Agent Security Review
Building or buying AI agents - in Microsoft Copilot Studio, Microsoft Azure AI Foundry, or from a third party? We review each one the way an attacker would: what it can reach, what it can be talked into doing, and who would notice.
Grant read-only access - the findings come back within 10 working days. You keep the report either way.
The promise
material findings per agent reviewed, or it's free
- Each agent reviewed the way an attacker would approach it
- Read-only access - nothing in your tenant is changed
- Fee credited in full against the pack it leads to
The problem
Teams are building agents in Microsoft Copilot Studio and Microsoft Azure AI Foundry, and buying them from third parties, faster than anyone is reviewing them. An agent is not a chatbot: it holds an identity, reaches knowledge sources, and calls tools and connectors that can read, send, and change things on someone's behalf. That makes each one a new way in. An instruction hidden in a document or an email can hijack its goal, an over-broad connector turns a helpful answer into a data leak, and a shared or over-privileged identity means nobody can say afterwards what the agent did, or switch it off quickly. Most agents go live with none of this checked. This is the focused way to find out, before or after go-live: not a rebuild, but a clear, ranked reading of what each agent can reach, what it can be made to do, and what needs to change.
What's Included
- A threat model of each agent against the Open Worldwide Application Security Project (OWASP) Top 10 for Agentic Applications - goal hijacking through prompt injection, tool misuse, and identity and privilege abuse
- The agent's identity and permissions - whether it runs under its own identity with least privilege, where Microsoft Entra Agent ID fits, and whether Conditional Access covers it
- Data exposure - the knowledge sources the agent can reach, the oversharing on them, and whether Microsoft Purview sensitivity labels and Data Loss Prevention (DLP) apply to what it reads
- The connectors and Model Context Protocol (MCP) servers it uses - how each was vetted, whether versions are pinned, and that no server passes a user's token straight through to another service
- Logging, audit, and the kill switch - whether you could see what the agent did, and stop it quickly if you had to
- Human oversight and autonomy - which actions need a person's approval, and whether that matches the risk of each action
- Cost controls - the limits that stop a looping or abused agent running up consumption charges
- A written findings report ranked by risk, a prioritised remediation list, and a walkthrough call to talk it through
What This Assumes
- Read-only access to Microsoft 365, Microsoft Entra, and the Microsoft Azure subscriptions the agents run in - no changes are made to your tenant
- A named owner for each agent who can explain what it is meant to do
- Agents built or hosted in Microsoft 365 or Microsoft Azure, where their configuration can be inspected
Not Included
- Building or fixing the agents themselves - remediation is separate (the AI and Agent Readiness Pack, or AI Automation & Secure AI Adoption)
- Penetration testing - this reviews each agent's design and configuration, it does not attack the live agent
- Agents running outside Microsoft 365 and Microsoft Azure, where their configuration cannot be inspected
Outcomes
- Each reviewed agent's risks known and ranked, before an attacker or an auditor finds them
- A clear remediation list your team - or ours - can work through, in order
- Evidence that each agent was reviewed against a recognised framework, for your risk register and your board
Who It's For
- IT and security leads whose teams are building agents in Microsoft Copilot Studio or Microsoft Azure AI Foundry
- Organisations buying third-party AI agents that will run against their Microsoft 365 or Microsoft Azure data
- Teams with agents already live that nobody has reviewed for security since they shipped
- Anyone weighing the full AI and Agent Readiness Pack who wants the agents themselves checked first
Engagement Model
A fixed-price review, priced per agent: from £4,500 / $5,800 for one agent, or £9,500 / $12,200 for up to five reviewed together. Grant read-only access and get the written findings back within 10 working days - nothing in your tenant is changed. Defined deliverables, a fixed price, no day rates. And it is guaranteed: if the review does not surface at least three material findings per agent reviewed, it is free. The fee is credited in full against the AI and Agent Readiness Pack if you book within 60 days.
Pricing: from £4,500 / $5,800 per agent - larger engagements are tailored to scope.
We govern the AI we deliver with
This work is delivered AI-accelerated, so AI tooling reads configuration and permission data from your estate along the way. It is fair to ask how that is governed - and the answer is published: which providers we use and on what commercial terms, what client data never reaches a model, that a named architect signs off every output, and that AI tooling holds no standing write access to client systems.
Read our AI policyRelated
The AI and Agent Readiness Pack
Found the gaps? The fixed-price, guaranteed sprint that brings every agent in your tenant under control and gets you to a verified, safe switch-on.
AI Oversharing Report
An agent can only leak what it can reach. The fast, fixed-price report shows what AI would surface across your Microsoft 365.
AI Automation & Secure AI Adoption
Need an agent built rather than reviewed? Purpose-built automation and governed AI tools you own, deployed into your own tenant.
Get started
Find out where you stand, free
Most engagements start with a no-cost posture audit against the baselines that matter to you. If a fixed-fee roadmap is the right next step, we'll say so - and if it isn't, we'll say that too.