Practical Technology Insights

AI AGENTS + GOVERNANCE

An AI Agent Needs an Access Boundary, Too.

As assistants start taking actions across business systems, identity and approval controls matter as much as the quality of their answers.

Why It Matters

Microsoft’s October 2026 guidance describes the risks of giving capable agents access to important systems. A model can make mistakes or be manipulated; it should not be responsible for enforcing its own security boundary.

A Practical Starting Point

For a business workflow, define an owner, permitted data, allowed actions and a human approval point for consequential steps. Keep the ability to review activity and stop the agent outside the model’s instructions.

ASK YOUR TEAM

Could we explain exactly what each assistant can read, change and approve—and who can stop it?

Source: Microsoft Security: AI Agent Access and Controls ↗ Discuss This With Us →

AI SEARCH + INFORMATION QUALITY

Useful AI Answers Start With Useful Sources.

Connecting AI to company documents is only part of the work. Retrieval, permissions and source quality shape whether an answer is useful.

Why It Matters

Retrieval-augmented generation brings relevant source material into an AI response and can include references. Microsoft’s Foundry guidance also describes document-level access filtering when Azure AI Search is used.

A Practical Starting Point

Start with a bounded set of owned documents and representative questions. Check what different users can retrieve, whether references support the answer and how the experience handles missing evidence. Grounding is a design pattern, not a guarantee that every generated statement is correct.

ASK YOUR TEAM

Can an employee verify the answer—and does a user without permission stay outside the same information?

Source: Microsoft Learn: Retrieval-Augmented Generation ↗ Discuss This With Us →

IDENTITY + PHISHING

A Security-Themed Message Can Still Be a Trap.

Messages about passkeys or account protection can be used to win trust. Strong authentication still needs a trusted setup and recovery process.

Why It Matters

Microsoft’s September 2026 research documents passkey-themed social engineering followed by unauthorized authentication changes and cloud data access. A message’s security branding is not proof that its instructions are legitimate.

A Practical Starting Point

Give employees a known route for checking account-change requests. Review how authentication methods are registered and recovered, and evaluate phishing-resistant authentication alongside access policies and monitoring. Roll out changes with tested recovery paths and the required licensing.

ASK YOUR TEAM

If someone received an urgent request to change their sign-in method, would they know how to verify it independently?

Source: Microsoft Security: Passkey-Themed Social Engineering ↗ Discuss This With Us →

CYBER RESILIENCE + RECOVERY

A Backup Is Not the Whole Recovery Plan.

Restoring files is one task. Restoring the organization’s ability to operate requires owners, dependencies, escalation and practice.

Why It Matters

The Canadian Centre for Cyber Security’s ransomware playbook connects backup, recovery and incident-response planning, and calls for testing backup and restore processes. A successful backup job alone does not establish that an organization can recover its services.

A Practical Starting Point

Choose a business service and walk through the people, identities, systems and data it depends on. Confirm the recovery responsibilities, test an agreed restore scenario and record what did not work. Keep operational documentation accessible through the recovery arrangements.

ASK YOUR TEAM

Who leads the first hour of an incident, and when did we last prove that a critical service could be restored?

Source: Canadian Centre for Cyber Security: Ransomware Playbook ↗ Discuss This With Us →

MICROSOFT 365 + AI READINESS

Review Sharing Before Expanding AI Discovery.

A faster way to find information makes content ownership, current permissions and sensitive-data handling more important.

Why It Matters

Microsoft’s Copilot readiness guidance starts with a secure, governed information foundation. Copilot works with information users already have permission to access; overly broad access and stale content therefore deserve review.

A Practical Starting Point

Identify owners for important SharePoint sites, review broad sharing and stale access, and check the content you want people to rely on. Evaluate appropriate information-protection controls and their licensing before a wider rollout.

ASK YOUR TEAM

Which sites contain sensitive or outdated material, and who is responsible for reviewing their access?

Source: Microsoft Learn: A Governed Foundation for Copilot ↗ Discuss This With Us →

AZURE + COST GOVERNANCE

Cloud Cost Is an Ongoing Design Decision.

The smallest bill is not always the best outcome. Review usage and cost alongside reliability, security and the work the service supports.

Why It Matters

Azure’s Well-Architected guidance treats cost optimization as a continuous process that balances expenditure with business value and workload requirements. The right choice can change as usage and platform options evolve.

A Practical Starting Point

Assign an owner to each workload, review utilization and dependencies, and distinguish necessary capacity from resources that no longer serve a purpose. Assess scheduling, sizing and commercial commitments against actual demand before making changes.

ASK YOUR TEAM

Can we connect each significant cloud cost to a workload owner, a requirement and a regular review?

Source: Microsoft Learn: Cost Optimization Design Checklist ↗ Discuss This With Us →

What’s Changing. What It Means for You.

An AI Agent Needs an Access Boundary, Too.

A Practical Starting Point

Useful AI Answers Start With Useful Sources.

A Practical Starting Point

A Security-Themed Message Can Still Be a Trap.

A Practical Starting Point

A Backup Is Not the Whole Recovery Plan.

A Practical Starting Point

Review Sharing Before Expanding AI Discovery.

A Practical Starting Point

Cloud Cost Is an Ongoing Design Decision.

A Practical Starting Point

What’s Changing.
What It Means for You.