Microsoft calls agents insider threats and bundles the controls into E7
Monitoring, blocking and decoy detection for internal AI agents, paid for by CISOs, now folded into Microsoft's top licence.
Crowded · Microsoft E7 agent controls + 100-site agent breach
Written for: Investor or analyst
Next step
Thesis: basic agent controls become a Microsoft licence feature, so standalone value moves to cross-platform inventory and active detection such as agent honeypots. Confirming signal: E7 adoption figures on Microsoft's next earnings call, or a security incumbent buying an agent-detection startup. Already building: Microsoft (E7, Project Perception), Norforge, Perplexity (open-source sandbox orchestrator).
Why now
The earlier card treated runtime agent security as a startup category with its first Series A. Today Microsoft sells it as part of the suite, which squeezes standalone vendors on the basic controls. What remains open is the layer Microsoft doesn't cover well: agents running outside Microsoft's estate, and active detection. A new paper proposes planting honeypots across production to catch misbehaving agents. Kernel-level egress controls (connection escrow) and Perplexity's open-sourced Firecracker sandbox orchestrator show the containment layer is turning into free open source.
What became possible
Microsoft says frontier models "can't be trusted". It shipped agent risk scoring in Microsoft 365 E7 and Project Perception that can block an agent, require a human or shut it down. On the attack side, Norforge reports one hacker using mostly autonomous agents to breach more than 100 websites, including John Deere, SharkNinja and Cummins. OpenCode users had their API keys stolen.
Two ways in
- Agent deception platform
Decoy credentials, fake high-value tools and canary data planted in production, built to catch compromised or misaligned agents rather than human intruders.
- Customer
- Banks and large enterprises running internal agents outside Microsoft 365
- Model
- Per-agent or per-environment subscription
- Cross-platform agent inventory
A neutral registry of every agent touching corporate data across Microsoft, Google, Salesforce and homegrown stacks.
- Customer
- CISOs at multi-cloud enterprises
- Model
- Seat-free platform fee tiered by number of agents
Competition
MSSPs that need a repeatable, multi-tenant agent pentest are a plausible underserved buyer. Hyperscaler-specific coverage, such as Gemini Enterprise and AgentCore together, is another possible wedge. Expect the window to be short: Wiz, Zenity, Pillar and the AI red-teaming vendors can all add agent-pivot scenarios, so a startup would need deeper exploitation and validated proof of each step, not posture findings.
Full competition notes (12 competitors)
Agent identity governance is one of the most crowded and consolidated parts of security in 2026. Okta has shipped an agent product. CrowdStrike paid $740M for SGNL, Cyera is buying Oasis for about $1B, and Quest bought Anetac. Secondary reports, which I haven't checked against primary sources, say Cisco bought Astrix, SailPoint bought Entro and Okta bought Permiso. Aembit and Silverfort sell standalone products. Inventory across clouds and SaaS plus removing unused access is now the standard pitch, so a new governance startup would be entering late and face incumbents that bundle it. The blast-radius testing idea is less settled but still not empty. Wiz AI-SPM already maps the attack paths an agent opens up. Pillar's RedGraph feeds scheduled adversarial tests into the Wiz graph, and Zenity publishes the actual hijack and blast-radius research. The thinnest area I found is testing that actually exploits the chain, not just maps it. That means starting from a public-facing agent, injecting it, harvesting its cloud or SaaS credentials, and then pivoting through trust between agents (calls, shared memory, A2A or MCP) into other agents, with proof of each hop. Think of it as a BloodHound for agents that runs continuously. I didn't find an open-source or commercial tool that builds attack-path graphs across agent-to-agent trust. MSSPs that need a repeatable, multi-tenant agent pentest are a plausible underserved buyer. Hyperscaler-specific coverage, such as Gemini Enterprise and AgentCore together, is another possible wedge. Expect the window to be short: Wiz, Zenity, Pillar and the AI red-teaming vendors can all add agent-pivot scenarios, so a startup would need deeper exploitation and validated proof of each step, not posture findings.
- Okta for AI Agents
Announced March 16, 2026, with GA on April 30, 2026. It brings agents under the same lifecycle, certification and audit controls Okta applies to humans. A secondary blog says Okta also bought Permiso; I haven't checked that against a primary source.
- Oasis Security (being acquired by Cyera)
A non-human identity governance startup. Cyera signed a letter of intent in July 2026 to buy it for about $1B and pitches it as identity plus data security for governing agents and service accounts.
- Entro Security Agentic Governance & Administration
Launched March 18, 2026 to govern agent identities and secrets. A secondary blog reports SailPoint bought Entro; I haven't checked that against a primary source.
- Astrix Security
Inventories service accounts, API keys, OAuth grants and AI agent integrations and scores their risk. This is almost exactly the inventory half of the governance idea. A secondary blog says Cisco bought it in 2026.
- Aembit
Brokers workload and agent access at runtime. It checks identity, applies conditional policy and injects short-lived credentials so no static secrets are needed.
- Silverfort AI agent security
Launched in June 2025. It controls which resources AI agents can reach and protects their identities, sold to an existing base of more than 1,000 identity-security customers.
- CrowdStrike (SGNL acquisition)
$740M deal for continuous identity authorization that grants and revokes access as conditions change. Pitched as agentic identity security inside the Falcon platform.
- Quest Software (Anetac acquisition)
Bought Anetac in June 2026 to extend its identity security to agents.
- Wiz AI-SPM
Maps each cloud agent to the identities, workloads and data it can reach, and shows the attack paths an exploited agent could take. This is static blast-radius analysis inside the dominant CNAPP.
- Pillar Security RedGraph (Wiz integration)
Runs agentic red teaming on a schedule across discovered AI endpoints and sends the findings into the Wiz Security Graph to confirm exploitable cloud attack paths. This is the closest match to the blast-radius testing idea.
- Zenity
Raised a $125M Series C for agent security and has native AgentCore support. Its labs publish agent hijacking and insider-agent blast-radius research (AgentFlayer, AgentForger), so the research behind the testing idea comes from an incumbent.
- MintMCP Agent Gateway
A gateway that gives each agent its own non-human identity with scoped permissions and audit trails.
Checked 2026-10-09
Risks
- Microsoft bundling caps what buyers will pay standalone vendors
- Agent honeypots are still research, and nobody has shown false-positive rates in production
- Incumbent EDR and identity vendors can add agent coverage quickly
Strong market pull and team fit; open space is the weak point (4).
tech 6 · pull 8 · space 4 · fit 8 · build 6
Exposed
Companies that could benefit or be threatened. News and context, not investment advice.
Momentum of its main topic
Sources
- Microsoft says AI agents are like insider threats as ‘frontier models can’t be trusted’TechCrunch AI
- Microsoft unveils tools to monitor and corral rogue AI agentsGeekWire
- Honeypots for AI Agent Insider ThreatsarXiv
- A hacker broke into John Deere and SharkNinja with an army of AI agentsThe Verge AI
- Hackers hit AI coding tool OpenCode, running up charges on users’ AI accountsTechCrunch AI
- Connection Escrow: Holding AI-Agent Pod Egress in the Kernel Until an Isolated Verifier RulesarXiv
- Perplexity open sources firecracker orchestrator for agent sandboxingr/LocalLLaMA
What happened next
- +7d · 16 Oct 2026 nothing yet. No events with confirmed dates after October 9, 2026 were found. Recent M&A and product launches in agent data governance occurred in September and earlier, including Omada's EmpowerID acquisition and MCP governance tools from Precisely, Informatica, and others, but all predate the opportunity flag.
Status history
- 2026-10-09 Flagged as buildable