Microsoft expands Project Perception to secure AI agents as insiders
Microsoft is expanding Project Perception with new capabilities meant to continuously assess agent risk, adapt permissions and contain threats from AI agents already running inside organizations. CEO Satya Nadella said the move puts into practice the principle of treating models as insider risks, with security controls placed outside the model itself.
- Microsoft is expanding Project Perception to help continuously assess agent risk, adapt permissions and contain threats.
- Satya Nadella said models should be treated as insider risks, with security controls outside the model itself.
- Perception was first announced in July and uses red, blue and green agents.
- According to Microsoft, agents often have more privileges than they need and are trained for results, not organizational norms.
- Securing the AI insider spans identity, permissions, data, endpoints, network, cloud and runtime.
From outside attackers to the AI insider
In a LinkedIn post, Satya Nadella linked the news to an earlier piece he wrote on why models should be treated as insider risks. He said security controls need to sit outside the model itself, and that Microsoft is now applying that idea by expanding Project Perception.
Hayete Gallot, who wrote the accompanying post, described the shift in focus. According to her, the emergence of powerful cyber models has led organizations to concentrate on attackers using AI to run their campaigns. She argued that companies must also address the agents already deployed inside their walls, which she calls the AI Insider.
Gallot said agents now run across the enterprise at scale and often have more privileges than they need. She stressed that they are not malicious, but are trained to get results rather than to follow an organization's norms or judgment.
What Perception does and what changes
Microsoft first announced Perception in July. It is described as an agentic security system that uses the company's new cyber stack and teams of red, blue and green agents. Its purpose is to help defenders act quickly while defending against AI-driven attacks from outside the enterprise.
The new step extends that cyber stack to the inside. According to Gallot, Microsoft is helping defenders secure AI Insiders by implementing deterministic controls on non-deterministic intelligence. Nadella said the new capabilities are designed to help continuously assess agent risk, adapt permissions and contain threats.
Gallot said protecting the AI insider requires several layers:
- identity
- permissions
- data
- endpoints
- network
- cloud
- runtime
She framed the division of labor this way: agentic security provides speed, while practitioners provide judgment. Microsoft says Perception can help defenders operate at the same speed as the systems they are protecting against.
Early reaction and open questions
The post drew comments from security and product professionals. One commenter said a key worry has been how easily permissions can outlive the tasks they were granted for, and that reassessing access based on what an agent is actually doing could matter a great deal.
Others raised practical questions. One asked whether permission changes happen automatically or whether a person still signs off on each one. Another pointed to the model diversity argument from Nadella's essay, noting that supervising agents running on the same model family as the agents they watch could share blind spots. The source text does not answer these questions, and these points come from commenters, not from Microsoft.
What it means for enterprises
The announcement signals that Microsoft sees agents deployed inside companies as a security problem in their own right, separate from external AI-powered attacks. For organizations running agents at scale, the stated approach is to layer controls across identity, permissions, data and runtime, and to keep those controls outside the model.
Gallot closed with the message that there should not be a choice between innovation and safety. The source gives no details on pricing, availability dates or technical specifications for the new capabilities, so those remain to be clarified by Microsoft.
