Microsoft Security Copilot: Should a Small UK Business Use It?

Security Copilot sounds like something every business should want. In practice it’s a specialist tool, and whether it’s worth having depends far more on your Microsoft licences, and on who reads security alerts in your company, than on the AI itself.

What Security Copilot is

Microsoft describes it as a generative AI security tool that helps defenders work faster. You use it in plain English, either in its own portal or built into Microsoft’s security products: Defender, Sentinel, Intune, Entra and Purview.

Microsoft lists its main uses as:

• Investigating security incidents and turning complex alerts into readable summaries, with step-by-step guidance on what to do next.
• Writing the queries analysts use to search logs, and explaining suspicious scripts.
• Showing the biggest risks in your set-up.
• Writing reports about an incident for non-technical readers.
• Running agents, for example to sort through phishing emails that staff have reported, or review Conditional Access policies.

It’s not the same as Microsoft 365 Copilot, the assistant in Word, Outlook and Teams. They’re separate products, licensed separately. Our post on what Microsoft 365 Copilot does in 2026 covers that one.

How it’s paid for in 2026

This is where things changed most since we first wrote about it in 2024.

If you have Microsoft 365 E5 or E7

Microsoft now includes Security Copilot with Microsoft 365 E5 and E7, with a rollout that started on 18 November 2025. You get 400 Security Compute Units (SCUs) a month for every 1,000 paid user licences, up to 10,000 a month. It scales down for smaller companies, so by Microsoft’s formula a 50-user E5 company gets around 20 SCUs a month. Unused SCUs don’t roll over.

If you don’t

Everyone else, including companies on Microsoft 365 Business Premium, pays for capacity by the hour. You provision at least one SCU, billed for every hour it’s switched on, and you can add pay-as-you-go “overage” capacity for busy periods. Microsoft publishes the price only in US dollars. At the time of writing (October 2026), the worked example on its pricing page uses US$4 per provisioned SCU per hour, so one SCU left running all month comes to roughly US$2,900.

Who it’s really for

Security Copilot helps people who already investigate alerts: an in-house security team, or the analysts at an IT provider. It doesn’t replace them. Microsoft’s own description ends with the user reviewing and assessing the response, and that takes someone who knows what good looks like.

It’s also only as useful as the data it can see. It draws on the Microsoft security products your company has licensed, so the fewer of those you have, the less it has to work with.

For a 5 to 50 person company without its own security staff, that usually means:

• On Business Premium: not worth buying. You’d pay by the hour for a tool built for analysts you don’t employ.
• On E5 or E7: it’s already included, so it’s worth switching on the agents that save time, such as phishing triage, with your IT provider overseeing them.
• With an IT provider: what matters is that someone skilled watches your alerts and acts on them, whatever tools they use to do it.

What to get right first

The government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a breach or attack in the previous 12 months, and phishing was by far the most common, hitting 38% of businesses. AI-assisted investigation doesn’t stop those. The basics do.

If you have Microsoft 365 Business Premium, you already pay for a lot of security. Microsoft’s plan comparison lists Defender for Business, Intune, Entra ID P1 and Purview, all included. Make sure they’re actually doing their job:

1. Multi-factor authentication for everyone, with Conditional Access to block risky sign-ins.
2. Defender for Business on every device, with someone watching the alerts and acting on them.
3. Devices managed in Intune, so they’re encrypted and kept up to date.
4. Email protection, with SPF, DKIM and DMARC set up properly. Our free email security check shows where your domain stands.
5. Cyber Essentials, which covers the controls that stop most common attacks. Try our Cyber Essentials checklist.

The bottom line

Security Copilot is a good tool for the right team. Most small businesses aren’t that team, and don’t need to be. If you’re on E5 already, make use of what’s included. If you’re on Business Premium, spend the money and effort on the security you already own, and on making sure someone is watching it.

Our Cyber Security service does that: Microsoft 365 set up to best practice, and your devices and accounts watched 24/7, with experts acting on real threats.