72 Minutes vs 292 Days: Unified Security Operations for the AI Era

Attackers need about 72 minutes from a phishing click to your data. Stolen-credential breaches take 292 days to contain — and AI agents are widening the gap.

The Clock Started at the Click

The CISO asked me a simple question in a quarterly review: "If someone in finance clicks the wrong link at 9:00, when do we know?"

The honest answer was: it depends which of our six consoles lights up, and whether anyone is looking at it.

That answer is the problem. The risks are familiar — phishing, stolen identities, exposed services. What changed is the speed and the scale.

Now put the defender's clock next to the attacker's:

Seventy-two minutes versus 292 days. No amount of analyst heroics closes a gap that size. Three forces keep widening it, and each maps to a question every CISO is already asking:

• Threats evolve faster than detections. “How do I stay ahead of emerging threats and avoid being the next headline?”
• AI raises attack frequency and velocity. “How do I deal with alert fatigue and focus on what matters?”
• The skills gap is widening and burnout is at a high. “How do I keep 24/7 coverage without more in-house talent?”

Every section below answers one of those three questions. None of them is answered by buying another point product.

Six Consoles, Zero Context

Walk into most enterprise security organisations and you'll find the same map.

Functional teams — identity, AppSec, cloud security, data protection, endpoint, architecture.

A point product for each — email security, network security, vulnerability management, DLP, EDR, ITDR, CASB, CSPM. And a SOC on the other side of the wall with its own stack — SIEM, SOAR, UEBA, threat intel, IDS, XDR.

Each tool is good at its job. None of them knows what the others saw.

So an identity alert, an endpoint alert and a data-access alert that are really one attack arrive as three tickets, in three queues, triaged by three people. That is how a 72-minute attack becomes a 292-day breach.

The target state isn't “one vendor”. It's three mutually reinforcing flywheels running on one signal plane, with generative AI across every layer:

Across all three: Security Copilot and its agents for triage, hunting and reporting.

From Reactive to Predictive

A reactive SOC waits for an alert. A predictive SOC works on the attack path before it is walked. Four capabilities make the difference:

The two loops that do most of the work

Attack Disruption: the 17-Minute Proof

This is the capability that changes the economics of a SOC.

Automatic attack disruption uses the correlated XDR signal to recognise multi-stage, multi-domain attacks — ransomware, business email compromise, adversary-in-the-middle phishing — and contains the compromised users, devices and sessions in near real time. It also predicts the next hop, to cut off lateral movement.

Two incidents from Microsoft's materials show what that looks like on a clock.

Look at the second one again. The attacker was in within three minutes of the click. A human SOC working a queue would not have read the alert yet. The platform had already closed the session.

Notice also what made the first one work: the email signal, the identity signal and the file-access signal were already in the same incident. Disruption is not a feature you bolt on. It is the dividend of unification.

Licensing: attack disruption is available with Defender for Endpoint, combinations of the Defender standalones, or the Microsoft Defender Suite (formerly E5 Security). Coverage depends on which workloads are onboarded — more on that in the caveats.

AI Agents Are the New Attack Surface

Every AI agent your business ships has planning, actions and memory. It talks to users and external apps, calls tools (email, code, APIs, the web, data sources), reaches cloud and local models with keys and tokens, and connects to other agents and MCP servers.

Each of those connections is an attack path. Here is how the threats map to the controls that belong in front of them:

Developers build safely; the SOC responds with context

The pattern that works splits the job cleanly.

Developers own Foundry guardrails — Prompt Shields block prompt attacks at the application boundary before they reach the model.

Security teams own Microsoft Defender, which combines that application and agent context with Microsoft Threat Intelligence and raises contextual alerts into Defender XDR or the SIEM, with automatic response.

Defender looks for two families of signal:

And when an AI alert fires, it arrives with the evidence to act: the prompt and response, application context, user context, the data sets involved, CNAPP posture context and a prompt-to-grounding map.

That answers the three questions every investigator asks — what did the user do with the model, where did the model's answer come from, and what posture change stops it happening again?

Reference Architecture

Securing AI workloads on Azure

Defence-in-depth from the edge to the model, with one SecOps plane. This is the pattern we take into design workshops:

Four design principles hold it together:

1. Zero Trust identity. No keys. Managed identities everywhere; Conditional Access on every human and workload path.
2. Private networking for every data plane. Models, search indexes and data stores are not reachable from the internet.
3. Guardrails on every model input and output. Not just the customer-facing chatbot — internal agents too.
4. All AI telemetry routed to one SecOps plane. An AI alert in a separate console is the six-checkpoint airport all over again.

24/7 Without Hiring 24/7

The third CISO question — coverage without more in-house talent — is where most programmes stall. A credible follow-the-sun SOC needs multiple analysts per shift, per role, plus leave and attrition cover. Most mid-market organisations can't staff that, and shouldn't try.

Microsoft Defender Experts for XDR is the managed answer: 24/7 expert-led detection and response and proactive threat hunting across endpoints, identities, email and cloud apps, with cloud workloads and partner-network signals (ingested via Sentinel) on the roadmap.

Behind it: roughly 10,000 security researchers working on 80+ billion signals a day, automation and agentic AI for speed, and a named service delivery manager.

Source: Forrester Consulting, New Technology: The Projected Total Economic Impact™ of Microsoft Defender Experts for XDR, July 2023 — commissioned by Microsoft. It models a composite organisation and is a projection, not a measured outcome for your estate.

When the incident is already a crisis, Microsoft Incident Response is the escalation path — on-site or remote, in three moves:

1. Investigate — determine whether systems are under targeted exploitation, including compromised cloud accounts.
2. Tactical containment — deploy immediate countermeasures against an active attack or ransomware and restore critical identity systems.
3. Strengthen — strategic hardening against sophisticated actors and the groundwork for recovery: evicting the attacker for good.

Put an IR retainer decision on the table before you need it. Negotiating scope during an active ransomware event is the most expensive procurement you will ever run.

The CFO Slide

The CFO's question is never “is this more secure?” It's “what does it cost compared to what we pay now?” For organisations on Microsoft 365 Business Premium (25–300 seats), the suite pricing makes the answer unusually clean. CSP list prices, per user per month:

What that means for a 250-seat company (illustrative list-price arithmetic):

• Defender Suite: 250 × ($28.20 − $10.00) × 12 = $54,600 a year below buying the same five components standalone.
• Defender + Purview Suites: 250 × ($47.20 − $15.00) × 12 = $96,600 a year below the standalone equivalent.

Be precise about what that number is. It's the gap to standalone Microsoft list prices, not your saving.

Your real business case is the suite cost minus the third-party point tools you can actually retire — email gateway, EDR, CASB, ITDR, DLP — minus the migration effort to retire them.

The Security Business Case Builder (upgraded May 2025, grounded in Forrester TEI data) is built to produce exactly that customer-specific view, including vendor-consolidation savings. Prices vary by term, currency and region.

The Partner Playbook

For Microsoft partners, this is not one motion. FY26 organises security into three solution plays:

The growth is in managed services. A Microsoft-commissioned Forrester TEI study (2025) found SMB-focused partners growing managed security services 42% year-on-year (versus 23% overall growth), and enterprise-focused partners 24% (versus 20%).

The winning pattern: license plus a recurring managed offer — Defender Suite for Business Premium paired with MXDR, SOC efficiency, incident-response automation or compliance automation.

The win formula, stage by stage

1. Listen & consult: build pipelineCampaign-in-a-box, propensity targeting (CloudAscent for SMB, Microsoft 365 Lighthouse opportunities), and 1:many Threat Protection and Data Security Immersion Briefings.
2. Inspire & design: design the solutionA rapid security assessment or cybersecurity self-service assessment, then a customer-specific business case.
3. Empower & achieve: win the dealStructural CSP incentives apply; check the current rates in the program guide.
4. Realise value: deploy and drive usageDefender XDR workload usage; data security that doesn't block end users.
5. Manage & optimise: expandUpsell and attach integration, SOC-efficiency, IR-automation and compliance-automation services.

Funding helps at the top of the funnel: immersion briefings are 90-minute, 1:many sessions (5–25 eligible customers each), funded at up to $2K per briefing in FY26 for partners with the Security Solution Partner Designation for SMB.

That designation is scored out of 100 — performance (20), skilling (40), usage growth (20), deployments (20) — with 70 required.

Skilling is the biggest lever, and the one a practice lead controls most directly. Program terms change; confirm eligibility and rates in the current partner guide before you plan around them.

The 180-Day Roadmap

Value in weeks, maturity in quarters. Three phases, in order. Tick them off as you go.

What the Pitch Deck Won't Tell You

Every one of these is solvable. None of them is solved by signing the order form.

• Disruption is only as good as your onboarding. A device that isn't onboarded can't be contained. An identity signal that never reaches XDR can't be correlated. The 17-minute story assumes coverage you have to earn in phase one.
• Consolidation has a migration cost. Retiring a SIEM means migrating detections, parsers, playbooks and muscle memory. Budget for dual-running and put a named date on each tool's switch-off — or the savings never arrive.
• SIEM ingestion is where budgets go to die. Unified doesn't mean “ingest everything into the analytics tier”. Decide which logs drive detections and which only need cheap, long retention.
• Automated containment needs governance. Agree up front which accounts and devices are excluded, who is paged when disruption fires, and how the business is told. An executive locked out mid-board-meeting is still a better outcome than a breach — but it should never be a surprise.
• Prompt Shields are one layer, not the strategy. Guardrails block known attack patterns. Least-privilege tools, managed identities and private networking are what limit the blast radius when something gets through.
• The price table is for Business Premium. Enterprise agreements, E5 and larger estates have different economics. Don't carry the 65% figure into a 5,000-seat conversation.

Executive Conclusion

The attacker's clock runs in minutes. The traditional SOC's clock runs in months. You cannot hire your way across that gap, and you cannot buy your way across it one point product at a time.

What closes it is architecture: unify posture, protection and SOC on one signal plane; automate containment so real attacks stop in minutes; protect AI with guardrails, detection and investigation context for every app and agent; and extend the team with 24/7 managed expertise instead of an impossible hiring plan.

The next step is small and concrete: run a rapid security assessment, build the business case with real retirement targets, hold an immersion briefing for the stakeholders, and agree a 90-day pilot scope. That is how 292 days becomes 20 minutes.

Ready to operationalize your Azure journey?

If your SOC is juggling six consoles, your AI apps are shipping without a security owner, or you need a board-ready business case for consolidating onto Defender, Entra, Purview and Sentinel — let's map your 180-day plan together.