Posture Prioritization Agent

The Posture Prioritization Agent helps security teams and stakeholders across the organization understand what to fix first and why. The agent supports two scenarios: broad posture prioritization for routine remediation planning, and threat-driven posture response for understanding exposure to a specific threat. In both cases, the agent analyzes posture findings and produces an explainable, prioritized action plan based on risk, exploitability, exposure, asset criticality, and available Defender signals. In preview, the agent is read-only and focuses on cloud and device posture scenarios.

Why use the Posture Prioritization Agent?

The Posture Prioritization Agent addresses the pre-breach side of security: identifying and reducing risk before an attack occurs. Security teams already have queues of posture findings and recommendations. The challenge is connecting those signals to understand the security problems they represent in your environment, then deciding which actions will reduce risk most effectively. 

The agent reduces manual triage by turning available Defender findings and signals into a focused set of prioritized risks. It does not replace the underlying findings or recommendation queues. Instead, it brings them together with context such as exploitability, exposure, and asset criticality to explain why certain risks warrant attention first. 

For each prioritized risk, the agent explains why it matters, the evidence behind its priority, the potential impact of not addressing it, and what to do next. This helps security teams validate their priorities and communicate decisions to stakeholders. When assessing a specific threat, the agent also connects threat context to relevant posture risks, helping teams focus their investigation. 

Use the agent to: 

• Find a focused place to start. Review prioritized risks rather than working through an undifferentiated list of findings. 

• Understand the decision. See why each risk was prioritized and which available signals support that assessment. 

• Connect priority to your environment. Understand the potential impact and review the relevant findings and affected assets. 

• Move toward action. Use the recommendations and available remediation guidance to decide what to investigate or change next. 

Scenarios

The agent supports both ongoing posture planning and prioritization in the context of a specific threat. 

Plan for posture remediation is the starting point for broad, ongoing prioritization. Protect against a threat is the better choice when a specific threat has surfaced and you need to understand your exposure. 

The two playbooks answer different questions, so their results should be interpreted in the context of the playbook you selected. 

Before you begin

Confirm the required product availability, licensing, permissions, and configuration before you use the Posture Prioritization Agent.

To use the agent, confirm that you have: 

• Access to Microsoft Perception and the permissions required to set up or run the applicable playbook. 

• A Security Copilot license. 

• A license for at least one supported source of posture data you want the agent to analyze: 

  • Defender CSPM for supported Defender for Cloud posture data enabled on a subscription level. Enabling additional plans surfaces more posture signals for the agent to work with. For more information, see What is Cloud Security Posture Management (CSPM).

  • Microsoft 365 E5 for supported device posture data.

Your ability to open underlying findings and assets also depends on your access to the relevant Defender data. For general information about permissions. For more information about unified RBAC in the Defender portal, see Microsoft Defender XDR Unified role-based access control (RBAC).

Set up the Posture Prioritization Agent

Follow the steps in Set up an agent to make the agent available in Perception. The Posture Prioritization Agent runs as part of a playbook. After setup, choose the playbook that matches the question you want to answer.

Start a Posture Prioritization Agent session

For ways to start a session, see Start a new session. This agent supports two playbooks with different scenarios. Select the one that matches your current need.

Plan for posture remediation

Scenario (Broad posture prioritization): "What should I fix first in my environment?"

Use this playbook when you want to identify which available posture risks to address first. No threat input is required. 

1. Go to Playbooks.
2. Select the Plan for posture remediation playbook.
3. Select New session.
4. Select Start session.

Protect against a threat

Scenario (Threat-driven posture response): "A new threat dropped. Am I exposed, and what should I do?"

Use this playbook when a specific threat has surfaced and you want to understand your exposure and prioritize remediation accordingly. The agent maps the threat to your posture findings before prioritizing.

1. Go to Playbooks.
2. Select the Protect against a threat playbook.
3. Select New session.
4. Provide the required threat input: a threat intelligence article.
5. Select Start session.

Monitor session progress

When a session starts, the agent creates a session in Project Perception. To view and manage sessions, go to Agents, locate the Posture Prioritization Agent under Agents in use, and select Go to agent.

The Posture Prioritization Agent page includes the following tabs:

Select the ellipsis (...) in the upper-right corner of the page to manage the agent. Select Pause to temporarily stop the agent or Run to resume agent activity.

Understand the report

When a session completes, select Summary in the session interface to view the session summary. Full output files are also available as downloadable Markdown files in the Outputs section of the session details panel. The output is the primary result of a run. It contains the top exposures to prioritize to reduce risk in your environment.

You can follow up on the report in the session chat interface. Ask the agent to explain a specific action, focus on a particular workload, or provide more detail on the reasoning behind a recommendation.

Start with the overall assessment

Read the Executive Summary and Impact sections first. They explain the main security concerns identified in the available data and the potential consequences of leaving them unaddressed. In a threat-based report, distinguish the threat described in the TA report from findings observed in your environmentץ

Read the prioritized risks

The Overall Risk Prioritization section gives you a focused starting point. Each row describes a security risk, not simply a finding copied from an existing recommendation queue. Review: 

1. Risk and priority: What security problem is described, and where does it appear in the prioritized list? 

2. Potential impact and likelihood: What could happen if the risk is realized, and what does the report establish about likelihood? If a value is unavailable, do not interpret it as low risk. 

3. Affected assets: Which assets are associated with the risk? Open the available asset links to inspect the underlying data.

4. Why prioritized: What evidence and context explain why this risk appears ahead of other work? 

5. Recommendations: Which underlying findings or controls relate to the risk, and what actions does the report suggest? 

For Protect against a threat, also review TI Relevance to understand how the risk relates to the analyzed threat.

Use Action Details to plan the next step

The Action Details section expands on each prioritized risk. Use it to examine the described impact, prioritization reasoning, affected assets, available attack-path context, and recommendations. Where the report includes remediation steps, review them against the affected configuration and your organization's change process before making a change. 

The report helps you decide what to investigate and address first, and why. The underlying Defender findings and recommendation queues remain the source for inspecting the relevant assets and tracking the broader set of posture work. 

Data coverage and limitations

The following scope and limitations apply during preview:

Related content

• What is Project Perception?

• Understand key concepts in Project Perception

• Work with agents

• Monitor and manage agent sessions

• Recon Agent