Microsoft Overhauls Defender and Copilot with AI Agents and Unified App

Microsoft is making significant strides in integrating artificial intelligence into its security and productivity tools. The company has launched the Integrated Security Operations Center (ISOC) within Microsoft Defender, embedding AI agents to streamline security operations.同时, Microsoft has unveiled a unified Copilot app, consolidating AI chat, coding, and autonomous agents into a single interface with three distinct modes: Home, Code, and Autopilot.

Microsoft Launches Integrated Security Operations Center in Defender

Microsoft has introduced the Integrated Security Operations Center (ISOC) within its Microsoft Defender platform, according to SiliconANGLE. The new service is designed to rebuild security operations around artificial intelligence agents, integrating features previously exclusive to Microsoft Sentinel directly into Defender.

ISOC aims to address the growing challenge of AI-driven cyber threats, which enable attackers to operate with fewer resources. Key features, such as case management, workbooks, and automation playbooks, are available out of the box in the Defender portal. However, some advanced capabilities—like user and entity behavior analytics—require additional setup and an Azure subscription.

The service includes over 500 connectors for external data sources, though Microsoft warns that ingestion charges may apply. The company is promoting an "integrated protection loop," where telemetry, threat intelligence, and exposure data feed directly into Defender’s controls, enabling real-time responses to intrusions.

AI agents in ISOC receive the same signals and controls as human analysts, allowing them to investigate and act on incidents without a separate operating model. However, high-stakes actions still require human approval, reflecting Microsoft’s cautious approach to AI autonomy.

ISOC builds on Microsoft’s earlier Project Perception and its in-house security model, MAI-Cyber-1-Flash, which were introduced in July.

The public preview of ISOC is available for customers with Microsoft Defender Suite, Microsoft 365 E5, or E7 licenses, excluding those with active Microsoft Sentinel workspaces. Pricing details have not yet been disclosed, and a technical ask-me-anything session is scheduled for October 6.

Copilot Gets a Unified App with Autopilot, Code, and Home Modes

Microsoft has unveiled a revamped version of its Copilot app, consolidating AI chat, coding, and autonomous agents into a single interface. According to reports from Engadget, Gizmodo, and SiliconANGLE, the new app features three tabs: Home, Code, and Autopilot.

The Home tab serves as a central hub for AI chat and task automation, integrating updates from emails, Teams messages, and other work-related notifications. Microsoft plans to introduce intelligent routing, allowing the app to automatically switch between modes based on the complexity of a user’s request. For example, a simple query may stay in Chat mode, while a more complex task could trigger Autopilot.

The Code tab enables non-technical users to create apps, dashboards, and automations using natural language prompts. Powered by the same technology as GitHub Copilot, this feature runs in a secure sandbox within Microsoft 365 and will soon be available to enterprise customers. It is particularly targeted at regulated industries concerned about compliance and governance.

The Autopilot tab introduces agentic capabilities, allowing Copilot to handle long-running tasks autonomously. Formerly known as Scout, Autopilot is described as an "always-on personal agent" that can manage tasks like responding to threads or automating recurring processes. Unlike basic Copilot functions, which are covered under a per-user license, Autopilot and Code are billed based on usage, depending on the scope and complexity of tasks.

Microsoft’s unified Copilot app absorbs the consumer-facing Copilot and offers users the choice between AI models from OpenAI, Anthropic, or an Auto mode that selects the best model for each request. The app was primarily engineered for enterprise customers, though it is also available to consumers—roughly 90 million of whom pay for Microsoft 365 out of pocket.

According to The Next Web, fewer than 7% of Microsoft’s 450 million commercial Office 365 seats currently have AI add-on licenses. Microsoft plans to share more details about Copilot at its Ignite conference in November.

Microsoft Retires Copilot+ PC Branding

Microsoft has quietly retired the "Copilot+ PC" branding for its Surface laptops, according to Mashable. The branding, introduced in mid-2024 as part of Microsoft’s AI push, was notably absent from the company’s latest hardware launches.

The Copilot+ PCs were designed to showcase AI capabilities in Windows but reportedly underperformed in meeting Microsoft’s expectations. The company has instead shifted its focus toward software-based AI integrations, including the newly unified Copilot app.

Alongside the branding change, Microsoft also retired its Copilot-branded mascot, Mico. The moves reflect a broader reevaluation of Microsoft’s AI strategy, particularly in how it markets AI-powered hardware and software.

Background: Microsoft’s AI and Security Push

Microsoft has been aggressively integrating AI into its enterprise and consumer products, with a focus on automation, cybersecurity, and productivity tools. The company’s AI assistant, originally launched as Bing Chat in early 2023, has undergone multiple rebrandings, including Copilot for Microsoft 365 and a standalone Copilot app.

The launch of ISOC in Defender follows Microsoft’s earlier experiments with AI-driven security tools, such as Project Perception and MAI-Cyber-1-Flash, its first in-house security model. These initiatives highlight Microsoft’s ambition to leverage AI for both threat detection and response, while maintaining human oversight for critical decisions.

In the productivity space, Microsoft’s Copilot has faced fragmentation, with separate interfaces and features for consumers and enterprises. The new unified app aims to address this by combining AI chat, coding, and autonomous agents into a single experience, aligning with trends seen in competitors like OpenAI and Anthropic.

What this means

LazyFounders analysis — our interpretation, not reported fact.

Microsoft’s latest moves signal a strategic shift toward consolidating its AI and security products into more cohesive, scalable platforms. The Integrated Security Operations Center (ISOC) in Defender is a direct response to the rising complexity of AI-driven cyber threats, aiming to simplify security operations for enterprises while embedding AI agents as a core component.

For founders and operators, this is a clear indicator of where Microsoft sees the future of cybersecurity: fewer silos, more automation, and AI agents working alongside human teams. The requirement for human approval on high-stakes actions also reflects a cautious approach to AI governance, likely influenced by both regulatory pressures and enterprise concerns about autonomy.

The Copilot update, on the other hand, is Microsoft’s attempt to unify its fragmented AI offerings into a single, more intuitive interface. The introduction of Autopilot and Code tabs—alongside usage-based billing—suggests Microsoft is betting big on AI-powered automation and low-code development as growth areas. However, the low adoption rate of Copilot’s AI add-ons (under 7%) raises questions about whether enterprises are ready to pay for these features at scale.

The retirement of the Copilot+ PC branding and the Mico mascot also hints at a broader reevaluation of Microsoft’s AI strategy. It’s a reminder that even tech giants can overestimate demand or misread the market, and that branding and positioning matter just as much as technical capabilities. For startups, this underscores the importance of iterating quickly and staying attuned to how users—especially enterprise customers—actually engage with AI tools.

Key takeaways

• ISOC in Microsoft Defender integrates AI agents to automate and simplify security operations, targeting AI-driven threats.
• Copilot’s new unified app combines AI chat, coding, and autonomous agents into a single interface, reflecting a push toward consolidation.
• Usage-based billing for advanced Copilot features like Autopilot and Code may appeal to enterprises but could limit adoption if costs escalate.
• Microsoft is retiring the Copilot+ PC branding, signaling a strategic pivot away from hardware-focused AI marketing.
• Human oversight remains a requirement for high-stakes AI actions in ISOC, highlighting ongoing concerns about AI autonomy and governance.
• Low adoption of Copilot’s AI add-ons (under 7%) suggests enterprises are still evaluating the ROI of AI-powered productivity tools.

FAQ

What is the Integrated Security Operations Center (ISOC) in Microsoft Defender?

ISOC is a new service within Microsoft Defender that integrates security operations around AI agents. It incorporates features from Microsoft Sentinel, such as case management and automation playbooks, directly into Defender to address AI-driven cyber threats.

Who can access the ISOC public preview?

The ISOC public preview is available to customers with Microsoft Defender Suite, Microsoft 365 E5, or E7 licenses. However, organizations with active Microsoft Sentinel workspaces are currently excluded.

What are the key features of Microsoft’s new Copilot app?

The new Copilot app features three tabs: Home (AI chat and task automation), Code (no-code app development), and Autopilot (autonomous AI agents). The app aims to unify Microsoft’s AI tools into a single interface for both consumers and enterprises.

How does billing work for Copilot’s advanced features?

Basic Copilot functionality is covered under a per-user license, while advanced features like Autopilot and Code are billed based on usage, depending on the scope and complexity of tasks.

Why did Microsoft retire the Copilot+ PC branding?

Microsoft retired the Copilot+ PC branding after the hardware failed to meet expectations. The company is now focusing on software-based AI integrations, such as the unified Copilot app.

What is Autopilot in Copilot, and how does it work?

Autopilot is an AI agent within Copilot designed to handle long-running tasks autonomously. It can manage tasks like responding to threads or automating recurring processes, and it operates as an "always-on personal agent" in the cloud.

Related on LazyFounders

• OpenAI
• Anthropic
• More technology news
• Palo Alto Networks CEO Calls AI Slowdown 'Unrealistic,' Pushes AI-Driven Security
• NetApp INSIGHT Event to Focus on Unified Storage for AI Infrastructure