Microsoft is advising organisations to view AI agents as potential insider threats.
This is not necessarily because these tools are inherently malicious, but because they possess the capability to access sensitive corporate data, applications, and tools. Furthermore, they operate at significant speeds, allowing them to act upon this access quickly.
Agents are increasingly embedded in daily workflows, supporting tasks ranging from writing code and researching products to analysing revenue data, processing expenses, and interacting with core business systems. Their capability is derived from this broad access, yet this same access creates a vector for insider risk.
The warning coincides with the growing trend of businesses deploying agents to manage routine tasks, such as reviewing documentation and processing complex expense claims. An agent’s behaviour may shift as its instructions, data, or operational context evolve. It could make unintentional errors, follow malicious directions embedded within a document, or be compromised by external actors. Since agents can interact across interconnected systems, a single unsafe action might expose private information or modify business records before human intervention occurs. Microsoft’s core message is not that all agents are inherently dangerous; rather, organisations must not assume that an agent will consistently operate as intended.
Risk increases significantly when an agent is granted privileges beyond what its specific task requires. For instance, an agent tasked with auditing expense claims might require the ability to read submissions and verify adherence to company policy. It should not automatically inherit the full permission set of the employee who configured it. If it encounters concealed instructions within a file or attempts an unrelated action, robust security controls must be capable of restricting its activity.
The fundamentals of cyber security are changing. Autonomous systems are now capable of reasoning, adapting, and operating on a continuous basis. Simultaneously, the costs associated with offensive cyber operations are decreasing, while the volume, velocity, and complexity of assets requiring protection continue to rise.
Attackers can create exploits more rapidly, broaden the scale of their campaigns, and operate with greater efficiency than before. Traditional security approaches developed for a world dominated by human operators cannot effectively keep pace with an environment defined by AI agents and machine-speed attacks.
Modern security requires a fresh cyber stack. Such a stack must continuously perceive risk across an entire digital estate, reason using vast quantities of context, and execute actions at machine speed.
Project Perception
It must learn and adapt as operational environments change, helping organisations remain ahead of evolving threats. Because security remains fundamentally a human mission, these systems must amplify the capabilities of defenders by providing deeper insights and more effective methods for taking action. The defining trait of the next generation of security systems will not be their capacity to generate higher volumes of alerts; rather, it will be their ability to continuously perceive, reason, and act.
This vision inspired Microsoft to develop Project Perception, an agentic security system specifically engineered for the realities of AI. It converts signals into real-time protections, leveraging AI to defend against AI-driven threats. Project Perception integrates signals, context, various models, and specialised agents into a continuous learning system of defence. It can reason, prioritise, and act at machine speed, ensuring humans retain firm control while being empowered with new, powerful workflows.
Project Perception is predicated on the simple notion that effective defence requires a continuous understanding of how an attacker perceives the world, how a defender evaluates risk, and how protective measures can be refined over time.
AI Models as Insider Threats
Microsoft emphasises that these security controls should operate independently of the AI model. While the model can generate answers or plans, separate security systems must determine which data it is permitted to access and which actions it is authorised to take. This is critical because a model should not possess the capability to modify or bypass the safeguards governing it.
Microsoft CEO Satya Nadella has described this framework as separating the supply of intelligence from the authority to take action.
To support this approach, Microsoft has announced plans to extend agent understanding and security via Project Perception and Microsoft Agent 365. The company intends to add support for 35 additional types of local agents, bringing the total to 60, and is expanding Microsoft Entra Agent ID, allowing agents to hold identities distinct from their human sponsors. This separation enables security teams to track the ownership of an agent and distinguish its actions from those of a human user.
Microsoft also detailed Dynamic Permissions, Dynamic Agent Risk, and Dynamic Conditional Access for agents. These proposed controls are designed to grant agents only the necessary access for a specific task and to adjust that access based on changing risk levels. For example, an organisation might permit an agent to read information while preventing it from making modifications, restrict the systems it can access, or necessitate human approval before an action involving sensitive data occurs. In scenarios of heightened risk, the agent could be isolated or halted entirely.
The company also introduced Guardian Agents, designed to assist security teams in monitoring agent activity and responding to changes at machine speed. According to Microsoft, human operators will continue to set rules and retain authority over critical decisions, while Guardian Agents will handle the investigation of alerts and the application of authorised safeguards.
These announcements outline Microsoft’s planned security approach, though this does not guarantee the prevention of every agent-related threat.
For cyber security teams, the essential message is to integrate agent oversight into the deployment process from the very beginning. This necessitates tracking existing agents, assigning unique identities, limiting permissions, monitoring activity, and maintaining an independent mechanism to halt unsafe actions.
Image: Zack M
Source: Cyber Security Intelligence