Toyota Leasing Thailand was facing frequent phishing attacks and a heavy manual workload in its Security Operations Center (SOC). Investigations took too long, and analysts spent a lot of time preparing reports for leadership.

By integrating Microsoft Security Copilot with Defender, Entra, and Purview, the company reshaped how it handles incidents:

• Faster response: Average time to first action on phishing cases dropped from hours to just a few minutes.
• Automated triage and reporting: Security Copilot now summarizes phishing incidents, classifies alerts, analyzes scripts, and generates user notifications and leadership-ready reports automatically.
• Natural language interaction: Analysts can ask questions in everyday language and get actionable context, which speeds up the handoff between the SOC and IT teams.

As a result, what used to be stressful spikes in activity are now handled as more systematic, repeatable responses, with clearer visibility from risk to action to outcome.

Before adopting Security Copilot, Toyota Leasing Thailand’s SOC and IT teams struggled with fragmented tools and time-consuming manual reporting. This affected both collaboration and morale.

With Security Copilot in place, the organization has seen several changes:

• Shared interface: Security and IT now work from a common view of risks, actions taken, and next steps, which makes conversations clearer and decisions faster.
• Guided workflows: Junior analysts receive step-by-step guidance and explanations of why certain actions are needed, which builds confidence and supports skills development.
• Reporting time reduced: Reports that previously took long evenings—sometimes until 10 p.m. or midnight—are now generated nearly instantly, allowing teams to finish by around 5 p.m.
• Better work-life balance: With less repetitive work and faster reporting, staff have more time for small team gatherings and a healthier balance between work and personal time.

Overall, Security Copilot has helped reimagine collaboration between SOC and IT while supporting a more sustainable way of working for analysts.

As a financial services provider handling sensitive personal data, Toyota Leasing Thailand places customer trust and regulatory compliance at the center of its security strategy.

The company follows a Zero Trust approach—“never trust, always verify, assume breach”—and uses Microsoft solutions to cover key pillars: data, identity, network, applications, and databases. Security Copilot helps tie these elements together in day-to-day operations.

Key benefits include:

• Operationalizing Zero Trust: By connecting data, identity, and device insights across Defender, Entra, and Purview, Security Copilot brings Zero Trust principles into everyday workflows instead of leaving them as abstract policies.
• PDPA support: Security Copilot assists with continuous vigilance around data access, storage, and incident response, supporting compliance with Thailand’s Personal Data Protection Act (PDPA).
• Policy optimization: Using agents such as the Conditional Access Optimization Agent with Microsoft Entra, the team improves identity and access management through policy recommendations and automated compliance checks.

By pairing AI assistance and agents with human judgment, Toyota Leasing Thailand has strengthened its defensive posture while protecting both customer data and employee well-being.