Findings/assistants-speed-up-analysts

Controlled trials run by Microsoft report that its security assistants make analysts faster and more accurate.

Reportedreported2 evidence records from 2 independent sourcesassistant-drafted

Scope: what this does not show

Vendor-run trials of vendor products; assisted work, not autonomous response.

Reported: Stated by one source and not yet corroborated or challenged.

Evidence

Dec 5, 2023

Microsoft randomized controlled trial measures Security Copilot effect on analyst speed and accuracy

Ben Edelman

Nov 17, 2025

Microsoft RCT finds phishing triage agent raised analysts' true positives per minute up to 6.5x

arXiv

How it relates to other findings

supportsqualifiescontestssupersedes

ReportedCorroboratedQualifiedContestedSupersededRevalidate· node size = evidence records · columns group by topic

Select a finding to see how it relates to others. Arrows point from the newer finding to the one it supports, qualifies, contests, or supersedes.

LLM agents fall well short of reliable performance on realistic threat-investigation and threat-hunting benchmarks built from security logs. qualifies this findingGains appear in assisted work; autonomous performance on realistic tasks remains weak.

Key questions that rely on this finding

Can AI agents defend and oversee systems on their own?Not yet. Agents are weak on realistic defensive benchmarks and monitors can be evaded; assistants help analysts who stay in charge.

Status history

2023-12-05ReportedFirst Security Copilot trial. · record

What would change this: Independent trials in real SOCs.
Evidence kind: reported: Stated by a party without shareable evidence.
Freshness: Evidence 313d old · recheck in 227 daysNewest evidence Nov 17, 2025. Half-life 540 days.
Topics: SOC automation
Attack surface: Human approver

Cite this record

Fide AI. "Controlled trials run by Microsoft report that its security assistants make analysts faster and more accurate.." Agentic Cyber Explorer, record assistants-speed-up-analysts. https://agentic-cyber-explorer.pages.dev/findings/assistants-speed-up-analysts/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-assistants-speed-up-analysts,
  author = {{Fide AI}},
  title = {Controlled trials run by Microsoft report that its security assistants make analysts faster and more accurate.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/assistants-speed-up-analysts/},
  note = {Record assistants-speed-up-analysts; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.