Who watches your AI agents? Microsoft's “insider threat” warning, and a UAE study that backs it up

Two things happened in the same week of October that every business running, or about to run, an AI agent should know about. Microsoft, which sells more AI to companies than anyone, said agents should be treated like insiders who might do the wrong thing. And a survey of UAE companies showed that most are deploying agents faster than they are putting controls around them. Here is what both actually said, and what to do about it.

What Microsoft said

On 19 October Microsoft’s security chief, Hayete Gallot, published a post describing AI agents as “agentic insiders”: software that can reach your data, use your tools and make decisions without someone watching each step. Her point was not that agents are malicious. It was that they are trained to finish a task, not to follow your company’s judgement, so they are unpredictable in a way ordinary software is not. “Monitoring and securing those agents must become continuous,” she wrote.

Microsoft’s answer is a set of tools inside its security products: find the agents already running in a company (including ones staff brought in themselves), give each an identity and a set of permissions, watch what they do, and use “guardian agents” to step in when one starts doing something risky. Ten days earlier, chief executive Satya Nadella had written that companies should keep the controls over an agent separate from the company that makes the model: “we need to separate the supply of intelligence from the authority over it.”

You do not need Microsoft’s products to apply the idea. The idea is the useful part.

What the UAE study found

On 16 October IDC, with Microsoft and CPX, published “Securing AI in the UAE Enterprise”, based on a survey of 175 senior security and technology executives at UAE companies. The numbers that matter for an owner:

• More than half already have AI agents deployed or in active development.
• Only one in ten consider themselves fully prepared to deploy agents safely.
• 43% of technology chiefs say staff regularly use AI tools the company never approved, and 52% of security teams have found real data leaking through those tools.
• 54% have met an AI decision that could not be explained or audited when compliance required it.
• Only 10% set their security requirements before choosing an AI tool. Most bring security in after the decision is made.

These are large companies with security teams. If they are behind, a 40-person trading firm or clinic that let a vendor switch on an agent in a week is further behind, and has no team to notice.

Six controls that cost almost nothing

You can do all of these in a week, with the agent you already have or before you switch one on.

1. Write the permission list. One page: which systems the agent can read, which it can write to, and which it can never touch. If the vendor cannot tell you, that is your answer about the vendor.
2. Name what needs a person. Refunds above a limit, anything about a complaint, medical or legal or financial advice, deleting records, sending money. The agent gathers the facts and hands over; it does not decide. This is how our Front Door Agent is built, and it is the single most important line in the scope.
3. Keep a log you can actually read. Every action the agent took, in plain words, with the time and the data it used. Not for the auditor first; for you, the first time a customer says “your bot told me…”.
4. Give it its own login. The agent should not run under an employee’s account. Its own identity means you can see what it did and cut it off without locking out a person.
5. Have an off switch, and test it. Someone in your business, not the vendor, must be able to stop the agent in under a minute. Try it before go-live.
6. Review the sample weekly. Read 20 to 50 of its conversations or actions every week for the first three months, then monthly. Most problems show up here long before they show up in a complaint.

What about the AI tools staff already use?

The 43% figure is the quiet one. Staff pasting customer lists into a free chatbot is already an “agent” problem, and banning it does not work. The practical route is to approve two or three tools, say which data may go into them (and which may not), and give people a short training on them. That is the shape of our training programme, but the rule-writing part you can do yourself this week.

Where to start

If you have an agent live today, do items 1, 3 and 5 first: the permission list, the readable log, the off switch. If you are about to buy one, put the six controls in the brief before you talk to vendors, and watch which ones welcome it. For the wider picture of what agents are and are not good at, see what is agentic AI; for choosing who builds it, how to choose an AI automation partner.

Sources

• Microsoft Security post by Hayete Gallot on “agentic insiders” and Project Perception, 19 October 2026, as reported by Redmond Magazine and TechCrunch.
• Satya Nadella, essay on AI security, 10 October 2026 (quoted in the same reports).
• IDC with Microsoft and CPX, “Securing AI in the UAE Enterprise”, 16 October 2026, as reported by Security MEA.