AI agent security for the agents you already run and the ones your teams are building.

For agents already running

AI agent security audit

A review of the Copilot Studio, Microsoft Foundry and custom agents you run today, and the MCP servers and connectors they use. You get ranked findings and a remediation plan.

Before more agents go live

Security foundation for AI agents

The registry, agent identities, tool gateway, guardrails, approvals, data protection, logging and incident runbook that every new agent inherits.

After launch

Ongoing agent security

Adversarial testing when models and agents change, a security review before each new agent is published, and regular monitoring reports.

Inventory and owners

Every agent we can find, from the Agent Registry in the Microsoft 365 admin center, Power Platform environments, Foundry projects and your code repositories, each with a named owner, its purpose and who uses it. Agents without an owner go to the top of the findings.

Identity and permissions

How each agent signs in and what it is allowed to do: service principals, OAuth scopes, connections that run on the maker's credentials, and Microsoft Entra Agent ID where your agents use it. We compare what each agent may do with what its task needs.

Data each agent can reach

SharePoint and Microsoft 365 content shared wider than intended, the knowledge sources and connectors behind each agent, and the findings in Microsoft Purview Data Security Posture Management (DSPM, which replaced DSPM for AI) where your licenses include it.

Testing for injection, misuse and leaks

Prompt injection through documents, email and tool results, attempts to make the agent misuse its tools, and attempts to move data out through links, images, email or tool calls. Tests run against a test copy of the agent where one exists, and we record each attack that worked and what it reached.

MCP servers and connectors

Which servers and connectors each agent may call, who published them, whether tool lists are pinned at approval, and whether each server accepts only tokens issued for it, as the MCP specification (version 2026-07-28) requires.

Logging and audit trail

Whether prompts, tool calls and results are recorded with the agent's identity, who can read those logs, how long they are kept, and whether an SDK writes sensitive content into traces in plain text.

Mapping to the frameworks

Each finding mapped to the OWASP Top 10 for Agentic Applications for 2026, the OWASP Top 10 for LLM Applications 2026, the EU AI Act duties that apply to the agent, and ISO/IEC 42001, the international standard for AI management systems.

Agent registry and named owners

One record per agent with a named owner, its purpose, the data it reads, a risk tier and a review date, kept in step with the Agent Registry in the Microsoft 365 admin center. An agent without an owner does not get published.

A separate identity per agent

Each agent gets its own identity, with Microsoft Entra Agent ID where it fits, and only the permissions its task needs. Shared service accounts and maker credentials come out of shared agents, and tokens are short-lived and scoped to one system.

An allowlist or gateway for MCP servers and tools

Agents reach only the MCP servers and tools on an approved list, enforced at a gateway such as Azure API Management where that fits. Tool lists are pinned at approval, so a server cannot change what a tool says it does without a new review.

Guardrails

Checks on what goes into an agent and what comes out, using Azure AI Content Safety and its Prompt Shields where you build on Azure. Prompt Shields can check documents and email for hidden instructions as well as user prompts, and we make sure that document check is on wherever agents read them.

Human approval for high-risk actions

A named person approves before an agent sends email outside the company, moves money, deletes records or changes who has access. The approval screen shows the exact action and the recipient.

Logs in your security tools

Agent sign-ins, tool calls and alerts sent to the security tools your team already uses, such as Microsoft Sentinel, with threat protection for AI services in Microsoft Defender for Cloud where agents run on Azure. Analysts see agent activity next to everything else they watch.

Periodic adversarial testing

Injection, tool misuse and data-leak tests rerun after every change to a model, prompt, tool or guardrail, and on a regular schedule with a human tester alongside automated scanners, because attackers adapt and fixed test cases catch less over time.

Review before a new agent is published

A security check on each new agent before it is shared: its identity, its tools and MCP servers, the data it reads and the approvals on its risky actions, with the result recorded in the registry.

Monitoring and reporting

A regular report for your CISO on agents added and retired, test results, blocked tool calls and alerts, open findings, and security patches for the agent platforms and SDKs you run.

Security operations on Microsoft Sentinel

For a global commercial vehicle manufacturer we set up security operations on Microsoft Sentinel, with KQL detection rules and Logic Apps response playbooks, next to a customer identity program, and trained their engineers to run both.

A European pharmaceutical regulator

An AI compliance scanner in production that has checked more than 620 marketing assets against 11 rules, cutting review from 2 to 3 hours to about 2 minutes per asset.

Security threats to agents

The OWASP agentic top 10, the incidents of 2025 and 2026, and the controls that hold.

Prompt injection

How instructions hidden in content reach an agent, and the defenses that limit the damage.

MCP security

Tool poisoning, token passthrough and the controls the MCP specification leaves to you.

Agent identity and access

Why each agent needs its own identity, and how Entra Agent ID, AgentCore and Google compare.

AI agent registry and sprawl

One record per agent, with an owner, an identity, a risk tier and an approval state.

Red teaming AI agents

What an agent red team covers, from prohibited actions to injection through tools.