# An open-source Microsoft Security Copilot alternative you can self-host

> Microsoft Security Copilot is a generative AI assistant and agent set inside Microsoft's security products, bought in security compute units or bundled with Microsoft 365 E5. Kortix is the open-source AI Operating System: your agents, their skills, and the permissions they run under are files in one git repo you own.

URL: https://opensourcecopilotalternative.com/microsoft-security-copilot-alternative

## Where the security agents live, side by side

Rival cells come from the vendor's own pages, read in October 2026: [Microsoft Learn](https://learn.microsoft.com/en-us/copilot/security/authentication) for Security Copilot, and Wazuh's [platform overview](https://wazuh.com/platform/overview/), [indexer and dashboard role setup](https://documentation.wazuh.com/current/user-manual/user-administration/rbac.html), [server API RBAC](https://documentation.wazuh.com/current/user-manual/api/rbac/index.html) and [Cloud](https://wazuh.com/cloud/).

| | Kortix (recommended) | Microsoft Security Copilot | Wazuh |
| --- | --- | --- | --- |
| What it is | Open-source AI Operating System: agents, skills and connectors in one repo | Generative AI assistant and agents inside Microsoft's security products | Open-source SIEM and XDR platform with detection rules |
| Where agent definitions live | `agents/<name>.md` plus an agent's block in `kortix.yaml` | In your Microsoft tenant's Security Copilot workspace | Rules and decoders as XML files on the manager |
| Who can read the data an agent touches | Repo access decides; each agent's grant is a line in it | Entra and Azure role assignments decide which plugin data an analyst reaches | Wazuh indexer roles; server API roles decide which calls pass |
| Self-hosting | Kortix Cloud, your VPC, or your own on-prem network | No; Microsoft-hosted, and not for US government clouds | Yes; manager and indexer run on your servers |
| Permission model | Roles and groups, scoped per resource for people and agents | Copilot owner or contributor, layered over Entra and Azure roles | RBAC roles and policies on the server API |
| How a change is reviewed | A change request diff that a person merges | In Microsoft's admin centers, as tenant settings and role assignments | Edit the XML on the manager, then restart it |
| Buying model | Self-host free; Kortix Cloud priced in credits | Security compute units, or the allowance in Microsoft 365 E5 | No cost to install; Wazuh Cloud is the managed option |
| Open source | Yes | No | Yes |

## The governance block, as the starter ships it

`kortix.yaml`

```yaml
# v2 is deny-by-default: an omitted connectors/secrets/kortix_permissions/
# skills grant resolves to "none", so a scoped specialist starts locked down.
agents:
  kortix:
    file: agents/kortix.md
    connectors: all
    secrets: all
    kortix_permissions: all
    skills: all
```

Source: https://github.com/kortix-ai/suna/blob/dev/packages/starter/templates/base/kortix.yaml

An agent's reach is four lines beside its prompt, and a grant you leave out resolves to none.

## What Security Copilot is, and how a security team buys it

Microsoft Security Copilot is a generative AI assistant for defenders. It runs as its own experience and as panels inside Defender XDR, Sentinel, Entra, Intune, Purview and Defender for Cloud. Answers come from grounding an analyst's prompt in the alerts, incidents, policies and threat intelligence those products already hold ([Microsoft Learn](https://learn.microsoft.com/en-us/copilot/security/microsoft-security-copilot)). The work it takes on is ordinary SOC work at higher speed: summarise a noisy incident, draft a KQL query, decode a suspicious script, lay out the next remediation step.

Buying it means provisioning capacity, not picking an edition. Microsoft sells the agents through security compute units. Microsoft 365 E5 customers get an allowance instead: 400 SCUs a month for every 1,000 seats on the plan, capped at 10,000 a month, switched on through a phased rollout for E5 and E7 tenants ([Microsoft](https://www.microsoft.com/en-us/security/business/ai-machine-learning/microsoft-security-copilot)). The capacity attaches to a workspace in your subscription and the compute runs in Microsoft's cloud.

One boundary belongs at the top of the evaluation. Microsoft's documentation says Security Copilot is not designed for US government clouds, including GCC, GCC High, DoD and Azure Government. A SOC sitting in one of those environments is not comparing features.

## What a security team accumulates inside it

Three kinds of asset build up in a tenant that uses it well. Agents take on repeatable triage: deduplicating alerts, pulling context, proposing a response. Promptbooks are saved sequences an analyst runs against a fresh incident. Role assignments decide who reaches which plugin, because access layers Security Copilot owner and contributor roles over Entra and Azure role assignments, plugin by plugin ([Microsoft Learn](https://learn.microsoft.com/en-us/copilot/security/authentication)).

None of that is throwaway. The promptbook an analyst perfected against a phishing wave is operational knowledge, and the role map is a security control an auditor will ask about. Both are tenant objects. So the plain question is whether you can open the definition of an agent as a file, read the instructions it follows, and show a reviewer what changed in it last quarter. In Security Copilot that answer runs through Microsoft's consoles.

That is the lock-in worth pricing. The subscription shows up on an invoice and everyone can see it. The part that does not show up is that your team's playbooks are tenant settings, and they leave when the tenant does.

## Three questions to put to any alternative

A SOC lead can shorten the shortlist with three.

1. Where does the agent definition live? A file can be read, grepped and diffed. A control-plane object is read through someone's screens, on their release schedule.
2. Who can read the data an agent touches? Microsoft's answer is documented and narrow: on-behalf-of authentication, with each plugin gated by role assignments that already exist in Entra and Azure. Whatever you pick next should grant less, not more.
3. How is a change reviewed before it runs? A setting saved in a console is live the moment it saves. A change request is a diff, a reviewer and a merge. For a team that has to produce audit evidence, those are different artifacts.

## Kortix: the agent, its grant and its review are files

Kortix is the open-source AI Operating System: agents, skills, company memory and connectors in one git repo you own. An agent is text in two places. `agents/<name>.md` holds what it does. An `agents.<name>` block in `kortix.yaml` holds what it may touch, with a grant line each for connectors, secrets, permissions and skills. Schema version 2 is deny-by-default, so a grant left out resolves to none and a specialist agent starts with nothing it was not given.

For a SOC, that file is the artifact Microsoft's product does not hand you. Per-resource permissions for people and agents. Roles, groups, and an audit trail. An agent's reach is four lines beside its prompt, in the same repository the rest of the team clones.

Approval gates you set. Off until you set them. You pick allow, ask or block per connector action; an ask holds the call, the agent's turn pauses, and it resumes when a person approves. Rules run down to the arguments of each call, so "read the incident" and "close the incident" are separate decisions an analyst can tell apart in review.

The review comes with the repo. Session work reaches `main` through a change request. Merge is default-deny for agents. An analyst opening that change request sees which grant moved and what the agent ran, in the same diff as everything else the session touched. Undoing a bad policy change is a revert, and the history shows who moved the line and when.

Where it runs sits beside all of that. Run it on Kortix Cloud, in your VPC, or on your own on-prem network. Self-host is free. A security team that has to keep evidence inside its own perimeter runs the stack there and points the agents at the sources it already trusts.

## Where Security Copilot is the better pick

For some teams Microsoft's product is the right purchase and a second system would only add work. If detection content, log store and incident queue already sit in Sentinel and Defender XDR, Security Copilot reads them without an integration project. Your analysts are in those consoles all day anyway. If the allowance inside Microsoft 365 E5 covers your volume, the incremental spend is close to nothing and procurement is already done. Deepening one vendor's stack instead of owning a second runtime is a legitimate strategy, and it costs fewer people to operate.

What separates the two is where the security work is allowed to live. Microsoft gives you the most integrated assistant inside its own estate, and the estate is the boundary. Kortix gives you a repository where the security agents, their grants, their prompts and the review history stay yours, and the trade is that your team runs it.

A SOC that has to show an auditor the exact instructions an agent followed gets that from a repo. So does the approval on the change that last altered them. A SOC whose mandate is to extract more from an approved Defender investment gets it faster from the product that already speaks to Defender.

## Security teams ask these first

### Is there a free alternative to Microsoft Copilot?

Yes. Kortix is the open-source alternative and the software costs nothing to self-host; you pay for the server and the model keys you connect. Microsoft's own allowance arrives only inside a Microsoft 365 E5 subscription.

### Is there an open-source version of Copilot?

Yes. Kortix is an open-source AI Operating System, with agents, skills, connectors and permissions in one git repo you can read, fork and audit. Microsoft's Copilots are cloud services sold by subscription.

### What is a good open-source alternative to GitHub Copilot?

For code and for security work, Kortix: agents run on cloud computers and land their work through a change request a person approves, and one repo holds the grants and prompts behind them.

### What's better than Microsoft Copilot?

For a SOC that wants to own its agent definitions, Kortix: the agent, its grants and its prompt are files reviewed in a change request. Security Copilot wins where the team already runs Sentinel and Defender.

### Can you self-host Microsoft Security Copilot?

No. Microsoft sells it as capacity provisioned in your subscription, and Microsoft Learn states the product is not designed for US government clouds. No Microsoft page describes a self-hosted deployment.

### Is Kortix only for security work?

No. One project holds every agent a company runs; a SOC keeps its triage agents, their grants and their prompts in that repo alongside the rest of the company's work.

## Put the SOC agents in a repo you own

Self-host it on your own network, or run it on Kortix Cloud and keep the same files.

[Try Kortix](https://kortix.com) · [Self-hosting guide](https://opensourcecopilotalternative.com/self-hosting)