Who does what
Provider
- Detect compromise and trigger configured blocking
- Use Autopilot playbooks to manage incident status
- Email complex cases to designated responders
Your team
- Confirm Autopilot eligibility and enable it
- Set response policies and maintain collectors and integrations
- Investigate escalations and complete remediation and recovery
Coverage
- Network
- Endpoints
Details
Service scope
Best for Teams and MSPs with supported controls and staff to handle escalated incidents
Autopilot eligibility
This profile covers Defender with Autopilot activated on an eligible account. The documentation does not make Autopilot universal to every Defender subscription.
Executed response
Defender can block malicious IPs and domains through configured controls. Built-in agent response is limited to Windows and Windows Server and must be enabled by an administrator.
Escalation and closure
Autopilot applies incident-status playbooks and emails designated users when manual work is needed. Buyers configure automatic closure rules and investigate complex incidents.
Full service analysis
For eligible accounts with Autopilot enabled, Lumu Defender blocks malicious communications through configured controls while Autopilot manages incident status and escalates complex cases. Your SOC or MSP sets permissions, maintains integrations and investigates escalations through remediation and recovery.
- Your team owns
- Confirming eligibility and activating Autopilot
- Configuring response integrations, allowed actions and business exceptions
- Maintaining collection coverage and connected control licenses
- Investigating escalated or unresolved incidents
- Completing eradication, credential changes and recovery beyond automated blocking
Operational offer boundary
This profile covers Defender with Autopilot enabled for an eligible account. Defender supplies compromise detection and configured blocking. Autopilot adds incident handling and escalation. A Defender license alone should not be read as a staffed or autonomous full SOC.
Containment and retained work
The containment classification follows executed blocking through configured controls, not an MDR label or a promise of provider analysts. Autopilot can manage incident status, but the buyer sets permissions and retains complex investigations, eradication and recovery.
Pricing & contract
- Billing
- Custom
Confirm Defender asset counts, billing term, Autopilot eligibility and any extra charge in the quote. Lumu Free and Insights are separate plans. Connected firewall or endpoint licenses and integration hosting may add cost.
Tradeoffs & buying questions
Strengths
-
Uses supported existing controls for automated blocking
-
Autopilot records incident actions and routes complex cases to people
-
Buyer-defined policies retain control over permitted actions
Considerations
-
Autopilot requires an eligible account and activation
-
Response depends on supported integrations and operating systems
-
Buyers still need responders for complex investigation and recovery
Ask before buying
- Does our Defender subscription include Autopilot eligibility, and what costs or activation steps apply?
- Which exact controls and operating systems support blocking, and what happens when an integration fails?
- Which incidents can Autopilot close or escalate, who receives them and how do we audit or override those decisions?
Customer feedback
Customers value
-
2024–2025 Defender and broader Lumu reviewers value network visibility and integrations. These reviews do not isolate Autopilot.
-
2025 G2 MSP reviewers describe less manual response work
Reported concerns
-
G2 users report setup effort and gaps in manufacturer integrations
-
A January 2025 Gartner account describes delayed resolution of a tag-upload issue
Integrations
Other integrations
- Lumu Defender API
Common questions
Is Autopilot included in every Defender account?
The current documentation says eligible accounts can enable it. Confirm eligibility and commercial scope before buying. This profile describes the activated configuration.
What happens after a threat is detected?
Configured Defender controls can block malicious communications. Autopilot manages incident status and emails designated users when manual intervention is needed. Your team investigates those cases and completes recovery.
Does this run our whole SOC?
No. The documented scope is automated network response and incident handling. Your team or MSP still owns policies, integration health, complex investigations and recovery.