St. Luke's saves nearly 200 hours monthly with AI-powered Security Copilot agents | Microsoft Customer Stories
What does unified security visibility change? St. Luke's University Health Network needed a real-time view across multiple platforms to disrupt attacks earlier in the chain. This customer story shows how Security Copilot in Microsoft Defender delivered an AI-powered, agentic view of alerts, access controls, and vulnerabilities, saving nearly 200 hours monthly in phishing triage. Read the story to learn from St. Luke's experience, then talk with RYCOMM LLC about applying Security Copilot in your environment.
How did St. Luke’s use AI to save nearly 200 hours a month on phishing triage?
St. Luke’s University Health Network uses the Phishing Triage Agent in Microsoft Defender, powered by Security Copilot, to handle the bulk of user-reported suspicious emails.
Previously, analysts spent hours each day manually reviewing hundreds of alerts across multiple portals. Now, the Phishing Triage Agent:
- Uses advanced language models to understand the content and intent of reported emails.
- Automatically classifies submissions as genuine phishing or false positives.
- Autonomously closes thousands of false positive alerts, with clear, plain-text explanations for each decision.
As a result, St. Luke’s is saving nearly 200 hours every month on phishing alert triage. Analysts no longer need to double-check every incident and can instead focus on proactive threat hunting and higher-value investigations. This shift has helped reduce burnout, improve response times, and ensure that real threats are surfaced more quickly.
How does Security Copilot unify St. Luke’s security tools and visibility?
St. Luke’s had a strong security stack—Microsoft Defender, Microsoft Sentinel, Microsoft Entra, Microsoft Purview, and other tools—but they were operating in silos. The team lacked a single, real-time view across endpoints, email, identities, applications, and cloud workloads.
Security Copilot acts as an AI layer across this entire stack, effectively becoming the “connective tissue” that:
- Consolidates alerts, access controls, and vulnerabilities into a single, unified view.
- Correlates signals from multiple platforms to identify threats in real time.
- Surfaces AI-driven insights and recommendations directly in analysts’ existing workflows.
This unified visibility helps St. Luke’s:
- Spot gaps and weaknesses in their environment.
- Move from reactive response to more predictive, proactive analytics.
- Make faster, data-driven decisions without jumping between multiple dashboards.
In practice, this reimagines their security operations from a set of disconnected tools into a cohesive, AI-first security posture that better supports both day-to-day operations and long-term strategy.
What other Security Copilot agents is St. Luke’s using beyond phishing triage?
St. Luke’s is an early adopter of several Security Copilot agents that help automate and streamline different parts of their security operations. In addition to the Phishing Triage Agent in Defender, they are using:
- Conditional Access Optimization Agent in Microsoft Entra – Helps refine and optimize conditional access policies so the team can balance security with clinician and staff productivity.
- Vulnerability Remediation Agent in Microsoft Intune – Assists with prioritizing and addressing vulnerabilities across thousands of endpoints.
- Alert Triage Agents in Microsoft Purview DLP and IRM – Support faster triage of data loss prevention and information protection alerts.
These agents work alongside Security Copilot’s core capabilities, such as:
- Automated incident reporting in Defender, which cuts report creation from hours to minutes for a workforce of more than 23,000 employees.
- Embedded guidance that helps analysts understand incidents step-by-step and collaborate more effectively.
Together, these agents help St. Luke’s reshape daily security work—moving repetitive, manual tasks to AI-driven agents and freeing the Security Operations Center to focus on complex threats, strategic improvements, and maintaining resilience across 15 campuses, 300 outpatient sites, and more than 2.5 petabytes of data.
St. Luke's saves nearly 200 hours monthly with AI-powered Security Copilot agents | Microsoft Customer Stories
published by RYCOMM LLC
Trusted by many small and medium size businesses in New England and nationwide, RYCOMM is an IT services company, focused on helping businesses with their IT needs and challenges.
We have been providing simplified IT solutions for unique customers since 1998. We use the latest technology in the market and have years of experience supporting companies. Our expertise is unmatched in the Managed IT Service provider space because we have seen what works and what doesn’t, both operating as a service provider and on the receiving end, managing outsourced IT Service providers ourselves to fill in gaps in large enterprise deployments.
Our company has been designed to provide a better user experience, save money, prevent downtime, and provide a comprehensive IT solution to fit your business’s needs.
We provide a variety of IT support and managed IT solutions tailored to fit your business needs. We offer managed services, including end-user support, cloud migrations, disaster recovery, network and server monitoring, help desk, telephony, business continuity services and strategic planning. We also offer Managed IT Service plans with complete management on a per user, per month pricing model.
RYCOMM also provides a large selection of hardware and software choices for your IT environment. Our technology experts design and configure solutions using the latest technologies from industry leaders.
We are a comprehensive Technology Consulting firm providing complete IT outsourcing, that manages all your technology needs, so you can focus on your business.
Sign in with LinkedIn