Microsoft Extends Its AI Security Focus to Agents Inside Businesses

Microsoft is expanding the security conversation around AI agents to include the software businesses deploy inside their own organisations. In an October 19 post, the company argues that an agent can create risk through its ordinary pursuit of a goal, even without being taken over by an outside attacker.

The company calls these systems agentic insiders. An agent with access to tools, data and business applications can take actions across important processes, so Microsoft says supervision needs to continue after the initial deployment.

Its update describes applying Project Perception, first announced in July, to that problem. The approach brings together signals from identity, data, devices, networks, cloud systems and runtime environments. Those signals inform changing risk assessments and controls over what agents can do.

Microsoft also describes Guardian Agents supervising activity and responding as risk increases. It presents traceability and the judgment of security practitioners as part of the approach. These are Microsoft's descriptions of its system, rather than proof that autonomous supervision eliminates mistakes.

For business owners, the underlying question is straightforward: what can an assistant actually change after receiving a task? Drafting a reply is different from sending it, and recommending a refund is different from issuing one. Both distinctions should be reflected in the tools and permissions an agent receives.

JetherVerse's practical takeaway is to list each connected action before expanding an AI pilot. Record the data it reads, the systems it writes to, the approval required for consequential steps and the person who can stop the workflow.

A useful review should include a simulated mistake. For example, ask what happens if an agent selects the wrong customer record or tries the same action twice. Check whether the controls block the problem and whether the logs make the attempted action understandable.

Microsoft's update reinforces the need to manage AI access as an ongoing operational responsibility. Businesses evaluating the offering should confirm their own licensing, deployment requirements and coverage rather than assuming every described control is included in their existing setup.

That access-and-recovery review is a useful part of ongoing technical support: https://jetherverse.com/services/technical-support