Agent value
What each Security Copilot agent is worth
Per-agent ROI computed from Microsoft's published SCU rates, conservative analyst-time-saved estimates, and your hourly rate. Every input is transparent and adjustable — your numbers, your call.
Looking for the tenant-level cost? Use the calculator. Real-world cost benchmarks: /benchmark. Machine-readable export: /value.json.
Illustrative — adjust to your team's rate. Drives every dollar figure below. Stored in your browser, never sent to the server. Default $100/hr.
Net monthly savings
8 of 8 agents included
+$14,208
- Hours saved / mo
- 159 h
- Savings / mo
- $15,900
- Cost / mo
- $1,692
Agents
Auto-triages user-reported phishing messages, classifying intent and prioritising real threats for the SOC.
0.5
- Cost / mo
- $300
- Hours saved / mo
- 25 h
- Savings / mo
- $2,500
- Net / mo
- +$2,200
Source notes
SCU / run (estimate): Microsoft does not publish a per-run rate; their Phishing Triage docs point to the in-tenant usage dashboard ("cost per email processed"). 0.5 SCU anchors to Microsoft's incident-summarisation reference in their billing-math example.
Hours saved / run (estimate): Microsoft does not publish a per-run time-saved figure. Independent SOC research (Ponemon Institute Cost of Phishing reports; IBM X-Force) places manual phishing triage at 20-30 minutes per reported email. 0.25 h (15 min) is a conservative midpoint of analyst time given back per run.
Reviews new alerts, summarises evidence, and proposes a verdict to reduce analyst time per incident.
0.5
- Cost / mo
- $300
- Hours saved / mo
- 25 h
- Savings / mo
- $2,500
- Net / mo
- +$2,200
Source notes
SCU / run (estimate): Microsoft does not publish a per-run rate; their Alert Triage docs point to the in-tenant usage dashboard. 0.5 SCU anchors to Microsoft's incident-summarisation reference (the underlying operation).
Hours saved / run (estimate): Microsoft does not publish a per-run time-saved figure for this agent. Tier 1 SOC alert triage commonly takes 15-30 minutes per alert (SANS Institute SOC surveys; vendor SIEM/SOAR benchmarks). 0.25 h is a conservative estimate of analyst time given back; verify against your tenant's MTTR before relying on it.
Scans Conditional Access policy gaps daily and proposes safe optimisations across users and apps.
0.5
- Cost / mo
- $90
- Hours saved / mo
- 15 h
- Savings / mo
- $1,500
- Net / mo
- +$1,410
Source notes
SCU / run (Microsoft (range)): Microsoft Learn states verbatim: "On average, each agent run consumes less than one SCU." 0.5 used as the midpoint estimate.
Hours saved / run (estimate): Microsoft has not published a specific per-run time-saved figure. The agent surfaces policy gap recommendations daily that an identity admin would otherwise have to derive manually from sign-in logs and policy state. 0.5 h (30 min) per run is a conservative estimate of the recommendation-curation time given back.
Investigates risky users in batches and recommends remediations such as resets, MFA, or session revocation.
0.5
- Cost / mo
- $90
- Hours saved / mo
- 15 h
- Savings / mo
- $1,500
- Net / mo
- +$1,410
Source notes
SCU / run (Microsoft (range)): Microsoft Learn states verbatim: "On average, each agent run consumes less than one SCU." 0.5 used as the midpoint estimate.
Hours saved / run (estimate): Microsoft has not published a specific per-run time-saved figure. Risky-user batches typically contain multiple users and an identity admin would otherwise review each user's sign-in pattern and recommend a remediation manually. 0.5 h (30 min) per batch run is a conservative estimate.
Continuously identifies vulnerable devices and drafts remediation tasks for endpoint admins.
0.5
- Cost / mo
- $300
- Hours saved / mo
- 25 h
- Savings / mo
- $2,500
- Net / mo
- +$2,200
Source notes
SCU / run (estimate): Microsoft does not publish a per-run rate. 0.5 SCU anchors to the incident-summarisation reference; verify against your tenant's usage dashboard.
Hours saved / run (estimate): Microsoft does not publish a per-run time-saved figure. Per-device vulnerability triage and remediation drafting typically takes 10-20 minutes when done manually (Verizon DBIR adjacent endpoint operations research). 0.25 h (15 min) per run is a conservative estimate of endpoint admin time given back.
Generates a tailored threat intelligence briefing for the tenant on a recurring schedule.
0.5
- Cost / mo
- $12
- Hours saved / mo
- 4 h
- Savings / mo
- $400
- Net / mo
- +$388
Source notes
SCU / run (estimate): Microsoft does not publish a per-run rate. Aligned with the other triage agents at 0.5 SCU; the 3.7 SCU promptbook value in Microsoft's billing-math example is an illustrative scenario, not a benchmark for this agent.
Hours saved / run (estimate): Microsoft does not publish a per-run time-saved figure. Producing a tailored TI briefing manually — gathering open-source intel, mapping to tenant assets, drafting the write-up — typically takes 1-2 hours for a TI analyst. 1 h per briefing is a conservative estimate of TI analyst time given back.
Triages insider risk alerts by analysing recent user activity and surfacing the highest-risk cases.
0.5
- Cost / mo
- $300
- Hours saved / mo
- 25 h
- Savings / mo
- $2,500
- Net / mo
- +$2,200
Source notes
SCU / run (estimate): Microsoft documents that consumption depends on alert volume and type and points to the in-tenant usage dashboard. 0.5 SCU anchors to the incident-summarisation reference.
Hours saved / run (estimate): Microsoft does not publish a per-run time-saved figure. Insider risk alerts require context-loading across user activity history; manual triage commonly takes 15-30 minutes per alert. 0.25 h is a conservative estimate of insider-risk-reviewer time given back.
Reviews DLP alerts and prioritises real exposure incidents over noise.
0.5
- Cost / mo
- $300
- Hours saved / mo
- 25 h
- Savings / mo
- $2,500
- Net / mo
- +$2,200
Source notes
SCU / run (estimate): Microsoft documents that consumption depends on alert volume and type and points to the in-tenant usage dashboard. 0.5 SCU anchors to the incident-summarisation reference.
Hours saved / run (estimate): Microsoft does not publish a per-run time-saved figure. DLP alert triage commonly takes 10-20 minutes per alert when separating real exposure from noise. 0.25 h is a conservative estimate of DLP-reviewer time given back.
Per-agent costs above do not subtract the included E5 / E7 SCU pool — that's a tenant-level offset and depends on your paid licenses. Use the calculator for tenant-level net cost.
Methodology & honesty notes
- SCU per run. Where Microsoft publishes a range (e.g. “less than one SCU”), we anchor to the midpoint and label it Microsoft (range). Where Microsoft does not publish at all, we anchor to the incident-summarisation reference (0.5 SCU) from their official billing-math example and label it estimate. Every agent card shows the provenance under “Source notes.”
- Hours saved per run. Microsoft does not currently publish per-agent time-saved figures. Defaults are conservative estimates anchored to independent analyst-handling-time research (SANS, Ponemon, IBM X-Force). They tend to understate value rather than overstate it. Each card shows the reasoning; adjust the value to match your team.
- Cost = SCU/run × runs × $6. Uses Microsoft's published $6/SCU overage rate. Doesnot subtract the included E5/E7 SCU pool — that's a tenant-level offset belonging on the calculator. Per-agent cost shown here is the on-the-meter rate.
- Savings = hours saved × your rate. The rate defaults to $100/hr and is editable above. Loaded labor costs vary 2–3x by region and seniority — use a number your team recognises.
- What “savings” means. Hours given back to your team are productivity, not always a direct P&L line. Some hours get reallocated to higher-value work (productivity gain), some avoid headcount growth (real cost avoidance), some enable headcount reduction (direct savings). The dollar figure here is the labour value of the time, computed at your rate — interpret it in your own staffing context.
- Nothing about your inputs leaves your browser. All overrides (include toggles, runs/month, hours saved/run, hourly rate) live in
localStorage. No tenant identifier, telemetry, or analytics on your numbers. - Planning aid, not a guarantee. Verify per-run consumption against your tenant's usage dashboard at securitycopilot.microsoft.com/usage-monitoring and calibrate the hours-saved estimates against your team's actual handling-time deltas.