{"id":59142,"date":"2025-08-07T16:00:00","date_gmt":"2025-08-07T16:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=141655"},"modified":"2025-08-07T16:00:00","modified_gmt":"2025-08-07T16:00:00","slug":"announcing-public-preview-phishing-triage-agent-in-microsoft-defender","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/announcing-public-preview-phishing-triage-agent-in-microsoft-defender\/","title":{"rendered":"Announcing public preview: Phishing triage agent in Microsoft Defender"},"content":{"rendered":"

At Microsoft Secure 2025, we <\/span>introduced<\/span><\/span><\/a> a new wave of innovations across Microsoft Defender aimed at redefining what AI can do for security operations. At the center of these announcements was the <\/span>launch<\/span> of 11 Security Copilot agents<\/span><\/span><\/a>, each purpose-built to reduce manual workload and accelerate response through autonomous, adaptive automation. Integrated into existing Microsoft Security infrastructure, they continuously learn and adapt to your unique environment, while keeping your team in control for proactive, end-to-end protection. <\/span> <\/span><\/p>\n

Among these is the Phishing Triage Agent in Microsoft Defender, now available in Public Preview. It tackles one of the most repetitive tasks in the SOC: handling reports of user-submitted phish. Instead of manually combing through endless submission, security teams can now rely on an agent that triages thousands of alerts each day, typically within 15 minutes of detection. Early adopters are already seeing accelerated threat response and significant time savings.<\/span> <\/span><\/p>\n

Phishing continues to be one of the most pervasive entry points for threat actors, with over 90% of breaches starting from email-based deception. In just twelve months, <\/span>Microsoft Defender for Office 365 detected more than 775 million malware-laced emails<\/span><\/span><\/a>, underscoring the relentless, large-scale nature of the threat. <\/span>While today\u2019s security tools are highly effective at blocking most of these attempts, attackers aren\u2019t standing still. They continuously adapt\u2014tweaking content, spoofing identities, changing tactics, and exploiting new channels to slip past defenses. Increasingly, they\u2019re also using generative AI to craft phishing messages that appear more legitimate and personalized, making detection even harder. As a result, a small but dangerous number of phishing emails still manage to slip through and reach users\u2019 inboxes.<\/span> <\/span><\/p>\n

When users report these suspicious messages, they land in SOC queues for further review, creating a significant operational burden for security teams. Most submissions are false alarms, yet analysts must still manually review each one to catch the rare threats buried in the noise. This delays response, drains focus, and raises the risk of a dangerous miss.<\/span> <\/span><\/p>\n

The Phishing Triage Agent marks a meaningful step forward in autonomous security operations. Powered by large language models (LLMs), it performs sophisticated assessments\u2014including semantic evaluation of email content, URL and file inspection, and intent detection\u2014to determine whether a submission is a true phishing threat or a false alarm. Unlike traditional systems based on static rules or pre-coded logic, the agent dynamically interprets the context and artifacts of each email to reach an independent verdict. It is autonomous defense working behind the scenes, cutting through the noise and elevating what truly matters.<\/span> <\/span><\/p>\n

Equally transformative is the agent\u2019s ability to learn. Rather than relying on fixed conclusions, the Phishing Triage Agent continuously evolves. Analysts can reclassify incidents and provide natural language feedback explaining why a particular verdict was correct or not. The agent incorporates this input, refining its reasoning and adapting to the organization\u2019s specific needs, patterns, and nuances. With every interaction, it becomes more accurate and better attuned to its environment, creating a feedback loop that drives ongoing improvement.<\/span> <\/span><\/p>\n

One of the most defining features of the Phishing Triage Agent<\/span> <\/span>is how clearly it communicates its decisions. For every verdict, the agent provides a natural language explanation that outlines why a message was or wasn\u2019t classified as phishing. The rationale is clear and accessible, allowing analysts to quickly comprehend what led to the outcome.<\/span> <\/span><\/p>\n

For those seeking deeper understanding, the agent also produces a visual map of its decision logic: a step-by-step breakdown of how it evaluated the submission. Each phase is presented as an expandable card within a structured diagram, detailing the signals analyzed, evidence collected, and logic applied. Teams can drill into any step to view the agent\u2019s reasoning in context, making the entire process traceable and reviewable from start to finish. This level of transparency isn\u2019t just helpful, it\u2019s essential for building trust in autonomous security systems. <\/span> <\/span><\/p>\n

 <\/span><\/p>\n

 <\/span> <\/span><\/p>\n