AI is rapidly becoming the backbone of our world, promising unprecedented productivity and innovation. But as organizations deploy AI agents to unlock new opportunities and drive growth, they also face a new breed of cybersecurity threats.<\/p>\n
There are a lot of\u00a0Star Trek<\/em>\u00a0fans here at Microsoft, including me. One of our engineering leaders gifted me a life-size cardboard standee of\u00a0Data<\/a>\u00a0that lurks next to my office door. So,\u00a0as I look at that cutout, I think about the Great AI Security Dilemma:\u00a0Is\u00a0AI going to be our best friend or our worst nightmare? Drawing inspiration from the duality of the android officer\u00a0Data<\/a>, and his evil twin\u00a0Lore<\/a>\u00a0in the\u00a0Star Trek\u00a0<\/em>universe, today\u2019s AI agents can either fortify your cybersecurity defenses \u2014 or, if mismanaged \u2014 fracture them.<\/p>\n The influx of agents is real. IDC research[1]<\/a>\u00a0predicts there will be 1.3 billion agents in circulation by 2028. When we think about our agentic future in AI,\u00a0the duality of Data and Lore seems like\u00a0a great way\u00a0to think about what\u00a0we\u2019ll\u00a0face with AI agents and how to avoid double agents that upend control and trust. Leaders should consider three principles and tailor them to fit the specific needs of their organizations.<\/p>\n Security is not just an IT issue \u2014 it\u2019s a board-level priority. Unlike traditional software, AI agents are even more dynamic, adaptive and likely to operate autonomously. This creates unique risks.<\/p>\n We must accept that AI can be abused in ways beyond what we\u2019ve experienced with traditional software. We employ AI agents to perform well-meaning tasks, but those with broad privileges can be manipulated by bad actors to misuse their access, such as leaking sensitive data via automated actions. We call this the \u201cConfused Deputy\u201d problem. AI Agents \u201cthink\u201d in terms of natural language where instructions and data are tightly intertwined, much more than in typical software we interact with. The generative models agents depend on dynamically analyze the entire soup of human (or even non-human) languages, making it hard to distinguish well-known safe operations from new instructions introduced through malicious manipulation. The risk grows even more when shadow agents \u2014 unapproved or orphaned \u2014 enter the picture. And as we saw in Bring Your Own Device (BYOD) and other tech waves, anything you cannot inventory and account for magnifies blind spots and drives risk ever upward.<\/p>\n AI agents may be new as productivity drivers, but they can still be managed effectively using established security principles. I\u2019ve had great conversations about this here at Microsoft with leaders like Mustafa Suleyman, cofounder of DeepMind and now Executive Vice President and CEO of Microsoft AI. Mustafa frequently shares a way to think about this, which he outlined in his book\u00a0The Coming Wave,\u00a0<\/em>in terms of Containment and Alignment.<\/p>\n Containment simply means we do not blindly trust our AI Agents, and we significantly box every aspect of what they do. For example, we cannot let any agent\u2019s access privileges exceed its role and purpose \u2014 it\u2019s the same security approach we take to employee accounts, software and devices, what we refer to as \u201cleast privilege.\u201d Similarly, we contain by never implicitly trusting what an agent does or how it communicates \u2014 everything must be monitored \u2014 and when this isn\u2019t possible, agents simply are not permitted to operate in our environment.<\/p>\n Alignment is all about infusing positive control of an AI agent\u2019s intended purpose, through its prompts and the models it uses. We must only use AI agents trained to resist attempts at corruption, with standard and\u00a0mission-specific\u00a0<\/em>safety protections built into both the model itself and the prompts used to invoke the model. AI agents must resist attempts to divert them from their approved uses. They must execute in a Containment environment that watches closely for deviation from their intended purpose. All this requires strong AI agent identity and clear accountable ownership within the organization. As part of AI governance, every agent must have an identity, and we must know who in the organization is accountable for its\u00a0aligned\u00a0<\/em>behavior.<\/p>\n Containment (least privilege) and Alignment will sound familiar to enterprise security teams, because they align with some of the basic principles of\u00a0Zero Trust<\/a>. Agentic Zero Trust includes \u201cassuming breach,\u201d or never implicitly trusting anything, making humans, devices and agents verify who they are explicitly before they gain access and limiting their access to only what\u2019s needed to perform a task. While Agentic Zero Trust ultimately includes deeper security capabilities, discussing Containment and Alignment is a good shorthand in security-in-AI strategy conversations with senior stakeholders to keep everyone grounded in managing the new risk. Agents will keep joining and adapting at work \u2014 some may become double agents. With proper controls, we can protect ourselves.<\/p>\n Technology alone won\u2019t solve AI security. Culture is the real superpower in managing cyber risk \u2014 and leaders have the unique ability to shape it. Start with open dialogue: make AI risks and responsible use part of everyday conversations. Keep it cross-functional: legal, compliance, HR and others should have a seat at the table. Invest in continuous education: train teams on AI security fundamentals and clarify policies to cut through noise. Finally, embrace safe experimentation: give people approved spaces to learn and innovate without creating risk.<\/p>\n Organizations that thrive will treat AI as a teammate, not a threat \u2014 building trust through communication, learning and continuous improvement.<\/p>\n AI isn\u2019t just another chapter \u2014 it\u2019s a plot twist that changes everything. The opportunities are huge, but so are the risks. The rise of AI requires ambient security, which executives create by making cybersecurity a daily priority. This means blending robust technical measures with ongoing education and clear leadership so that security awareness influences every choice made. Organizations maintain ambient security when they:<\/p>\n And it will be important to take a set of practical steps:<\/strong><\/p>\n The call to action for every business is:<\/strong>\u00a0Review your AI governance framework now. Demand clarity, accountability and continuous improvement. The future of cybersecurity is human plus machine \u2014 lead with purpose and make AI your strongest ally.<\/p>\n At Microsoft, we know we have a huge role to play in empowering our customers in this new era. In May, we introduced\u00a0Microsoft Entra Agent ID<\/a>\u00a0as a way to help customers place unique identities to agents from the moment they are created in Microsoft Copilot Studio and Azure AI Foundry. We leverage AI in Defender and Security Copilot, combined with the massive security signals we collect, to\u00a0expose and defeat phishing campaigns<\/a>\u00a0and other attacks that cybercriminals may use as entry points to compromise AI agents. We\u2019ve also been committed to a platform approach with AI agents, to help customers safely use both Microsoft and third-party agents on their journey, avoiding complexity and risk that come from needing to juggle excessive dashboards and management consoles.<\/p>\n I\u2019m excited by several other innovations we will be sharing at\u00a0Microsoft Ignite<\/a>\u00a0later this month, alongside customers and partners.<\/p>\n We may not be conversing with Data on the bridge of the\u00a0USS Enterprise<\/a>\u00a0quite yet, but as a technologist, it\u2019s never been more exciting than watching this stage of AI\u2019s trajectory in our workplaces and lives. As leaders, understanding the core opportunities and risks helps create a safer world for humans and agents working together.<\/p>\n1. Recognize the new attack landscape<\/strong><\/h3>\n
2. Practice Agentic Zero Trust<\/strong><\/h3>\n
3. Foster a culture of secure innovation<\/strong><\/h3>\n
The path forward: What every company should do<\/strong><\/h3>\n
\n
\n