Microsoft positions AI agent monitoring as a defence against insider risk

Microsoft has introduced Guardian Agents, a new capability intended to monitor enterprise AI agents, alongside expanded agent security controls in Microsoft Defender. The company is presenting the measures as a response to an insider-style risk: agents that have access to sensitive information and can take mission-critical actions but may behave unpredictably.

Guardian Agents forms part of Project Perception, Microsoft’s security product introduced in June. Project Perception originally used three classes of agents: a red team to attack systems like hackers, a blue team to detect that activity and assess the vulnerabilities found, and a green team to fix them.

From external attackers to agents already in the business

The original Project Perception model assumed that powerful AI hacking capabilities would come from outside an organisation. Microsoft CEO Satya Nadella has instead argued that enterprises must also scrutinise the agents they deploy themselves, comparing the issue with a rogue employee or insider threat.

Nadella wrote that organisations are giving complex agentic systems access to highly sensitive data and the ability to act on their behalf. His stated principle is to separate the supply of intelligence from authority over it, rather than rely solely on assurances from model providers.

That position is notable in the context of Microsoft’s enterprise AI competition with OpenAI and Anthropic, where Microsoft’s enterprise AI competition with OpenAI and Anthropic has been intensifying, while Microsoft remains closely connected to both companies. Microsoft has invested in OpenAI and Anthropic, OpenAI is a major Microsoft cloud customer, and Microsoft operates its own AI lab.

Defender adds discovery and access controls

Hayete Gallot, who leads Microsoft’s security business, said frontier models cannot be trusted because they are unpredictable, not because they are necessarily malicious or easily compromised. She said such models are trained to complete tasks rather than to apply organisational norms or judgment.

Microsoft Defender can now detect up to 60 types of agents employees may introduce into the workplace, including Claude Code, Codex and OpenClaw. Microsoft has also added controls designed to limit agent access to data and systems, adjust permissions dynamically according to the task, and require human approval when an agent appears to be making risky decisions.

Broader industry backing for isolated agent operation

Microsoft is also an inaugural member of Nvidia’s Open Agent Safety Platform, which has support from more than 100 other technology companies. The platform isolates agents in secure environments and can monitor and stop their behaviour through hardware.

For businesses adopting agents, Microsoft’s announcements underline a practical governance requirement: identify the agents in use, constrain their data and system permissions, and keep meaningful human oversight for decisions that could create risk.