ASM: Security Copilot for faster threat investigations

ASM builds equipment for semiconductor makers, so its intellectual property is a target at every production site. Microsoft's story says the company has to defend against state-sponsored attackers, espionage, insider risk and advanced phishing across facilities and customers in Asia, Europe and North America.

The security operations team wanted one consolidated view of its defenses, faster investigations, and a way to pass the methods of experienced investigators on to junior analysts.¹

ASM connected Microsoft Security Copilot across the Microsoft security tools it already runs. Analysts ask questions in plain language, bring signals from several tools into a single view and receive suggested next steps.

The team also wrote the know-how of its senior investigators into Security Copilot workflows. Junior analysts follow these steps to learn investigation techniques, while senior analysts spend more time on threat hunting and building playbooks.

ASM is testing Security Copilot agents that process telemetry across its Microsoft stack. Microsoft describes these as early trials and gives no figures for them. The story names no implementation partner and does not list the other Microsoft security products involved.¹

In our view, the part worth copying is ASM's first step: writing down how its experienced investigators work and turning that into repeatable Security Copilot workflows. That helps a mid-sized team train junior analysts and keeps investigations consistent. The figures need care. The 68% rests on one incident, so it is not a benchmark, and the 337 hours come from ASM's own calculation with no published method or baseline. All numbers reach readers through Microsoft and were not independently checked. Security Copilot works with the security tools it is connected to, so a team whose stack is mostly non-Microsoft should first check which of its tools it can reach. A small team with low alert volume may get more from tuning its existing playbooks than from adding an AI layer.