Microsoft CEO Satya Nadella announced yesterday that Project Perception is expanding with new capabilities to continuously assess agent risk, adapt permissions, and contain threats.
I recently wrote about why we need to treat models as insider risks, with security controls sitting outside the model itself.
Today, we're putting that principle into practice by expanding Project Perception with new capabilities to help continuously assess agent risk, adapt…
— Satya Nadella (@satyanadella) October 19, 2026
Expansion of Project Perception
Project Perception is an agentic security system that uses Microsoft’s new cyber stack and teams of red, blue and green agents to help defenders act with speed while defending against AI-driven attacks from outside of the enterprise. The same cyber stack is also directly applicable to managing and governing the agentic insiders that run in the enterprise.
The company has now introduced capabilities to treat AI agents as insider risks by continuously assessing their risk, adapting permissions, and containing threats through external controls.
Project Perception is now enhanced with Guardian Agents to supervise internal AI actions, discover across more agent types, and enforce unified policies. An AI agent brings together a model, a harness that orchestrates its work, an action space of tools and resources and a runtime in which it executes. Securing an agent requires protection across multiple layers: identity, permissions, data, endpoints, network, cloud and runtime.
Project Perception can be leveraged to contain agentic insiders (agents frequently overprivileged, have access to data, tools and systems and can take actions and make decisions in critical processes), implementing deterministic controls on non-deterministic intelligence:
- Sensors/Signals/Actuators: bring together signals across the various sensors (identity, data, cloud, endpoint, network, runtime) to discover agents in the enterprise and bring them under management by assigning an identity, container and set of policies and permissions.
- Context: use those signals to compute, dynamically, the risk associated with what the agents are attempting to do.
- Harness/agents/models: based on dynamic agent risk, a team of Guardian Agents, with green and blue agents, actively and continually supervise every action of every agent and surgically respond as the risk profile increases, in real time.
Project Perception can supervise in real time while providing traceability for practitioners to examine what happened, understand why the risk emerged and apply the judgment needed to update their security system accordingly.
Microsoft’s security controls should increasingly be able to ask not only “What is happening?” but also “Why is it happening?” Is this consistent with the intent of the task?” This will require greater transparency into the model itself, not only the input and output tokens, but the thinking and chain-of-thought tokens.
