Microsoft’s security Copilot gets a deeper reasoning layer for triaging data risk

Microsoft’s July security update, published Thursday, centers on the general availability of the Data Security Triage Agent within Microsoft Purview’s Insider Risk Management product, an AI reasoning layer designed to cut through alert fatigue by performing deeper, multi step analysis across user behavior, device activity, and data movement signals rather than scoring each in isolation. The agent is meant to surface the small subset of incidents that genuinely warrant a human analyst’s attention while suppressing lower confidence noise, and Microsoft says security teams can now filter across both traditional alert attributes and the new agent generated attributes from a single unified page, preview the agent’s case summaries and relevant user details without navigating away, and document investigation findings while the system automatically logs status changes and escalations to preserve a clear audit trail. Microsoft frames the release as part of a broader push to embed agentic reasoning throughout its security products rather than treating AI as a bolt on feature, following earlier previews of similar triage agents inside Microsoft Defender. Together with other changes detailed in the same July roundup, Microsoft says the goal is to let leaner security teams investigate faster and with more confidence, at a moment when the volume of alerts generated by increasingly automated attack tooling, including AI driven reconnaissance, continues to climb faster than security team headcounts.