Security Copilots, Agents & DLP Analytics Engine

Overview

Designed and delivered an AI layer on Microsoft's Security Platform - enabling Copilot for Security (CfS) skills, agents, and functions that give security practitioners AI-powered capabilities across data protection, compliance, insider risk, and threat management.

The Challenge

Enterprise security teams face an overwhelming volume of alerts, incidents, and compliance signals. Manual triage and investigation processes were slow, expensive, and didn't scale. Microsoft needed an AI-native approach to security operations that could augment human analysts across the entire security lifecycle.

Strategic Approach

The work spanned three interconnected workstreams that together position Microsoft as the only vendor delivering comprehensive, end-to-end AI integration across the security lifecycle:

• Unified AI Platform Architecture - Grounded in competitive intelligence, designed a platform layer enabling AI capabilities across all Purview workloads
• Horizontal CfS Skills - Built Copilot for Security skills to accelerate consumption across Purview and USX, making AI accessible to every security practitioner
• Kendra (Deep Research Agent) - A security research agent for multi-day analytical tasks, enabling deep investigation beyond surface-level triage

GenAI Copilot & Agents for Purview

Spearheaded the development of GenAI-based Copilot and Agents for Microsoft Purview. These AI capabilities were designed to give security teams intelligent assistance in real-time - from summarizing incidents to recommending remediation actions. The system drove 16K+ monthly invocations and achieved 30% faster triage, fundamentally changing how security analysts work.

ML-Based DLP Analytics Engine

Launched an ML-based Data Loss Prevention Analytics Engine that surfaces sensitive data insights, identifies risk users, and detects policy anomalies. The engine's recommendations achieved 50%+ admin adoption, directly fueling 20% month-over-month growth in Monthly Protected Users - a key business metric for the platform.

Outcome & Impact

This initiative transformed Microsoft's security offering from reactive tooling to proactive AI-powered defense. The combination of Copilot skills, deep research agents, and ML-driven analytics created a flywheel: more AI usage leads to better models, which drives more adoption, which generates more value for customers.