Microsoft urges CISOs to govern AI agents as adoption grows

October is Cybersecurity Awareness Month, and this Microsoft Security blog outlines how the Chief Information Security Officer’s role is changing as enterprises increasingly run on AI and agent-driven workflows. The piece notes that agents have proliferated rapidly: in Microsoft 365, active agents grew 15-fold year on year and 18-fold in large organisations. While well meaning, these agents can introduce risk if access and behaviour aren’t properly governed.

The article frames two central shifts for CISOs: protecting an enterprise increasingly operated through AI and agents, and defending that enterprise as attackers employ AI to move faster and at greater scale. It argues innovation must be enabled without unmanaged risk, and security fundamentals must be modernised rather than discarded.

For builders, the post advocates giving agents governed identities rather than personal or shared credentials, and ensuring data protections are in place before connecting agents to information. It emphasises the need for the security function to be involved early in development to align identity and data safeguards with builders’ objectives.

For CISOs, the guidance centres on deep observability—knowing what agents exist, who owns them, what they can reach, and what they do—and enforcing governed identities and data classifications to keep defence practical. The article also calls for a reimagined defence approach: integrating signals across identity, endpoints, apps and cloud, leveraging threat intelligence and organisational context, and partnering with providers to attain faster, agent-enabled response. The post links to Microsoft’s agent governance and integrated security operations initiatives.