Red, blue and green
Jul 29th, 2026 by Jesper Kråkhede
This week Microsoft introduced Project Perception, a new agentic security system. The idea is simple to describe and hard to build. Three kinds of specialised AI agents work together. Red agents probe like an attacker. Blue agents investigate like your best responder. Green agents remediate and harden.
What I like is the loop. A red agent finds a path an attacker could use. Instead of a report that ends up in a backlog, a green agent fixes it, and a blue agent watches for anyone trying to use it in the meantime. The finding becomes a fix without a handover at every step.
The agents start with the context of your organisation: past incidents, policy decisions, identity relationships and live signals across endpoints, identities, clouds and applications. That is the difference between an agent that guesses and one that knows that this particular server is critical.
It also uses purpose built security models. One of them is used inside MDASH, the vulnerability scanning system I wrote about in May and June.
And the important part: humans set the objectives and the guardrails, and every high impact action requires a human sign off. Every decision is meant to be traceable and replayable.
How should you prepare? Get your foundations right, because the agents work with the data and permissions you give them. Define your critical assets. Decide which actions you are comfortable letting agents take, and which need approval.
The SOC has always needed more hands. Now it might get them.