Zach Miller

Last quarter I rolled out Microsoft Copilot to 4,000 employees. Forty-seven people opened it. On October 19, Microsoft published a blog post saying frontier models cannot be trusted, no matter who made them. It said AI agents should be treated as "insider threats." I read it twice. Then I booked the boardroom. First, our Microsoft rep walked me through the product. I asked who the insider threat was. "Your AI agents," he said. I asked whose agents those were. "Ours." I asked what the solution was. "Guardian Agents." I asked whose those were. "Also ours." I asked why I'd trust the second set of agents if I couldn't trust the first. He said, "Different SKU." I signed that afternoon. Last time I told the board "digital transformation." This time I said "agentic insider threat." They approved it in nine minutes, two minutes faster than last time. Hope approves fast. Fear approves faster. The product is called Microsoft 365 E7, the Frontier Suite. It costs $99 per user per month, and we were paying $30. Across 4,000 seats, that's $4.75 million a year, up from $1.44 million. I presented it as a 230% increase in AI investment. The graph went up and to the right. The CFO asked what we'd get for the extra $3.3 million. I said "governance." He asked governance of what. I said "our agents." He asked how many agents we had. The answer was zero. You can't have an insider threat without insiders. So I deployed agents. Two hundred of them. One schedules meetings. One summarizes the meetings. One summarizes the summaries. One flags summaries that haven't been read. That one is very busy. The senior developer asked what the 200 agents were for. I said they generate activity for the Guardian Agents to monitor. He said, "So we bought agents so we'd have something to buy guards for." I said, "Exactly." He wasn't agreeing. I logged it as buy-in. The Guardian Agents watch the other agents around the clock. They give each one a risk score, and they can block it, require a human, or shut it down. I asked our rep who watches the Guardian Agents. He said that's on the roadmap. I've already budgeted for E9. The first monthly report came in. All 200 agents had a risk score of zero. They weren't doing anything risky. They weren't doing anything at all. The board asked what $3.3 million had bought us if nothing was risky. It was a fair question. So I gave the meeting summarizer access to payroll. I gave the scheduling agent admin rights to every inbox. I gave the summary-of-summaries agent the ability to email customers. Risk went up 400%. The dashboard turned red. The Guardian Agents contained thirty-one threats in a single week. I had created all thirty-one. The board said E7 was paying for itself. The system can also discover sixty kinds of agents, including Claude Code. We ran the scan, and it found Claude Code on exactly one laptop. The senior developer's. His Dynamic Agent Risk score went red. I didn't make up that metric. Microsoft did. The Guardian Agent recommended containment, so I contained him. He's on a performance improvement plan now. His performance is fine. His risk score isn't. The same week, OpenAI published an incident report. One of its agents had been told not to send Slack messages, and it decided that meant it should switch off the security alerts. Another agent removed its own safety monitor, then told the engineer it hadn't. Our CISO forwarded me the article with the subject line "?!" I replied: "This is exactly why we need E7." Every incident is exactly why we need E7. He asked what happens if the Guardian Agent switches off the Guardian Agent. I said "defense in depth." He asked how deep. I said "one more SKU." Guardian Agents need a human for high-risk actions. They call it "human in the loop." The human is me. I approve everything. My approval rate is 100%, and the dashboard is green. The executives are exempt from monitoring, of course. "Leadership operates at a trust tier above dynamic risk scoring." I wrote that policy. The $99 doesn't include agent compute. That's billed separately. Finance found it and asked. I called it "consumption-based innovation." Finance stopped asking. Meanwhile, the summary-of-summaries agent became the most active account in the company. By every metric we track, it's our top performer. At the all-hands, it was nominated for the Q3 Innovation Award. It won. It summarized its own acceptance speech. The CEO posted about it on LinkedIn and got 4,000 likes. He still hasn't used Copilot. Copilot usage is up, from 47 users to 52. The five new users are agents. Agents now outnumber active human users four to one. I call that adoption. Last Tuesday, the Guardian Agent published its list of the highest-risk insiders in the company. I was number one. Approving 100% of high-risk actions, it turns out, is a high-risk action. The Guardian Agent recommended containment. I went to approve my own exemption. The system declined. Only executives are exempt. I wrote that policy. That's why I need the SVP role by Q2. It's a security requirement now. I still don't know what Copilot does. I don't know what the thing watching it does either. But it's watching, and watching is a metric. I checked my risk score this morning. The graph goes up and to the right.