St. Luke’s University Health Network uses the Phishing Triage Agent in Microsoft Defender, powered by Security Copilot, to handle the bulk of user-reported suspicious emails.

Previously, analysts spent hours each day manually reviewing hundreds of alerts across multiple portals. Now, the Phishing Triage Agent:

• Uses advanced language models to understand the content and intent of reported emails.
• Automatically classifies submissions as genuine phishing or false positives.
• Autonomously closes thousands of false positive alerts, with clear, plain-text explanations for each decision.

As a result, St. Luke’s is saving nearly 200 hours every month on phishing alert triage. Analysts no longer need to double-check every incident and can instead focus on proactive threat hunting and higher-value investigations. This shift has helped reduce burnout, improve response times, and ensure that real threats are surfaced more quickly.

St. Luke’s had a strong security stack—Microsoft Defender, Microsoft Sentinel, Microsoft Entra, Microsoft Purview, and other tools—but they were operating in silos. The team lacked a single, real-time view across endpoints, email, identities, applications, and cloud workloads.

Security Copilot acts as an AI layer across this entire stack, effectively becoming the “connective tissue” that:

• Consolidates alerts, access controls, and vulnerabilities into a single, unified view.
• Correlates signals from multiple platforms to identify threats in real time.
• Surfaces AI-driven insights and recommendations directly in analysts’ existing workflows.

This unified visibility helps St. Luke’s:

• Spot gaps and weaknesses in their environment.
• Move from reactive response to more predictive, proactive analytics.
• Make faster, data-driven decisions without jumping between multiple dashboards.

In practice, this reimagines their security operations from a set of disconnected tools into a cohesive, AI-first security posture that better supports both day-to-day operations and long-term strategy.

St. Luke’s is an early adopter of several Security Copilot agents that help automate and streamline different parts of their security operations. In addition to the Phishing Triage Agent in Defender, they are using:

• Conditional Access Optimization Agent in Microsoft Entra – Helps refine and optimize conditional access policies so the team can balance security with clinician and staff productivity.
• Vulnerability Remediation Agent in Microsoft Intune – Assists with prioritizing and addressing vulnerabilities across thousands of endpoints.
• Alert Triage Agents in Microsoft Purview DLP and IRM – Support faster triage of data loss prevention and information protection alerts.

These agents work alongside Security Copilot’s core capabilities, such as:

• Automated incident reporting in Defender, which cuts report creation from hours to minutes for a workforce of more than 23,000 employees.
• Embedded guidance that helps analysts understand incidents step-by-step and collaborate more effectively.

Together, these agents help St. Luke’s reshape daily security work—moving repetitive, manual tasks to AI-driven agents and freeing the Security Operations Center to focus on complex threats, strategic improvements, and maintaining resilience across 15 campuses, 300 outpatient sites, and more than 2.5 petabytes of data.