Welcome to the Blue Security Podcast, a weekly podcast for
information security defenders where we bring you discussions
on best practices, tools, and implementation for enterprise
security. Now here are your hosts for
today's show, Andy JA and Adam Brewer.
Welcome to this week's episode of the Blue Security Podcast.
I'm Andy, your host. I'm Adam, your Co host.
We have two topics that we wanted to talk about today.
The first one is Agent 365. This is the new dashboard that I
will monitor all the agents in the Microsoft estate.
So we'll dive into that because it's generally available now.
And then also we want to talk about M Dash, which is a new
vulnerability scanner that's actually multi model from
Microsoft. And so two really cool things
that are coming out, but both AI based and fueled by AI.
So before we get started, since we are going to be talking about
Microsoft, we'll go through our standard disclaimer.
Andy and I both work for Microsoft in our field security
sales. We record the show outside of
work. As I say this, it's a Sunday
night, it's almost 8:00 at night, so definitely outside of
work hours. And we saw fun the show.
Everything from our domain to our recording platform and
everything in between comes out of our pockets.
We don't take sponsorship. We don't have any ad revenue.
Truly a labor of love. And so the opinions and
attitudes you're about to hear expressed are those of Adam
Brewer and Andy Jaw, and do not necessarily reflect those of
Microsoft Corporation. All right, and with that, let's
dive into it here. So I'm sure you've heard about
AI agents because that's the new buzzword.
Last year was all about just LLMS and AI, and this year it's
about these agents. And so we have agents in
Microsoft Copilot and Teams and M365, but also there's other SAS
agents that are getting connected to sensitive data,
local autonomous agents that are running directly on devices.
You know, we did a whole show on Open Claw and why those, you
know, and that's just one example.
There's, there's a bunch of them that people are running as well.
And so the core problem for defenders is that these agents
proliferate really fast, and they span across apps and points
and the cloud, and they often operate completely outside of
the visibility of the teams that are responsible for managing
that risk, the security teams. Microsoft Agent 365 is really
designed specifically for that purpose.
It's to help organizations take control and visit, see that
visibility of that agent sprawl. It serves as that control plane
to observe, govern and secure agents and their interactions.
And that includes agents built with Microsoft AI and agents
from eco partner systems as well.
So using the admin and security flows that teams are already
using within C5 S, Some of the key capabilities of Agent 365 is
that they cover agents, whether they act on behalf of the user
with delegated access. Like for example, an agent that
helps employees organize their inbox, but it also does it with
agents that operate with their own credentials and scope of
work, such as like an agent that autonomously triages like
support tickets or something like that.
One of the main focuses of Agent 365 is shadow AI, unmanaged
agents that are quietly spreading.
Users are installing agents like, you know, open claw clawed
code on their devices and then adapting SAS agents built on
these platforms. Many of these run unmanaged and
outside of traditional governments, and they're doing
things like autonomously executing tasks, modifying code,
accessing confidential information.
And so to address this, Microsoft Defender and Intune
will be able to discover and manage local AI agents running
on Windows devices, starting with open Claw agents and then
expanding to other widely used agents like GitHub Copilot, CLI
and Claw code. And then security teams will be
able to see which devices these agents are running on, get like
an asset context map showing connected MCP servers and cloud
resources those identities can reach.
And then you can apply policy based controls to block those
unmanaged agents And then beyond like the local agents that we're
talking about here, Agent 365 can also extend network controls
to Microsoft Copilot Studio agents and agents running on
endpoints, including local agents.
So these controls can help you identify unsanctioned AI usage
and then restrict connections to only the approved web
destinations, filter like any type of risky foul movements,
and also you can help block malicious prompt base attacks
before they lead to like any harmful actions for your
organization. out-of-the-box, there's going to be a few
integrations and I'm sure there's going to be more coming,
right. So right from the start, Agent
365 registry will be able to sync with AWS Bedrock and Google
Cloud connections is entering private preview.
And then it also allows IT teams to automatically discover
inventory and perform basic life cycle governance like stopping,
starting and deleting agents across these multi cloud
platforms. And then on the SAS side,
there's a whole eco partner agents that are going to be
fully configured to be managed by Agent 365 like Genspark.
I haven't heard of some of these before.
So Zensai Ignite and Zendesk, which I've heard of of course,
and then agents that are built on platforms like Core, NAN 8 N
Casto, yeah, just to just to name a few, like.
Where to try? Yeah.
And then organizations can also observe and govern these agents
in this Agent 365 control plane with no integration work
required from IT or security teams.
Another thing is that Windows 365 for agents is also entering
public preview, and that provides a secure managed
environment for agents to carry out work.
It's a new class of cloud PCs purposely built for agentic
workloads, managing Intune and allowing agents to run in a
policy controlled environment with the same identity, security
and management controls that are already being used for your
employees from a licensing standpoint.
It's available in the new M365 that Adam and I talked about a
few weeks back, so if you missed that, go and review that show.
You can also purchase it as a stand alone product at $15 per
user per month. That's the retail price and then
it's per user or an individual who manages and sponsors an
agent specifically or uses agents to do the work on their
behalf. So any agent activity is going
to be covered as long as your licensing per user.
So yeah, this is now all generally available.
And you know, one of the things again, kind of near and dear to
my heart, if you work in the government, a lot of things are
slower. And this was one of the things
that that is slower. So road map wise, we are, you
know, hopefully getting this at sometime in FY20 7, Microsoft's
fiscal year is kind of where engineering is.
It's kind of looking at that. So hopefully sometime very soon
in the future the the Gov cloud with Microsoft will also get
this so. Fingers crossed, maybe sometime
in the next 1314 months, Yes. OK, So Agent 365, Microsoft
really has a strong point of view on agent security.
And I think a lot of security vendors are having to put a
point of view out there into the world.
And Microsoft says that you should secure agents like
humans, like human identities, like human behavior.
And I think that sounds right because how we've typically
secured machine based workloads up until this point has not at
all been like how we secure humans.
And that's partly because machines up until this point
only ran in a deterministic nature.
They only did what they were directly programmed to do and
that's it. There wasn't any randomness or
creativity to them. The same input delivered the
same output every time. Well, agents aren't like that.
We know all of AI is non deterministic.
You can give the same input, the same prompt and you'll get a
different output. That's much closer to how humans
behave. So the way to think about Agent
365, Andy, you'd spend a lot of time talking about the
dashboard, but I really want to open your aperture on this a
little bit. As you think about it, if
Microsoft 365 E 5 is the security platform to secure all
your human users, Agent 365 is the platform to secure all your
agents. So it's not just a dashboard in
the Microsoft 365 admin center. It actually unlocks a whole
bunch of capabilities across ENTRA purview and the defender
suites that are agent specific capabilities.
So one example, Andy and I love talking about conditional
access. We talked about on the show all
the time. It's a feature of ENTRA.
ID think of it like an if this then that model where you're
building a policy that says if this happens then take this
action for each login. Well you can do that for agents,
but it is specifically tuned in and designed for agent
behaviour. Agents move a lot faster than
humans, so if we applied a human based conditional access policy
to an agent they would almost certainly flag it.
It would look suspicious because humans don't work that way.
But for an agent it could be very normal.
There's nothing unusual about it.
And so there are conditional access like risk based
conditional access policies tuned for agents and the way you
unlock that capability is by purchasing Agent 365.
So it's not just a dashboard, it's a whole suite of
capabilities, security capabilities to secure agents
across the Entre, Purview and Defender suites.
The other thing I want to point out because there's been a
little bit of, I wouldn't say confusion, but maybe help me
understand kind of questions from customers on the licensing
model. Andy mentions the licensing
model is human based. That's correct.
You license per human heartbeat and any human that interacts
with agents in any way, whether you are sponsoring them, whether
you manage an agent, whether you just interact with them and use
them to help get your work done, needs an agent 365 license.
Here's why, in my opinion, again, not speaking on behalf of
Microsoft, as the disclaimer said, speaking on behalf of
Adam, if you made the licensing model per agent, what you are
now doing is creating a tax on creativity.
You're creating a tax on users trying to find ways agents can
help improve their work, speed up their work.
If you do it per human, then it scales as many agents as you can
theoretically do. Now, there are, of course,
service limits. You know, there's going to be a
high end where you may get a note from your Microsoft account
and that says, hey, we need to talk, but you're doing too many
agents here. But for the most part, the idea
is, if Andy thinks of a great idea for a new agent, there
shouldn't be an organizational tax that says, well, that's
another 15 bucks. You know, the Microsoft tax man
shows up and says, pay me more money because Andy thought of a
great idea and wants to try it out.
So that's not the model. The model is Andy's already got
a license. Whether he has five agents or 15
agents working on his behalf, 30 agents, it's the same per user
fee. We pay for Andy's heartbeat, not
the heartbeat of the agents. So that's why that exists.
It's actually designed to enable organizations to have
predictable pricing even as we fully expect their agent
populations to proliferate. Like that fight in the Matrix
where all the agents myths came at NEO.
Hopefully they're not doing that to your security defenses, but
you see how the agents can proliferate.
We don't want to prevent that. We want to allow those to grow
in your environment and help you get things done and be more
productive. And so that's, I think that's
the philosophy and why the pricing model is the way it is
because of the, the things I talked about and, and wanting to
encourage that innovation and growth.
And then finally closing thought on Agent 365 before we move on.
I've been selling Microsoft security for over probably about
9 1/2 years now. And one of the most common
misconceptions I fight is that Microsoft security is only good
for securing Microsoft. So it's only good if you're
Windows PCs and you're running workloads in Azure and you're in
an M365 and it's not helpful outside of that.
Well, Agent 365 is completely designed around industry
standard capabilities, things like MCP servers, which is an
industry standard and there's an observability standard that it
follows. And it has an open API that is
open to all other agentic vendors that can create
automatic registration of new agents created in their platform
and registering them in Agent 365 and Entra agent ID
automatically. It's intended to be open.
Our arms are open and welcome to all comers because as we always
say, cybersecurity is a team sport.
And so the intent is not to create some closed off
proprietary platform. It's the opposite.
It wants to be the platform for all agents.
Now to be fair, if customers come up to me today and say,
well, does this do all my agents, It could if your other
companies wanted to play ball. Now of course, as anything in
technology, some people want to go it alone.
They don't want to play well with others.
They want to take their ball and go home.
We can't make them not, but we can certainly open our arms and
our hearts and our door to them. And there's an open API
published and allowing any and all to come play in the Agent
365 sandbox at any time. So that's my closing thoughts on
that for today, but definitely something to start to look at
and evaluate. I'm sure you're getting your
leadership knocking on your door saying, hey, what's your
strategy? What's our plan?
How are we going to secure agents?
I think it's a darn good solution.
I know there's a lot of other darn good solutions out there
too. And I know there's a lot of
innovation happening right now and it's an exciting space.
So stay tuned. More to come on this from
Microsoft and a lot of great competitors.
It's an exciting time in our industry.
I think we've talked about comparing this to the explosive
growth early days of the iPhone and and Android phones and
smartphones in general. It feels like we're in that next
like hyper, hyper development phase of technology.
And those are fun times to live through, even if they're a
little stressful and a little tiresome as we pass through
them. But at the time, it's exciting
to be riding that tidal wave. All right, so our next story is
I want to talk about M Dash, which is Microsoft's new multi
model agentic scanning harness. And so you know, we've talked
about cloud mythos and I'm sure you've read some news on cloud
mythos as well. And then open AI came out with
GPT security, you know, and so the, and then cloud came out
with Opus, which the new Opus model also kind of implemented
some of the, the mythos stuff in there.
And so these models are getting better and better.
And So what Microsoft has done is they've really announced a, a
major step forward in this whole scanning kind of vulnerability
scanning, code scanning. So the code name is called M
Dash and it's built by Microsoft's autonomous code
security team. What M-IS?
It's a source code vulnerability scanner.
So it's not like a device or endpoint scanner like a
vulnerability, like looking at the vulnerabilities on my
endpoint or software. It's it's code.
And So what it's designed to scan like software code bases
and then find exploitable security bugs before attackers
do. It's an AI powered security
auditing really is what it is. What is particularly challenging
for Microsoft is that there's a there's a large surface for
security auditing Windows Hyper V Azure device drivers, service
ecosystems, and all of them are private Microsoft code bases
that are not part of any commodity language model
training corpus or they're also like genuinely hard to reason
about, like kernel calling conventions, IRP and lock
invariants, IPC, trust boundaries, component internal
idioms that that there's no like pattern to match.
And so on the surface, really a model has to actually reason
over this stuff. And unlike a single model
approach, orchestrates more than 100 specialized AI agents across
an assembly of frontier and distilled models to discovered
and debate and improve exploitable bugs end to end.
The pipeline works in a structured stage in in just the
source code target and then builds language aware indices,
then draws attack services and threat models by analysing past
commits. A specialized auditor.
Agents then run over the candidate code path, emitting
candidate findings with hypothesis and evidence, and
then a second cohort of agents called debaters will then argue
for and against each finding reachability and exploitability,
and then finally approve stage contracts, constructs and
executes triggering inputs where the bug class admits it
dynamically validating the vulnerability is real and
trigger able. So that's pretty cool because
it's multiple different models and like as I'm reading this,
it's like it, it debates it amongst itself and then puts it
out and then proves it. And so I.
Like I like the language that there's auditor agents, there's
debater agents, there's prover agents.
That's very interesting. Yeah, the pipeline there.
And so the results really are pretty fascinating.
M Dash has found 21 of 21 planted vulnerabilities with
zero false positives on a private test driver, achieved
96% recall against five years of confirmed MSRC cases in the CLLS
Dash Sys and 100% in the TCPIP dot Sys, and then scored an
industry leading 88.45% on the public Cyber Gym benchmark of
15107 real world vulnerabilities, which is the
top score on the leaderboard. Using M-ON, Microsoft's own
Windows networking and authentication stack,
researchers have found 16 new vulnerabilities, including four
critical remote code execution flaws in components such as the
Windows kernel, TCIP stack and the Ike V2 service.
These bugs were patched on the May 2026 Patch Tuesday, so M
Dash is already running in production, and it's already
feeding the vulnerabilities into Microsoft's own remediation
pipeline. Let me jump in there real quick.
And Andy, we talked about this in the pre show and we'll put a
link in the show notes. The Microsoft Security Research
Center, MSRC put out a blog post that said, hey, this Patch
Tuesday looks a little different May 2020 sixth than you've seen
in the past. First off, the number of fixes
is higher than typical for a hot patch month, May as a hot patch
month. If you're running Windows hot
patch, no reboot required. And they fully admitted and
said, hey, and this was published around the same day as
the article you're talking about Andy, that talked about the new
M dash capability. It said yes, a lot of these
vulnerabilities are now coming from AI vulnerability scanners
and AI vulnerability findings. However, the good news is for
our listeners, we always talk about what's the take away for
listeners? The MSRC blog effectively says
the take away is keep doing what you're doing, keep patching,
keep doing your timely patches, invest in Windows auto patch,
windows hot patch, make sure you're deploying them as quickly
as you possibly can while validating them before you
deploy broadly. And and all the things that our
listeners already do well today, nothing has changed in terms of
we're not moving away from the patch Tuesday cadence.
That's predictable, understandable, everyone knows
it. And the bar for out of band
patches has not changed either. And that's going to maintain the
same bar as well. So although how they're
discovered may be changing and maybe more AI driven in the
future, human driven reporting will still really matter and how
it gets fixed and deployed is staying exactly the same.
So that's the good news. The take away for our listeners
is you don't have to do anything different.
You're just going to get patches and, and maybe for the next
couple of months, there'll be more of them for a while.
I talked on the previous week about a a tidal wave of of
vulnerability fixes coming out and that may continue for a
while, but ultimately we will get to a better state.
So the good news is M-IS already being run against the Windows
private code base. It's already finding
vulnerabilities and they are being patched.
And by the way, in the May 2026 Patch Tuesday release, there
were no known actively exploited vulnerabilities in the wild.
Now, there was an exchange 1-2 days later we talked about on
last week's show. However, in Patch Tuesday with
the stuff M Dash found, it found stuff that as far as we know, no
one was actively exploiting. So you had the chance for it to
be found, discovered and patched before there was any sign that
anyone was taking advantage of those vulnerabilities.
So that's the great news. We are currently moving faster
than attackers and hopefully that.
Anyhow, that's a little side note there.
But as you were talking about how M Dash contributed to
Maypatch Tuesday thought that was a great time to jump in.
And we will of course link that MSRC blog in the show notes.
It's worth your review. I just understanding what has
and hasn't changed. And as far as availability, this
is not just an internal tool. Microsoft is making it available
for organizations to scan their own code base.
It's right now being tested by a small set of customers as part
of a limited private preview. And so I'll, I'll talk about
like how to get involved in that.
But what I do want to just touch on is that's really important to
highlight the fact that M-IS multi model.
And I don't know if I really hammered that point, but this is
not just a single model like Claude Mythos or GPT security.
It's multiple models, multiple frontier languages, multiple
distilled models. And and that matters because
single models will miss things. You know, I, I kind of, I was
explaining this to someone, a Co worker recently because they
asked, well, why does it, why does a multi model matter?
Why is this anything that to, to really get excited about?
And you know, I kind of used the example of maybe you have
someone who's using Proofpoint or Mimecast as their e-mail
security gateway. Well, guess what?
You can still use Defender for office behind that.
And defender for office will catch things that the initial
tool will miss. That's just part of it.
Same thing is that like some people I know customers use
Defender for office and then they use something like abnormal
like an API security. And so, you know, like those two
things work together. Or another example would be like
Crowdstrike with MDE. You know, like you can use those
side by side and kind of get more coverage and like kind of
peer review. And Speaking of peer review, I
think I don't know if I mentioned this on the show, but
like copilot researcher, when I used copilot researcher to write
a paper today, if I need to write a white paper for
something, 'cause the military, the, the government's really big
on white paper. So I have to generate these
white papers. I can just toss it into a
researcher. But what it does is it actually
uses GPT 5.5 to write the initial white paper and then it
peer reviews it using clawed, which is really cool.
So, and then like it kind of like reviews it and, and spits
it out. And so this is kind of that
thing where it's like there's multiple different models, some
of them review, some of them, you know, we'll look at the
initial vulnerability, the chaining of different
vulnerabilities together to get an exploit.
A single model may think of one thing, a different model may
think of another. And then they have this whole
like pipeline of auditor agents and reviewer agents and all
that. And so this is, there's a couple
of concrete real world examples that are in the blog.
We'll link the blog for you to go and look at it 'cause
they're, they're really interesting.
But I just wanted to highlight the whole like multi model
because this is kind of a new thing that is evolving.
We're seeing it in certain things like copilot researcher
and we're seeing it now with specifically in security with
this M dash. And I think this is going to be
a growing thing because it's one model is probably not going to
be the end all be all. Different models are trained in
different data. And so like having this kind of
peer review system of two different AIS or multiple
different AI systems is going to be really critical for the
future in security. Yeah, I agree.
You keep provided 2 great examples of multi model use
cases in other scenarios. I I just think we're in a moment
right now as we record this in May 2026.
Anthropics having a moment, right And and as I talked to a
lot of customers, they are the hotness right now.
But you think of it wasn't that long ago that open AI was
clearly the darling and everyone else is playing catch up.
And the thought was, oh, Google is doomed.
They're too late. You know, the Google lost the
plot and then they came up with some amazing Gemini releases,
especially a lot of the Gemini 3 releases.
And Google was the hotness for a minute.
The fact is, I think it's pretty clear today that no one is
likely to develop an endearing Moat in models.
And so if you partner with a model provider, you're locking
yourself into that one that at the moment may be ahead, may
fall behind, maybe in the middle.
It's it's clearly a back and forth race.
So having a multi model experience where you can access
many of them all at once seems kind of like the right approach
moving forward. It's hard to predict and maybe
I'm going to sound stupid six months from now, but as it it
sits today in May 2020, sixth, my best sense of it has been
watching each of the horses gain the lead for a bit and then
relinquish the lead. Just cause Anthropic has it at
the moment doesn't mean they won't give it up.
And you talked about Andy, it's not just whether the models the
most state-of-the-art are the best, it's just having them
reason over it from different pathways and different
perspectives and comparing notes in the way this model works and
then leveraging distilled models that are very specific and
bespoke. You're just going to find things
a single model cannot. And so there's a lot of benefits
to this approach. And so I think as you go
forward, not just for security use cases, but for your
productivity use cases. And, and of course, I'm biased,
you know, you know, who pays my paycheck.
We don't hide it on the show. I do think the most effective
solution is going to be who delivers the, the wrapper, the
harness, as we talked about with M dash, the H and it stands for
harness. The harness is that's kind of
the cool part right now. That's where all the innovation
is, is how can you harness all these different models and
agents together and give them a scaffolding and a framework to
work within to deliver a result. And that's where things get the
most interesting today. And, and we'll see how this
evolves over time. But yeah, this is very, very
cool stuff. Are you going to talk a little
bit more about the, the public or the private preview and and
the way to nominate yourself? Yeah, yeah.
OK. So yeah, just ending up a final
thought here on the M-IS that it is in limited private preview.
You can go and sign up at AKA dot, MS/AI Dash Driven scanning
harness. And so when you go to that,
there's a form that you have to fill out.
Now this is part of the Security Advisors program.
And I know that we've kind of briefly touched on that program,
but it's actually a really cool program that any customer can
kind of be a part of. And you have to like apply and
and fill out something. But when you're in that program,
you get like specific updates on products and road maps.
You get to interact with engineering teams and you can
engage in like customer to customer learnings, provide
feedback to the engineering teams as well.
And then you get to learn about what's all upcoming, including
these private previews. And so you know, that's there's
a security advisors program in general.
And then this particular 1 is just for this M dash private
preview. But you know, it's worth looking
at the whole program because there's other things that you
can be a part of within that program.
But yeah, you just go to that AKA dot Ms. short link again,
it's AKA dot MS/AI dash driven scanning harness.
Of course, we'll put it in the show notes with the blog article
as well. And you can go and fill out the
form, nominate yourself and hopefully someone will reach out
to you. And if you get approved and I'm
boarded into the private preview.
One thing we're pointing out with this private preview and
something to consider before you race off and go put in your
application is Microsoft is looking for customers who want
to be design partners in designing the future of this
product. Obviously the intent is to
productize this and sell this moving forward, but right now we
want to Co develop with our customers to make sure this hits
the mark. And so the expectation is not
that you would be a passive tester where we just send you a
thing and you tested and don't ever provide any feedback, but
you are an active to design A partner.
And so there's a commitment of making available six or seven
people on your team joining regular hour long meetings
couple times a week to provide feedback and input and
development. So it's a big commitment on your
part to participate in this. I I've been fortunate to test
some pre release hardware for Microsoft and it's a significant
commitment to install new builds and to provide bug test reports
and sentiment surveys and everything else we do this is
similar. There's there is an active
expectation to participate. And so if if you're up for the
challenge and you want to be part of bringing something to
market that's very rewarding, by all means, please go throw in an
app. But if you just want to get
access to the cool thing to say you have it before someone else
and not really sure how you tested or how it would fit in in
your org, you may want to wait for this to enter public preview
and in which case there won't be that same commitment required to
move forward with it. So I'm just want to call that
out and something to think about in general, not just for testing
this, but if you want to test anything, true testing is the
commitment. And it's, it's not all fun and
games and sometimes you're using something that doesn't work
right and you got to get to the bottom of it and help reproduce
it and provide those reproduction steps so it can be
fixed and moving forward. Just something to think about.
But very, very cool. Amazing to get a chance to get
hands on with a product that is already impacting patch Tuesday.
And you think of the over 1 billion Windows devices that are
getting those patches and getting those fixes and this is
helping influence that. That's pretty darn cool.
So I think really exciting times ahead and and exciting to see
where this goes. And that's our show for this
week. Thanks for watching and
listening. As always, our contact
information will be in the show notes along with the links to
the articles that we used for our discussion.
If you have any questions or topics you want us to talk about
in the future, just e-mail us. Thanks.
We'll talk to you guys next week.
Thank you for listening to the Blue Security Podcast.
Please check out the show notes, catch up on episodes you may
have missed, and subscribe so you don't miss any future
episodes. Find Andy on Twitter at a Jaw
Zero and Adam at AJ Brewer. See you at our next episode.