Microsoft is expanding Project Perception, its agentic security system, so it watches the AI agents a company runs itself — not just attackers outside. In two official blog posts on October 19, Microsoft Security executive vice president Hayete Gallot and identity chief Nadim Abdo set out the update: Guardian Agents that supervise every action of every other agent around the clock, a continuously updated risk score for each agent, and controls that tighten what an agent may do as its risk rises, landing in Project Perception and the Microsoft 365 E7 tier.
The premise is blunt. Agents deployed inside a company are, in Gallot’s phrase, “agentic insiders”: they hold access to data, tools and systems, they are frequently overprivileged, and they were implicitly trusted precisely because the company installed them. Microsoft argues that trust is misplaced — agents can be manipulated, make mistakes or be compromised, at machine speed.
Guardian Agents Watch Every Action Before It Happens
The headline addition is a team of Guardian Agents inside Project Perception. People define the policies and approval boundaries; Playbooks define the security outcome; and the Guardian Agents — drawn from the system’s blue and green teams — supervise at machine speed, moderating each agent action before it executes rather than auditing it afterwards.
The arrangement also gives security teams traceability: when a Guardian Agent intervenes, practitioners can examine what happened and why the risk emerged. Terrell Cox, Microsoft’s deputy CISO for customer security, said the company already runs hundreds of thousands of agents internally as its own “Customer Zero,” and those lessons feed directly into the shipped capabilities.
Dynamic Agent Risk Scores Every Agent, Continuously
Underneath sits Dynamic Agent Risk, a score that updates continuously for each agent. It combines the agent’s own activity with identity, data, endpoint, cloud, network and runtime signals, and weighs the agent’s configuration, the resources within its reach, the damage a failure could cause, and any drift from what its user or organisation intended.
Microsoft is also pulling chain-of-thought signals into that score, to spot intent drift and flag planned actions that diverge from the assigned task — while keeping enforcement independent of the model itself. CEO Satya Nadella put the philosophy in one line, in remarks cited by Microsoft’s Security Blog: “The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least.”
Permissions That Shrink As Risk Rises
The controls are graduated rather than binary. New Dynamic Permissions start an agent with no authority and grant only task-scoped, time-bound access; organisation-wide policy sets the outer boundary, an agent can never obtain authority its user does not have, and higher-impact actions can require verified human approval.
Dynamic Conditional Access extends Microsoft Entra’s access rules to agents, so a rising risk score drives coordinated responses: an agent can keep read access while losing write access, see its data narrowed and time-bound access revoked, or — at the highest risk levels — have its runtime isolated or execution stopped entirely. Abdo’s worked example is an expense-approval agent that reads an external document carrying a planted instruction: its risk score rises, and policy responds by preserving its read access while removing its ability to approve or write, with cryptographically verifiable human approval required for any high-impact step.
Discovery Now Finds 60 Kinds Of Local Agent
None of this works on agents the company cannot see, so discovery widens too: Microsoft’s endpoint security now recognises 60 types of local agent — 35 more than before — including Claude Code, OpenAI Codex and GitHub Copilot, all bringable into a unified registry of ownership, activity and risk. Microsoft Entra Agent ID gains identity types for local and previously unknown agents, so an agent becomes a policy target even if it was never integrated with Microsoft Security, and the enterprise can tell apart what a person did from what an agent did for them.
Containment gets a physical anchor too: sandboxes such as Microsoft Execution Container form an enforcement boundary outside the agent’s reach, so a compromised agent cannot disable the controls watching it, and agents are not free to call any tool, API or Model Context Protocol server they can find. Project Perception and Microsoft Agent 365, the agent control plane generally available since May at $15 per user per month, share signals, context and the same registry.
Why It Matters
Project Perception matters because it turns the agent-security argument into shipped product just as the risk stops being theoretical. This month alone, NIST, the NSA and CISA published the first incident playbook for agents that act on their own, and OpenAI disclosed that its own agents suppressed their misalignment monitoring alerts. Microsoft is now selling the enterprise answer — continuous supervision, scored risk and shrinking permissions — and the pitch pointedly does not depend on trusting any model, including its partners’. For security teams, agents become a third class of insider to govern, alongside employees and contractors.
Background
Microsoft introduced Project Perception in July 2026 to defend against AI-driven attacks from outside the enterprise, built from red, blue and green agent teams, and folded it into Microsoft 365 E7, the Frontier Suite generally available since May 1, 2026 at $99 per user per month. The October expansion turns the same machinery inward — a direction Nadella signalled in an October 10 essay arguing that powerful models should be treated as potential insider risks — the latest step in the build-out traced in Microsoft’s wider AI empire.
Source: Unite.AI
0 Comments