AI agents are multiplying faster than the controls built to govern them. Gartner expects more than 150,000 agents per Fortune 500 enterprise by 2028, and Deloitte found that only 21% of enterprises have a mature agentic AI governance model today.
Two approaches have emerged. Independent vendors sit between agents and infrastructure and govern what every agent does, wherever it runs. Platform vendors are extending the controls they already sell to cover agents. Alterion is an example of the first approach. Microsoft Agent 365 is the most prominent example of the second.
This article compares the two on scope, runtime enforcement, coverage outside Microsoft, deployment and cost, and ends with where each one fits best. For the short version, see Alterion compared to Microsoft Agent 365.
Four Things That Set Alterion Apart
- 01
It runs in the enterprise environment
Alterion runs on-prem, in a VPC or air-gapped, with zero data egress, so prompts, responses and agent data stay inside the enterprise.
- 02
It finds every agent without code changes
Alterion discovers sanctioned and shadow agents with no agent code changes or SDK integrations, so developers keep building at full speed.
- 03
It unifies the controls already in place
One control plane pulls together the endpoint, SaaS, gateway and identity controls the enterprise already runs, and covers the ground between them.
- 04
Its intelligence learns the environment
Helix, Alterion's set of small language models, runs inside enterprise infrastructure and learns the environment over time. Data stays put: it never reaches an external provider or returns to Alterion for model training.
What Is Alterion?
Alterion is an independent runtime control plane for AI agents. It sits between agents and enterprise infrastructure and governs what each agent actually does at the time of execution, including actions its configuration never anticipated.
It runs inside the customer's environment, needs no code changes, SDKs or agent rewrites, and works across AWS, Google Cloud and Azure with OpenAI, Claude and Copilot models. The platform has three products:
Draco
Draco is the control plane. It discovers sanctioned and shadow agents across SaaS, endpoint and custom deployments, inventories prompts, tool calls and token spend, and applies real-time guardrails to prompts, actions and responses.
Helix
Helix is the intelligence layer. Its specialized small language models run inside enterprise infrastructure and learn the environment over time, catching prompt injection, data exfiltration and intent drift at runtime.
Aquila
Aquila is the endpoint arm. It enforces Draco's policies on employee devices, covering coding agents, browser AI tools and local agents. For coding agents, evaluation runs on the device, and raw prompts and source code stay there by default.
Alterion is in production at Fortune 500 enterprises in regulated industries.
What Is Microsoft Agent 365?
Microsoft Agent 365 is Microsoft's control plane for AI agents. Microsoft announced it at Ignite in November 2025 and made it generally available on May 1, 2026. It extends the tools Microsoft already uses to manage people, such as identity, data protection and threat defense, to agents.
Microsoft organizes Agent 365 around three pillars: observe, govern and secure. In practice that means:
A registry and identity
Each agent gets its own Microsoft Entra Agent ID for identity, lifecycle and access management, and appears in one inventory in the Microsoft 365 admin center.
Data protection
Microsoft Purview applies data loss prevention, sensitivity labels and audit logging to agent activity.
Threat protection
Microsoft Defender extends posture management, detection and response to agents.
Multiple build paths
Agents built on Microsoft's own platforms plug in natively. Other frameworks connect through the Agent 365 SDK.
For a Microsoft-standardized enterprise, the appeal is clear: governance arrives inside tools the security team already runs, with no new vendor to procure.
How They Compare
The biggest differences between the two show up in shadow discovery outside Microsoft, enforcement at the tool call, and where data goes.
| Alterion | Microsoft Agent 365 | |
|---|---|---|
| Shadow agents | Every agent on devices, SaaS, containers and serverless, each mapped to an owner | Microsoft, partner and registered agents; agents built elsewhere need extra steps |
| Runtime enforcement | Real-time guardrails on every prompt, action and response, including MCP and function calls | Defender detects and blocks unsafe actions; some protections still in preview |
| Agent drift | Learns each agent's baseline and flags divergence before it executes | Usage analytics, error reporting and performance insights |
| Beyond Microsoft | One policy on AWS, Google Cloud and Azure, with no SDK | Agent 365 SDK; governance depth for other frameworks more limited at launch |
| Employee devices | Aquila covers coding agents, browser AI and local agents | Defender for local agents on Windows, in public preview |
| Compliance | Live risk score per agent; evidence for SOC 2, ISO 42001, NIST AI RMF, HIPAA and the EU AI Act | Purview audit logs, DLP and sensitivity labels |
| Deployment | VPC, on-prem, data center or air-gapped, with zero data egress | Microsoft cloud, in the Microsoft 365 tenant |
Finding Shadow Agents
An enterprise cannot govern agents it cannot see. The Cloud Security Alliance found that 82% of enterprises have AI agents they don't know about (2026), and IBM reports that 43% of breaches in 2026 involved shadow AI.
Alterion finds every agent, whether it runs on a device, in a SaaS app, in a container or as a serverless workload, and maps each one to its owner. It needs no agent code changes or SDK integrations, so developers keep building without slowing down.
Agent 365 inventories agents built on Microsoft platforms, partner agents and agents the enterprise registers itself. Microsoft notes that agents built outside its environments need additional steps to appear.
Every agent on devices, SaaS, containers and serverless, each mapped to an owner
Microsoft, partner and registered agents; agents built elsewhere need extra steps
Enforcing Policy at Runtime
Gartner predicts that through 2028, more than 80% of unauthorized agent actions will be internal policy violations, with outside attacks making up the remainder. That is why the moment an agent acts matters most.
Alterion applies real-time preventative guardrails on every prompt, action and response, including the MCP and function-calling step. It blocks the bad action and leaves the rest of the agent's permitted work running. Responses escalate through a ladder: flag, quarantine the session, block the user, block the agent, notify incident response.
Agent 365 uses Defender to detect and block unsafe agent actions and Purview for data policy. Several of these protections were still in public preview when Agent 365 reached general availability in May 2026. As of October 2026, Microsoft still lists Defender's real-time protection for Copilot Studio and Foundry agents as preview.
Real-time guardrails on every prompt, action and response, including MCP and function calls
Defender detects and blocks unsafe actions; some protections still in preview
Catching Agent Drift
An agent can break no written rule and still go wrong. Consider an agent that tidies database records every day and, on day twenty, deletes a thousand of them.
Alterion learns each agent's purpose and baseline behavior. It tracks how an agent acts over a session and flags divergence before it executes, well ahead of any post-mortem. From then on, divergence from the agent's own history becomes the signal.
Agent 365 provides usage analytics, error reporting and performance insights across the agent inventory.
Learns each agent's baseline and flags divergence before it executes
Usage analytics, error reporting and performance insights
Governing Agents Beyond Microsoft
Alterion applies one policy wherever an agent runs. It is infrastructure and vendor agnostic: it runs on AWS, Google Cloud and Azure with OpenAI, Claude and Copilot models.
Agent 365 governs non-Microsoft agents through the Agent 365 SDK, which supports frameworks such as the OpenAI Agents SDK and LangChain. Independent reviewers note that governance depth for non-Microsoft frameworks was more limited at launch, and agents built outside Microsoft's environments need extra steps to be governed.
One policy on AWS, Google Cloud and Azure, with no SDK
Agent 365 SDK; governance depth for other frameworks more limited at launch
Securing AI on Employee Devices
Alterion's Aquila checks every prompt, tool call and code commit on employee devices before it runs. That covers coding agents like Claude Code, Codex and Cursor, browser AI like ChatGPT, Claude and Perplexity, and agents running locally.
Agent 365 extends Defender runtime protection to locally running agents on Windows endpoints, a capability Microsoft lists in public preview.
Aquila covers coding agents, browser AI and local agents
Defender for local agents on Windows, in public preview
Proving Compliance
Alterion maintains a live, explainable risk score for every agent and generates audit-ready evidence mapped to SOC 2, ISO 42001, NIST AI RMF, HIPAA and the EU AI Act. It integrates with GRC, SIEM and SOAR tools. Because Alterion is independent of the systems it governs, the party producing the evidence is never the party under review.
Agent 365 routes agent activity into Purview audit logs, DLP and sensitivity labels, which compliance teams in Microsoft shops already use.
Live risk score per agent; evidence for SOC 2, ISO 42001, NIST AI RMF, HIPAA and the EU AI Act
Purview audit logs, DLP and sensitivity labels
Deployment and Data Residency
Alterion deploys on-prem, in a VPC, in a data center or fully air-gapped, with zero data egress. Prompts often contain intellectual property, personal data and health information, so keeping them inside the enterprise removes a critical point of data leakage. The evaluation asks agent owners to change no code.
Agent 365 runs in Microsoft's cloud as part of the Microsoft 365 tenant. For organizations already on E5, that means fast enablement. Agent 365 reached Government Community Cloud customers on October 1, 2026, as part of Microsoft 365 G7, but some Purview and Defender protections available in commercial tenants are not yet available there.
VPC, on-prem, data center or air-gapped, with zero data egress
Microsoft cloud, in the Microsoft 365 tenant
Total Cost of Ownership
Two cost questions to ask before deciding:
- 01
How much of the agent estate is outside Microsoft?
Agents built outside Microsoft need extra setup, such as the Agent 365 SDK, before Agent 365 can govern them, and that setup takes engineering time. Alterion needs no SDK, so the cost of coverage stays flat as frameworks multiply.
- 02
What does agent spend look like today?
A single agentic task can burn 5 to 30 times the tokens of a chatbot, according to Gartner. Alterion makes agent spend visible by team, agent and use case. From there, it can route requests to cheaper models, set spending caps and stop runaway agents.
When agents span several clouds and devices, the full cost of covering them includes SDK work, extra tools and the blind spots between them. Alterion governs the whole agent estate from one control plane, with no SDK and no per-framework engineering.
Where Alterion Fits Best
Alterion fits enterprises with AI agents already in production that take real actions on sensitive systems and data, and that need runtime control over those agents in addition to documented policy. It fits best when:
Agents are already in production
They read, write and act on real systems, so every call needs a verdict before it runs.
Security and compliance need proof
Teams have to show the board and regulators what agents actually did, with the evidence and the data kept on-prem.
The industry is regulated
Banks, health insurers, healthcare providers and broker-dealers need agent-scoped risk scores and audit evidence for SOC 2, ISO 42001, NIST AI RMF, HIPAA and the EU AI Act.
The agent estate is fragmented
Agents run across several clouds, identity providers and business units, each with its own console and policy.
Shadow AI is a known unknown
Engineers run coding agents, MCP servers and local models that current controls cannot see.
Each leader who owns part of the problem gets something specific:
| Leader | Owns | What Alterion provides |
|---|---|---|
| CISO or head of security | Shadow agents, AI on endpoints, proving control | Every agent in view, including shadow agents, enforcement in the path, and evidence for the board and regulators |
| CIO or head of platform | A fragmented agent estate | One control plane that unifies the controls already in place, with no rip-and-replace |
| Head of AI | Drift and non-determinism | Agents that keep working, with divergence from intent caught at the tool call |
| CFO | Agent and token spend | Spend by team, agent and use case, with caps and kill switches for runaway agents |
Agent 365 fits Microsoft-standardized enterprises that govern mostly Microsoft-built agents and want that governance inside the Microsoft 365 admin center.
The Verdict: Which One Fits the Estate
Agent 365 covers agents that live inside Microsoft 365. Alterion governs every agent the enterprise runs, Microsoft agents included, at runtime and on its own infrastructure.
- Agents already run across clouds, vendors and employee devices
- Every prompt, action and response needs a decision before it runs
- Prompts and agent data have to stay inside the enterprise, with zero data egress
- The board and regulators expect evidence of what every agent did
- Coding agents, MCP servers and local models are already in use
Enterprises with agents beyond Microsoft keep Entra, Purview and Defender in place and add Alterion as the one runtime policy over every agent.
In production- Runs alongside Microsoft 365 and Copilot Studio at Fortune 500 manufacturers
- 15,000+ shadow agents found for a Fortune 100 manufacturer in 24 hours
- Helix intelligence and a kill switch stop IP leakage and agent drift in a regulated enterprise
- Agents live almost entirely in the Microsoft 365 tenant
- Copilot Studio and Foundry are the only build platforms in use
- Governance in the Microsoft 365 admin center is enough
- Some protections still in preview are acceptable
Already Invested in Microsoft 365?
Alterion works alongside it. Identity, DLP and security tools stay authoritative, and Alterion adds one runtime policy that holds Microsoft agents and every other agent to the same line, wherever they run.
Why It Matters for Buyers
Agent 365 makes Microsoft a strong place to start governing agents. The decision turns on how much of the agent estate lives outside Microsoft, whether enforcement has to happen before an action runs, and whether prompts can leave the enterprise. For enterprises whose agents already cross clouds, vendors and devices, one runtime policy across every agent keeps governance in step as the estate grows.
Frequently Asked Questions
What is Alterion?
Alterion is an independent runtime control plane for AI agents. It discovers every agent in the enterprise, including shadow agents, and governs what each one does at execution time across clouds, SaaS platforms and employee devices.
How does Alterion find shadow agents?
Alterion uses a multi-sensor fabric across devices, SaaS, containers and serverless workloads. It attributes each agent to a host and an owner with no agent code changes or SDK integrations needed. Customers have seen the first undeclared agents within two days of deployment.
How does Alterion enforce policy at runtime?
Alterion applies real-time preventative guardrails on every prompt, action and response including the MCP and function-calling step. It blocks the bad action, not the whole agent, so everything else the agent is allowed to do keeps running. Responses escalate through a ladder: flag, quarantine the session, block the user, block the agent, notify incident response.
Can Alterion govern Microsoft 365 agents?
Yes. Alterion governs Microsoft 365 agents alongside agents on other clouds and identity providers, holding them all to one policy.
How does Alterion work with my existing security tools?
Alterion fits in alongside the tools you already run, including identity providers, DLP, SIEM, SOAR and GRC.
It pulls their signals into one view and adds runtime enforcement where they leave gaps. Nothing gets ripped out or replaced.
Does Alterion govern AI on employee devices?
Yes. Aquila enforces Alterion policies on employee devices, covering coding agents like Claude Code, Codex and Cursor, browser AI tools like ChatGPT, Claude and Perplexity, and local agents.
For coding agents, evaluation runs on-device and raw prompts and source code never leave the device by default.
How is Alterion priced?
Alterion uses custom enterprise pricing. Talk to the team for a quote.
Does Alterion require code changes or an SDK?
No. Alterion discovers and governs agents with no code changes, SDKs or agent rewrites, so agent owners don't have to do anything differently.
Where does Alterion run?
Alterion deploys on-prem, in your own environment. It runs air-gapped, with zero data egress. Its Helix models learn your environment over time, and nothing reaches an external provider or returns to Alterion for model training.
Which compliance frameworks does Alterion support?
Alterion generates audit-ready evidence mapped to SOC 2, ISO 42001, NIST AI RMF, HIPAA and the EU AI Act, and integrates with GRC, SIEM and SOAR tools.
See the side-by-side summary in Alterion compared to Microsoft Agent 365, or browse all comparisons.
