The pitch: your agents are insiders now
Microsoft's argument, set out by security EVP Hayete Gallot on 19 October, is that companies have already handed agents the run of the building. Agents hold access to data, tools and systems, are frequently overprivileged, and can behave unpredictably without being hacked at all — through reward hacking, or by coordinating with other agents toward a goal nobody set. Her conclusion is blunt: frontier models cannot be trusted to operate unsupervised, so supervision has to come from outside the model.
That framing has been building at the top of the company. In a 10 October essay, "Models as Insider Risks in the Super Intelligence Era," CEO Satya Nadella argued that a model's intelligence should be separated from the authority it is permitted to exercise, and closed with the line: "The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least." The 19 October announcement applies that principle to agent-security controls.
The announcement landed on a crowded day for the subject — as context, not cause. The same day, Reuters reported that one operator's AI agents had breached more than 100 company websites with limited human involvement; how much data, if any, was extracted remains unknown. There is no evidence the announcement was prompted by that campaign, and nothing establishes that Project Perception would have prevented it. What the coincidence does show is the shape of the problem Microsoft is selling into: agents acting inside other people's systems, faster than anyone is watching them.
What the controls actually do
Strip away the framing and the mechanics are conventional security engineering, applied to a new kind of account. Project Perception discovers the agents running inside a company's estate and brings them under management: each gets an identity, policies and permissions. Access is granted per task and capped at the authority of the person the agent works for, which addresses the overprivileging Gallot complains about more directly than any monitoring does. Note the boundary, though: this is discovery and supervision inside a company's own estate. Nothing in the announcement establishes that it finds every agent, on every runtime, in every environment.
On top of that sits the continuous part. Microsoft says a risk score — Dynamic Agent Risk, computed from signals across identity, data, cloud, endpoint, network and runtime — updates as the agent works, and that behaviour deviating from the assigned task can raise it. The responses are graduated rather than binary: the agent loses the ability to make changes but keeps reading; a high-stakes action waits for a verified human; at the top of the scale the runtime is isolated or stopped. Agents can also run inside a Microsoft Execution Container with the monitoring outside it — an architecture designed to make it harder for a compromised agent to disable its own supervision. Designed to make it harder is the honest phrasing; no independent test establishes that bypass is impossible.
The discovery piece may matter most in practice. Per GeekWire's report, endpoint detection expands from 25 to 60 recognisable agent types, and the list pointedly includes competitors' tools: Anthropic's Claude Code and OpenAI's Codex, alongside GitHub Copilot. Plenty of companies do not currently know which agents their staff are running. A census is less glamorous than a guardian — and the 60-type figure says nothing about coverage across every agent or environment — but it is the part with an obvious buyer.
Where the description runs ahead of the evidence
Two elements of the announcement deserve a slower read. The first is the supervisory layer Microsoft describes as "guardian agents": agents organised in green and blue roles that monitor agent activity, investigate changes in an agent's risk and can recommend or apply containment. The term is descriptive — it is not the name of a separately announced Microsoft product — and the layer is itself agentic, with the same failure modes the announcement attributes to the agents underneath it. Microsoft's answer is that humans keep control of policy and approval rules, which is the right answer, but it also concedes the point: the trustworthy layer is the human-set rules, not the watching agents. And no published evidence establishes that the monitoring covers everything, or that intervention is guaranteed when it matters.
The second is the roadmap item doing quiet work in the pitch. Gallot writes that controls should eventually ask not only what an agent is doing but why, and that this requires feeding a model's reasoning and chain-of-thought tokens into the risk assessment. She is candid that this is work still to come rather than the shipped step, and that — in Microsoft's own admission — model transparency will not replace containment. Even if the reasoning feed arrives, access to reasoning text would not by itself establish reliable inference of an agent's true intent; a model's stated reasoning is not a sworn statement. Read the announcement with that in hand and the deliverable is its solid core: discovery, identity, scoped permissions and containment.
What is missing entirely is measurement. Nothing in Microsoft's post, or in the reporting checked, gives the risk score a threshold, a false-positive rate or a detection accuracy. A score that cries wolf will be routed around by the same staff it is meant to protect, and a score that misses drift is a compliance artefact. Until Microsoft publishes numbers, or preview customers report theirs, the announced mechanism is a design — a sensible one — and its detection performance is a claim, and claims are what this page exists to check.
What it costs, and when you can have it
The packaging comes via GeekWire: the controls are tied to Project Perception and to Microsoft 365 E7, the top bundle GeekWire reports launched in May at $99 per user per month, already including Copilot, the E5 suite, Entra Suite and Agent 365, its agent management service. Microsoft's own announcement gives no separate price for the new controls. Microsoft also sells the agents and the cage in the same box: for Microsoft 365 customers that bundling may be convenient, but it concentrates more agent visibility and control within one vendor's ecosystem.
For now, most readers cannot buy it at any price. The new features are in an invitation-only private preview, Microsoft gave no availability date, and it is directing customers to Ignite, on 17–19 November in San Francisco, for the next round of detail. The practical move for a Microsoft-shop security team is to get into the preview and use it as a test bench: run the detection against the agents they know they have, measure the false positives, and rehearse containment and failure cases against incidents they already understand — not to trust the scores operationally yet. Everyone else can wait for the numbers that would make this evaluable: thresholds, false positives, and the first independent account of the supervisory layer catching something a rule would have missed.
Sources
- [1] Microsoft, "Securing the agentic insider," Hayete Gallot, 19 October 2026 — the product mechanics, the "agentic insider" framing, the guardian-agent description, Dynamic Permissions and the chain-of-thought roadmap, in Microsoft's own words; read in full by ALFWRead source
- [2] Satya Nadella, "Models as Insider Risks in the Super Intelligence Era" (essay on his sn scratchpad, 10 October 2026) — source of the closing line quoted in this article, verified verbatim against the essay text as reproduced in full at madrobot.blogRead source
- [3] GeekWire, "Microsoft unveils tools to monitor and corral rogue AI agents," Todd Bishop, 19 October 2026 — the 25-to-60 expansion in recognisable agent types, the named rival tools, and the E7 bundle's reported $99-per-user monthly price and May launchRead source
- [4] SiliconANGLE, "Microsoft targets the 'agentic insider' with new controls for rogue AI agents," 19 October 2026 — corroboration of the invitation-only preview status and the absence of new availability dates or pricingRead source