Microsoft’s Cyber Pulse report puts agent governance under scrutiny

Microsoft released its Cyber Pulse report on 10 February, focusing on the governance of AI agents. The company said more than 80% of Fortune 500 businesses used active agents built with low-code or no-code tools. That statistic concerns a defined group and tooling context; it should not be read as a global adoption rate.

The report recommends holding agent identities to controls comparable with employees and service accounts: limited access, explicit verification and planning for compromise. The practical gap is whether a business can identify agents already operating inside workflows and assign responsibility for their actions. Creating an agent through a simple interface does not remove the need to track the information and services it can access.