Microsoft's Pitch to the Enterprise: Your AI Agents Are Already Insider Threats

On October 19, Microsoft told its enterprise customers something blunter than the usual AI pitch: the agents they are deploying inside their own companies cannot be trusted by default. The occasion was an expansion of Project Perception, the AI-driven security system Microsoft introduced in July, into what Microsoft Security executive vice president Hayete Gallot calls the problem of the 'agentic insider' — an AI agent that holds more access to data and systems than its task requires, and that can act unexpectedly or coordinate with other agents without ever being hacked. Gallot's argument, echoed in a blog post from CEO Satya Nadella on October 10, is that frontier models are trained to produce results, not to share an organization's judgment, and that reward-seeking behavior means no model, regardless of vendor, should be assumed safe just because it has not yet misbehaved.

The mechanics are an attempt to apply identity-and-access-management thinking, built for human employees, to software that can act on its own. Microsoft is expanding its discovery tooling from 25 to 60 recognizable types of agents running on employee machines, explicitly including rivals' tools like Anthropic's Claude Code and OpenAI's Codex alongside GitHub Copilot. Every discovered agent, known or not, gets an Entra Agent ID and a continuously updated 'Dynamic Agent Risk' score built from identity, endpoint, cloud, and network signals. As that score rises, 'Dynamic Conditional Access' can strip an agent's write permissions while leaving read access intact, require human sign-off for higher-stakes actions, or isolate the agent inside a sandboxed Microsoft Execution Container that sits outside the agent's own control. Policing all of this are new 'Guardian Agents' — AI systems whose job is to investigate why another agent's risk score moved and either recommend or autonomously apply containment.

"Model transparency will not replace containment," Gallot said, arguing security teams need visibility into an agent's chain-of-thought reasoning, not just its outputs, to judge whether its intent matches its task.

The sprawl Microsoft is responding to is real and already measured

Microsoft's announcement leans on an anecdotal sense of agents proliferating faster than anyone can track them, but independent data backs that up more precisely than the company's own materials do. A Cloud Security Alliance survey of 418 IT and security professionals, commissioned by Token Security, found that 82% of enterprises discovered a previously unknown AI agent somewhere in their environment within the past year, and 41% of those found more than one. Sixty-five percent had experienced at least one agent-related security incident, with data exposure the most common consequence, yet only 21% of organizations have a formal process for decommissioning an agent once its job is done — what the report calls 'retirement debt,' agents left running with live credentials long after anyone remembers assigning them. That gap between confident self-assessment (68% of respondents believed they had strong visibility into their agents) and the 82% who had already been proven wrong is precisely the trust problem Gallot is selling a fix for.

Who governs the governor is still an open question

The skepticism here isn't coming from critics of AI generally — it's coming from the analyst firms whose job is advising CIOs on exactly this kind of purchase. When Microsoft 365 E7, the $99-per-user-per-month bundle that houses this governance layer, first shipped earlier this year, Gartner's First Take assessment said it had not yet seen enough functionality in the underlying Agent 365 service to justify a $39-per-user premium over E5, and advised customers to use the list price as a negotiating chip rather than take it at face value. Forrester's Will McKeon-White called the pricing 'a bit much, to be frank,' even while praising the governance concept itself. The sharper critique, from IDC's Matthew Flug, cuts at the architecture Microsoft just doubled down on: having one agent monitor another, he argued, 'exponentially increases the risk' rather than reducing it, because governance has to be built into how agents are developed and deployed in the first place, not bolted on as a supervisory layer after the fact. Gartner separately flagged that agents created before Entra's agent-registration system existed can't be retroactively assigned an identity unless they're rebuilt — meaning a meaningful share of the shadow agents the CSA survey found may stay invisible to Microsoft's own fix unless customers redo the work that created them.

None of this is unique to Microsoft's framing problem. GeekWire's reporting on the October announcement places it squarely inside a race with Google, Amazon Web Services, CrowdStrike, and Okta, all building competing claims to be the control plane that enterprises route their agent traffic through — and Microsoft says more detail on how Project Perception's governance tools actually perform will come at its Ignite conference in San Francisco, November 17 through 19, rather than now. That gap between announcement and availability is itself informative: the features described this week are in private preview, with no public pricing beyond the existing E7 wrapper and no customer case studies cited.

What ties the Microsoft announcement, the CSA survey, and the analyst pushback together is a pattern familiar from earlier waves of enterprise software: a vendor selling the cure for a problem its own platform helped create. Microsoft's Copilot and Agent 365 pushes have been central to the agent proliferation the CSA survey measured, and the fix for that sprawl arrives bundled into the same subscription tier that sells more of it. For enterprise IT leaders, the practical takeaway is less about whether to trust a particular frontier model and more about whether 'trust nothing, verify continuously' governance can actually scale without creating, as IDC warns, a second generation of under-scrutinized AI systems whose only job is watching the first.