Phishing attacks slowed response and strained Toyota Leasing Thailand's SOC. This customer story shows how Microsoft Security Copilot unified visibility, improved collaboration, and reduced response times from hours to minutes. Read the story to see how stronger coordination and automation can improve your security operations.
How did Microsoft Security Copilot improve Toyota Leasing Thailand’s threat response?
Toyota Leasing Thailand used to spend hours manually triaging phishing incidents and preparing reports. Their security operations center (SOC) was dealing with frequent phishing attacks, manual reporting, and fragmented tools, which slowed down investigations and put pressure on both analysts and leadership.
After integrating Microsoft Security Copilot with Microsoft Defender, Entra, and Purview, they reshaped their threat response in several ways:
- **Faster response times:** The average time to first action on phishing cases dropped from **hours to just a few minutes**.
- **Automated analysis and reporting:** Security Copilot now summarizes phishing incidents, classifies alerts, analyzes scripts, generates user notifications, and produces leadership-ready reports automatically.
- **Unified visibility:** By consolidating insights from Defender, Entra, and Purview into a single interface, analysts can see the full chain from risk to action to outcome without switching between multiple tools.
- **Natural language interaction:** Analysts can ask questions in everyday language and receive actionable context, which speeds up decision-making and handoffs between the SOC and IT teams.
Overall, Security Copilot helped Toyota Leasing Thailand move from reactive, manual investigations to a more systematic, timely response to threats.
How did Security Copilot affect collaboration and work culture?
Before Security Copilot, Toyota Leasing Thailand’s SOC and IT teams relied on manual processes and time-consuming report preparation, which often meant late nights and limited time for higher-value work.
With Security Copilot in place, several changes emerged:
- **Shared interface for SOC and IT:** Security Copilot provides a common workspace where both teams can see risks, actions taken, and next steps. This has made it easier to explain incidents and coordinate responses.
- **Clearer communication:** Automatically generated summaries and reports give leadership and IT a straightforward view of what happened, what was done, and what remains to be addressed.
- **Support for junior analysts:** Step-by-step guidance from Security Copilot helps less-experienced analysts understand why specific actions are needed, building confidence and consistency.
- **Improved work-life balance:** Reports that previously took until 10 p.m. or midnight to complete can now be finished by around 5 p.m. This has opened up time for small team gatherings and contributed to better morale.
As a result, collaboration between SOC and IT has become more structured and transparent, while employees experience a more sustainable workload and a healthier work-life balance.
How does Security Copilot support Zero Trust and regulatory compliance?
Toyota Leasing Thailand operates in financial services, where customer trust, data protection, and service continuity are critical. The company follows a Zero Trust approach—“never trust, always verify, assume breach”—and must comply with Thailand’s Personal Data Protection Act (PDPA).
Security Copilot supports these goals in several ways:
- **Zero Trust alignment:** By integrating with Microsoft Defender, Entra, and Purview, Security Copilot ties together data, identity, device, network, application, and database insights. This helps Toyota Leasing Thailand operationalize Zero Trust principles in daily workflows rather than treating them as abstract policies.
- **Identity and access optimization:** Using the **Conditional Access Optimization Agent** with Microsoft Entra, the team receives policy recommendations and automated compliance checks that strengthen identity and access management.
- **Continuous compliance support:** Security Copilot helps monitor and support PDPA-related requirements across data access, storage, and incident response. This includes faster detection, clearer documentation of actions taken, and more consistent reporting.
- **Risk-to-outcome traceability:** When briefing leadership, the security team can now show the full chain from identified risk to actions taken and resulting outcomes in one place, which supports both governance and audit needs.
By combining AI assistance with their existing Microsoft security stack, Toyota Leasing Thailand has reimagined how it enforces Zero Trust and maintains PDPA compliance while protecting sensitive customer data.
Sign in with LinkedIn