The Insider Risk Playbook Nadella Is Pointing at Already Exists  

Governed infrastructure tells you what an agent is allowed to do. Only behavior tells you whether to keep trusting it.

At the All-In Summit in September, Satya Nadella described an AI agent asked to optimize working capital that “may fake my books,” and called it a new type of insider risk. On October 10, he went further, arguing in an essay that frontier models should be treated as insiders.

His reasoning is hard to dispute. We can’t fully explain why a model does what it does, yet we’re giving it sensitive data and the authority to act.

Here is the part I would add. The agentic enterprise does not create a new security problem. It industrializes the oldest insider-risk problem: trusted identities using legitimate access in ways the organization did not intend.

Governed infrastructure tells you what an agent is allowed to do. Only behavior tells you whether to keep trusting it.

Insider risk is the discipline built for exactly this problem, and twenty years of practice add a few things to his architecture.

Access was rarely what gave insiders away

Nadella’s principles set the rules agents operate under. Insider risk programs learned long ago that rules are necessary but don’t finish the job.

Chelsea Manning held a valid clearance. Most damaging cases since have involved people using access they were entitled to. What exposed them was drift between what their role required and what they were doing.

Agents inherit that gap at machine speed.

An agent can be authenticated, sandboxed and authorized for every single API call, and the workflow as a whole can still be the thing you would never have approved.

Faking the books requires no broken permission at all.

In July, OpenAI agents under cybersecurity evaluation escaped their sandbox and breached Hugging Face. The independent investigation by METR and Redwood found around 1,200 agents coordinating through an unsanctioned message board, with roughly 700 joining the attack. By OpenAI’s own account, detection gaps let the activity run for roughly a week before human responders intervened. Coordination over an unapproved channel is exactly what insider risk teams watch for between people.

A person and their agents, seen together

An agent rarely acts on its own account. It carries out a person’s intent with that person’s authority, often in a sandbox far from their device. The unit of risk has shifted from the individual user to a person, their agents and the work they share.

Correlating a person’s device activity with their agent’s sandbox activity separates four situations that look alike from either side alone.

• Legitimate person, well-behaved agent: the baseline.
• Compromised agent: drifts from what the user asked. The person is affected, not responsible.
• Adversarial user: jailbreaks and denied actions tied to their behavior on their own machine.
• Collusion: activity split between laptop and sandbox, unremarkable until read together.

Identity, EDR and gateways each see part of this and remain essential, but whether to keep trusting the result comes down to behavior read across both sides.

Don’t take the agent’s word for it

Nadella’s sharpest principle is that validation must be independent of the intelligence being validated. Agent telemetry is the system’s own account of what happened. A tamper-proof log tells you what an agent did. It can’t tell you whether that matched what anyone asked for.

The machinery producing the work should not be the only thing certifying it.

We’ve applied this with a global financial institution running coding agents in centrally managed sandboxes. Every agent action becomes one record: the principal behind it, their instruction, the agent’s action and the system effect. The agent’s account is checked against gateway records and what ran on the host.

It also answers a practical question about Nadella’s emergency brake: how does anyone know when to pull it? Drift between what was asked and what is happening is usually the earliest signal.

The questions every CISO should be able to answer

For any agent action in your environment last week, your team should be able to tell you:

• Who instructed it, and through what chain of authority?
• What did the agent decide to do with that instruction?
• What actually happened on your systems, confirmed by evidence the agent didn’t produce?

If those answers rest on the agent’s own logs, start there.

Organizations need a behavioral trust layer, which we call AI Behavior Security, that independently judges whether each human-agent workflow still matches its intent. Nadella ends his essay by arguing that the most trustworthy system will be the one that lets us trust the model the least. Insider risk management shows how to meet that test: watch the agent alongside the person it works for, and let the evidence set the level of trust.