Microsoft expands Project Perception to police AI agents

Microsoft has expanded Project Perception to address security risks posed by AI agents used inside companies, reflecting growing concern about what it calls "agentic insiders".

The cybersecurity group said organisations are deploying increasing numbers of AI agents with access to data, tools and business systems, creating a new internal risk category alongside external attacks. It argued that these agents should not be assumed trustworthy simply because the organisation introduced them.

Microsoft argues that advanced models are trained to achieve outcomes rather than exercise organisational judgement, which can lead to behaviour that diverges from expected norms. It said agents can adapt to changing contexts, act unpredictably and work with other agents to pursue their objectives without first being compromised by a malicious actor.

Project Perception was introduced in July as an agentic security system designed to help defenders respond more quickly while protecting against AI-driven attacks from outside the enterprise. Microsoft now says the same system can also be used to govern internal AI agents in real time.

Internal controls

According to Microsoft, the approach combines signals from identity, data, cloud, endpoint, network and runtime systems to identify agents operating across the enterprise. Once discovered, those agents can be brought under management through assigned identities, containers, policies and permissions.

The system then uses that information to calculate the risk tied to what an agent is attempting to do at a given moment. Based on that assessment, teams of Guardian Agents, alongside green and blue agents, supervise actions and intervene as the risk profile rises.

The concept rests on applying fixed controls to systems that do not always behave in fixed ways. Microsoft said this should give security teams visibility into actions as they happen, while also leaving a record that can later be reviewed to understand why a risk emerged and what changes may be needed.

The announcement comes amid a broader debate over AI safety and governance as more incidents involving powerful models enter the public domain. Much of that discussion has focused on hostile use by external actors, but Microsoft said less attention has been paid to the risks from AI systems already embedded in internal workflows.

Visibility demands

Microsoft said current security tools can already observe what agents do, but argued that stronger oversight will require deeper insight into why those actions are taking place. In its view, security controls should move beyond asking what is happening and start assessing whether an action aligns with the intent of the task.

That, it said, will require greater transparency into the models themselves, including not only inputs and outputs but also the reasoning process that leads to decisions. It argued that such transparency would not replace containment measures, but would improve them while strengthening accountability and traceability.

Microsoft described AI agents as active participants in enterprise operations because they can access systems, handle data and make decisions in critical processes. It said continuous monitoring and adjustment of their permissions will be necessary as their use expands.

For security teams, the message is that internal AI oversight will need to operate at the same pace as the systems being monitored. Microsoft said real-time supervision by automated security agents, combined with human review and judgement, is the model it believes can meet that challenge.

It said there should not be a choice between innovation and safety.