by Jesper Kråkhede, Sweden
Posted in Security Architecture, Technology on Oct 7th, 2026
Agents now triage alerts, investigate incidents, find attack paths and propose fixes. Some of them act on their own. So what remains for the human analyst? I get that question from colleagues, from students and, honestly, from myself. Let me try an answer. Judgement. Deciding which risk to accept, which action is worth its business […]
Posted in Business, Security Architecture on Aug 19th, 2026
Project Perception, like many AI services, uses consumption based pricing. You pay for what the agents do, measured in Security Compute Units, and more intensive tasks consume more units. That changes how a SOC is budgeted. Traditionally, security costs are mostly fixed. Licences per user or device, a SIEM priced per gigabyte, and salaries. You […]
Posted in Security Architecture, Technology on Aug 5th, 2026
On the 3rd of August Project Perception entered preview. It is a limited public preview, so only a selected group of customers have access for now. Here is how it actually works. It lives in the Defender portal, with sections for an overview, chat, sessions, agents and playbooks. Playbooks are reusable templates that describe how […]
Posted in Security Architecture, Technology on Jul 29th, 2026
This week Microsoft introduced Project Perception, a new agentic security system. The idea is simple to describe and hard to build. Three kinds of specialised AI agents work together. Red agents probe like an attacker. Blue agents investigate like your best responder. Green agents remediate and harden. What I like is the loop. A red […]
Posted in Security Architecture, Technology on Jun 17th, 2026
In November 2018 I wrote about a pentester who arrived in a long black coat, promised to become domain admin within hours, and came down to the cafeteria after an hour and fifty three minutes to ask for a user account. Forty five minutes later he gave up on that too. It is still one […]
Posted in Security Architecture, Technology on Feb 11th, 2026
Last year I wrote that AI agents are identities. Since then, the number of agents has exploded. They are built in low code tools, in development platforms, in productivity suites and in security products. Many are created by the business, not by IT. So here is a simple question: how many AI agents do you […]
Posted in Security Architecture on Jan 14th, 2026
We talk about self driving cars in levels. Level 0 is a human doing everything, level 5 is a car without a steering wheel. I think it is time we did the same for the SOC, because every vendor now claims to have an ‘autonomous SOC’ and the word has stopped meaning anything. Here is […]
Posted in Security Architecture, Technology on Nov 12th, 2025
This year the Model Context Protocol, MCP, has become the common way to connect AI agents to tools and data. It is an open standard, and the idea is simple. A server exposes tools, like ‘search tickets’ or ‘send mail’, and any agent that speaks MCP can use them. The big platforms have adopted it, […]
Posted in Security Architecture, Technology on May 21st, 2025
At Build this month Microsoft introduced Microsoft Entra Agent ID, a way to give AI agents their own identities in the directory. That may sound like a small detail. It isn´t. An AI agent that reads mail, files tickets, queries databases or changes configurations needs permissions to do so. Today, many agents run with the […]