News

Microsoft Targets AI-Era Threats with Project Perception and Stronger Agent Security

• By Chris Paoli
• July 28, 2026

As AI agents take on increasingly autonomous roles inside enterprises, Microsoft is rolling out new security capabilities intended to help organizations identify and stop malicious or risky agent behavior in real time. The announcement combines a new AI-driven cyberdefense framework with expanded runtime protections aimed at giving security teams greater oversight of deployed AI agents.

At the center of the rollout is Project Perception, Microsoft's new agentic security initiative, which combines security telemetry, organizational context, AI models and specialized agents into what the company describes as a continuously evolving defense system. Alongside the new platform, Microsoft is extending real-time monitoring and threat detection for AI agents managed through Microsoft Agent 365, enabling defenders to better track agent activity and respond to potential threats after deployment.

Together, the announcements reflect Microsoft's argument that AI has changed both sides of cybersecurity. Attackers can use AI to produce exploits, expand campaigns and adjust their tactics more quickly. Meanwhile, enterprises are deploying agents that can access sensitive information, call tools and take actions without waiting for direct human approval.

"The physics of cybersecurity are changing," Hayete Gallot, executive vice president of Microsoft Security, wrote in the announcement. "Autonomous systems can now reason, adapt and operate continuously. At the same time, the cost of offense is falling, while the volume, velocity and complexity of what must be secured continues to grow."

Project Perception is Microsoft's proposed answer to that imbalance. Rather than simply generating more alerts for already overworked security operations teams, the system is intended to continuously evaluate risk, determine what matters and initiate defensive action while leaving people in control.

Microsoft organized the system around three types of specialized agents. Red team agents search for possible paths attackers could use to compromise an environment. Blue team agents investigate activity and determine whether it represents a meaningful risk. Green team agents apply corrective actions and strengthen defenses.

Those agents operate as a closed loop, allowing the system to discover weaknesses, assess their severity and improve protections as an organization's environment changes.

"The defining characteristic of the next generation of security systems will not be their ability to generate more alerts," Gallot wrote. "It will be their ability to continuously perceive, reason and act."

Project Perception draws from Microsoft's visibility across identities, endpoints, applications, data, cloud environments and AI systems. That information is converted into a shared security context that agents can use without repeatedly gathering and correlating raw signals.

Microsoft said the approach should improve the accuracy and consistency of agent decisions while reducing the computing resources, time and cost needed to operate an autonomous defense system.

The project also uses a multimodel architecture rather than relying on a single large language model for every task. Microsoft said the system can select among frontier models and specialized cybersecurity models based on quality, reliability, latency and cost.

The first use case incorporates Microsoft's MAI-Cyber-1-Flash model into MDASH, the company's multiagent system for finding software vulnerabilities. Microsoft said the configuration scored 96 percent on the CyberGym benchmark, 12 points above the Mythos model, while cutting costs by nearly 50 percent compared with the current MDASH configuration.

"No single model will be optimal for every security task," Gallot wrote. "Effective cyber defense requires applying the right model to the right problem at the right time."

Project Perception is scheduled to enter public preview Aug. 3.

Hardening Microsoft 365 Agents
While Project Perception focuses on using agents to defend orgs, Microsoft's second security push focuses on protecting the AI agents enterprises are deploying.

New Microsoft Defender capabilities integrated with Agent 365 are designed to discover agents, evaluate their security posture and monitor their activity at runtime. This is an important distinction because an agent that appears safe when it is created may encounter malicious instructions or take an unsafe action once it begins interacting with users, files and connected systems.

Microsoft Defender can inspect prompts and responses for agents built with Copilot Studio and Microsoft Foundry. For supported local agents running on Windows endpoints, Defender for Endpoint can examine the agent loop, including user prompts, tool calls and tool responses.

The protections are designed to stop threats such as prompt injection, in which hidden or malicious instructions manipulate an agent into ignoring its intended rules. Defender can block risky actions before they execute, then surface the activity as an alert for investigation in Microsoft Defender XDR.

Agent 365 provides the management layer behind those protections, including a centralized inventory of managed agents. Defender adds security posture assessments, threat detection, advanced hunting and incident investigation. Security teams can use those capabilities to trace suspicious behavior across the agent, its user identity, the endpoint and other affected resources.

The runtime security update applies to agents built with Microsoft tools as well as supported third-party and locally running agents onboarded through Agent 365. Local agent runtime protection on Windows endpoints is available in public preview.

The combined strategy gives Microsoft two complementary roles in the emerging agent security market: using autonomous agents to protect enterprise environments and securing the growing population of agents operating inside those environments.

That second challenge is likely to become more pressing as agents move beyond answering questions and begin modifying files, running code, communicating with other services and making decisions on behalf of employees. In that environment, identity controls and predeployment testing remain necessary, but they cannot account for every decision an agent may make in production.

Microsoft's latest push rests on the idea that defenders should be able to observe and intervene during the agent's decision-making process, not merely review what happened afterward.