AI-powered view. - Correlates signals from endpoints, email, identity, applications, and cloud workloads. - Surfaces insights in real time so analysts can anticipate and disrupt attacks earlier in the chain. By embedding AI-driven guidance directly into daily workflows, St. Luke’s reimagined how its Security Operations Center (SOC) works. Analysts now: - See cross-platform threats in one place instead of jumping between tools. - Use AI-generated context and recommendations to make faster, data-driven decisions. - Identify gaps and weaknesses in coverage, then use that information to shape security roadmaps and strategies. In short, Security Copilot helped St. Luke’s move from a set of siloed tools to a more unified, AI-first security posture that supports both day-to-day operations and long-term planning.

The Phishing Triage Agent in Microsoft Defender delivered clear, measurable impact for St. Luke’s, particularly around efficiency and analyst focus. Key results: - Nearly **200 hours saved every month** on phishing alert triage. - Thousands of **false positive alerts** are now handled and closed autonomously. - Triage work that previously took **hours per day** now takes **minutes**, because everything is consolidated in one place. How it works in practice: - The agent uses advanced language model–based analysis to understand the content and intent of user-reported emails. - It classifies submissions as genuine phishing attempts or false alarms and provides plain-text explanations for its decisions. - Over time, the St. Luke’s team gained confidence in the accuracy of these classifications and no longer needs to double-check every incident. Business and team impact: - SOC analysts have shifted from **reactive triage** to **proactive threat hunting**, focusing on real threats instead of routine noise. - The reduction in repetitive work supports **analyst satisfaction** and helps reduce burnout. - The agent effectively acts as a 24/7 digital team member, doing the heavy lifting so human analysts can apply their expertise where it matters most. For a large healthcare network with 15 campuses, 300 outpatient sites, and more than 2.5 petabytes of data and patient records in motion, these time savings and focus gains are significant. They help St. Luke’s protect patient care operations while managing a high volume of phishing attempts, which the organization identifies as its biggest attack vector.

Security Copilot has helped St. Luke’s streamline incident response and reporting by embedding AI into the tools analysts already use and automating time-consuming steps. Faster triage and investigation: - Before Security Copilot, analysts spent **hours** each day triaging and understanding hundreds of alerts, often digging through multiple portals and tabs. - With Security Copilot, alerts and related context are consolidated, so triage now takes **minutes** instead of hours. - AI-generated summaries and correlations help analysts quickly see how alerts are connected and what to prioritize. More efficient incident reporting: - St. Luke’s has more than **23,000 employees** and manages millions of patient records, so compliance and clear documentation are critical. - Previously, creating a detailed incident report by hand could take **hours**. - With Security Copilot in Defender, the team can generate clear, sequential incident reports in **minutes**. Analysts then add any needed context and escalate to leadership or forensics with confidence. Operational and collaboration benefits: - Routine, repetitive tasks are automated, allowing analysts to focus on higher-value work such as threat hunting and strategic improvements. - All relevant incident information is available in one location, which improves collaboration across the security team and reduces the need to switch between tools. - By highlighting where visibility is limited or where gaps exist, Security Copilot supports ongoing improvements to St. Luke’s security roadmap. Overall, Security Copilot helps St. Luke’s rethink incident response from a manual, fragmented process to a more integrated, AI-assisted workflow that supports both operational efficiency and regulatory requirements in a complex healthcare environment.