News
Microsoft Unveils Project Perception, Expands Runtime Security for AI Agents
Microsoft is pairing autonomous cyberdefense with new Defender protections designed to detect and block risky AI agent activity as it happens.
Microsoft on Monday introduced a new agentic security system and expanded runtime protections for AI agents as the company prepares enterprise defenders for attacks that increasingly move at machine speed.
The broader initiative, called Project Perception, brings together security signals, organizational context, AI models and specialized agents in what Microsoft describes as a continuously learning defense system. Separately, Microsoft is adding real-time protection and threat detection for agents governed through Microsoft Agent 365, giving security teams more visibility into how those agents behave after deployment.
Together, the announcements reflect Microsoft's argument that AI has changed both sides of cybersecurity. Attackers can use AI to produce exploits, expand campaigns and adjust their tactics more quickly. Meanwhile, enterprises are deploying agents that can access sensitive information, call tools and take actions without waiting for direct human approval.
"The physics of cybersecurity are changing," Hayete Gallot, executive vice president of Microsoft Security, wrote in the announcement. "Autonomous systems can now reason, adapt and operate continuously. At the same time, the cost of offense is falling, while the volume, velocity and complexity of what must be secured continues to grow."
Project Perception is Microsoft's proposed answer to that imbalance. Rather than simply generating more alerts for already overworked security operations teams, the system is intended to continuously evaluate risk, determine what matters and initiate defensive action while leaving people in control.
Microsoft organized the system around three types of specialized agents. Red team agents search for possible paths attackers could use to compromise an environment. Blue team agents investigate activity and determine whether it represents a meaningful risk. Green team agents apply corrective actions and strengthen defenses.
Those agents operate as a closed loop, allowing the system to discover weaknesses, assess their severity and improve protections as an organization's environment changes.
"The defining characteristic of the next generation of security systems will not be their ability to generate more alerts," Gallot wrote. "It will be their ability to continuously perceive, reason and act."
Project Perception draws from Microsoft's visibility across identities, endpoints, applications, data, cloud environments and AI systems. That information is converted into a shared security context that agents can use without repeatedly gathering and correlating raw signals.
Microsoft said the approach should improve the accuracy and consistency of agent decisions while reducing the computing resources, time and cost needed to operate an autonomous defense system.
The project also uses a multimodel architecture rather than relying on a single large language model for every task. Microsoft said the system can select among frontier models and specialized cybersecurity models based on quality, reliability, latency and cost.
The first use case incorporates Microsoft's MAI-Cyber-1-Flash model into MDASH, the company's multiagent system for finding software vulnerabilities. Microsoft said the configuration scored 96 percent on the CyberGym benchmark, 12 points above the Mythos model, while cutting costs by nearly 50 percent compared with the current MDASH configuration.
"No single model will be optimal for every security task," Gallot wrote. "Effective cyber defense requires applying the right model to the right problem at the right time."
Project Perception is scheduled to enter public preview Aug. 3.
Hardening Microsoft 365 Agents
While Project Perception focuses on using agents to defend orgs, Microsoft's second security push focuses on protecting the AI agents enterprises are deploying.
New Microsoft Defender capabilities integrated with Agent 365 are designed to discover agents, evaluate their security posture and monitor their activity at runtime. This is an important distinction because an agent that appears safe when it is created may encounter malicious instructions or take an unsafe action once it begins interacting with users, files and connected systems.
Microsoft Defender can inspect prompts and responses for agents built with Copilot Studio and Microsoft Foundry. For supported local agents running on Windows endpoints, Defender for Endpoint can examine the agent loop, including user prompts, tool calls and tool responses.
The protections are designed to stop threats such as prompt injection, in which hidden or malicious instructions manipulate an agent into ignoring its intended rules. Defender can block risky actions before they execute, then surface the activity as an alert for investigation in Microsoft Defender XDR.
Agent 365 provides the management layer behind those protections, including a centralized inventory of managed agents. Defender adds security posture assessments, threat detection, advanced hunting and incident investigation. Security teams can use those capabilities to trace suspicious behavior across the agent, its user identity, the endpoint and other affected resources.
The runtime security update applies to agents built with Microsoft tools as well as supported third-party and locally running agents onboarded through Agent 365. Local agent runtime protection on Windows endpoints is available in public preview.
The combined strategy gives Microsoft two complementary roles in the emerging agent security market: using autonomous agents to protect enterprise environments and securing the growing population of agents operating inside those environments.
That second challenge is likely to become more pressing as agents move beyond answering questions and begin modifying files, running code, communicating with other services and making decisions on behalf of employees. In that environment, identity controls and predeployment testing remain necessary, but they cannot account for every decision an agent may make in production.
Microsoft's latest push rests on the idea that defenders should be able to observe and intervene during the agent's decision-making process, not merely review what happened afterward.