AI Agents Are Becoming a New Security Perimeter

The enterprise security perimeter is changing — and AI agents are becoming part of it.

Organizations are rapidly adopting AI-powered tools capable of performing increasingly sophisticated tasks: analyzing documents, accessing business applications, writing code, querying databases and executing workflows on behalf of users.

But as these capabilities expand, so does the security challenge.

An AI agent is no longer simply a conversational interface. Depending on its configuration, it may operate with its own identity, delegated permissions, access to enterprise resources and the ability to execute actions across multiple systems.

That makes AI agents a new category of identities, workloads and potential attack surfaces that security teams must understand and govern.

From Shadow AI to Agent Visibility

One of the challenges facing enterprise security teams is understanding which AI agents are operating across their environments.

Employees and developers may introduce tools such as ChatGPT, Claude Code and other AI-powered applications, sometimes outside established IT governance processes.

Microsoft Security’s demonstration highlights emerging capabilities for discovering AI agents and assessing their associated risks.

This includes visibility into agent activity, security posture and potential exposure across supported environments.

The objective is to move beyond simply identifying AI applications toward understanding the risks associated with how agents operate.

AI Agents Need Identity and Access Governance

Consider an AI coding agent that can inspect repositories, modify files and execute terminal commands.

Such an agent may require access to sensitive development environments, source code, credentials or internal services.

Microsoft’s demonstration illustrates how agent identity and authentication information can become part of the security assessment, including agent identities associated with Microsoft Entra.

This introduces important questions for security administrators:

• Who owns the agent, and who is accountable for its actions?

• What resources can the agent access?

• Does it operate through delegated or autonomous authentication?

• How are permissions granted, reviewed and revoked?

• Can security teams detect unusual behavior or excessive privileges?

  
  

These are familiar Identity and Access Management questions, but they now apply to a new generation of non-human actors.

From Risk Assessment to Adaptive Protection

Visibility alone is not sufficient.

Microsoft’s demonstration also highlights a more integrated approach to agent protection, bringing together risk signals, security recommendations and protective controls.

The capabilities shown include assessments of runtime risk, exposure and potential blast radius, alongside protection experiences for AI agents.

This is particularly relevant when agents interact with external services, development tools, enterprise data sources or Model Context Protocol (MCP) integrations.

The security challenge is not only whether an agent is legitimate.

It is whether the agent continues to operate within acceptable boundaries as its capabilities, connections and behavior evolve.

Security Operations Must Evolve with Agentic AI

Traditional security operations were designed primarily around human users, devices, applications and infrastructure.

Agentic AI introduces another operational dimension.

Security teams must increasingly correlate identity, data access, agent behavior, runtime activity and potential security incidents.

The emerging direction is toward unified visibility and risk-informed protection rather than isolated controls for each AI tool.

Microsoft’s work across Microsoft 365, Defender and its Project Perception capabilities reflects this broader evolution.

The demonstration by Microsoft CVP Yina Arenas provides an early view of how security teams may discover, assess and protect AI agents through integrated experiences.

Availability note: This article discusses capabilities shown in the Microsoft Security demonstration. It does not establish general availability of the Project Perception capabilities demonstrated, or universal support for third-party AI tools. Availability, licensing, supported integrations and rollout status must be checked for each capability and tenant.

Watch the original Microsoft Security demonstration below.