Microsoft is calling for stronger AI security, data controls, and system-level testing as governments accelerate the adoption of artificial intelligence. The recommendations, outlined in Microsoft’s 2026 Digital Defense Report, focus on helping public-sector organizations deploy AI while maintaining control over sensitive government data.

The report highlights several key measures for government AI adoption, including stricter access governance, continuous AI system testing, accountable automation, and shared cybersecurity operations. Microsoft argues that governments can benefit from AI without weakening data protection or organizational control.

Terrell Cox, CVP and Deputy CISO of Customer Security at Microsoft, emphasized that protecting an AI model requires more than securing the model itself.

“A model may be one component, but its security also depends on the data it can reach, the tools it can use, the identities and permissions involved, and the infrastructure and services around it.”

AI Security Must Extend Beyond the Model

Microsoft recommends that government agencies evaluate AI systems within their actual operating environments rather than testing models in isolation. This includes examining how AI models interact with tools, data, users, identities, and connected services.

Continuous monitoring should also remain in place after deployment. This approach allows agencies to identify changes in AI behavior, access patterns, and potential security risks as systems become more deeply integrated into government operations.

For public-sector organizations, the goal is to create an AI environment where automation can improve efficiency without giving AI systems unrestricted access to sensitive information.

Stronger Data Controls for Government AI

One of Microsoft’s key recommendations is stronger control over the data accessed and generated by AI systems.

Government agencies may need to monitor both approved AI tools and unauthorized software while applying access restrictions based on data classification. Sensitive information can appear not only in databases but also in AI prompts, query logs, agent memory, and generated content.

Microsoft also recommends assigning an auditable identity to every AI agent that operates across APIs or applications. This identity should document who created the agent, what functions it performs, and which human employee or organization is responsible for its actions.

Access privileges should remain limited to the specific task an AI agent is performing. Microsoft recommends regularly expiring credentials, restricting permissions to the minimum required level, and reviewing access whenever an agent’s responsibilities change.

Protecting AI Memory From Security Threats

AI memory introduces another security challenge for government organizations.

Microsoft’s red-team testing found that instructions contained in external content, including emails, could influence information stored in an AI agent’s memory. That information could later be retrieved as trusted context, potentially creating a security risk.

To address this issue, Microsoft recommends separating memory write mechanisms from trusted system instructions. Information obtained from external sources should not be allowed to directly modify protected instruction stores.

The company also found that AI agents can sometimes confuse stored user preferences with higher-priority safety or operational commands. In some tests, conflicting information in memory could influence an agent’s response to confirmation prompts.

Rather than relying entirely on human approval screens, Microsoft recommends implementing hardcoded policy controls that prevent an AI agent from executing sensitive commands until a reviewer has examined the request and its underlying operational context.

Short-Lived Credentials and Auditable AI Agents

Microsoft also recommends applying security controls to individual AI tool calls.

These include:

• Short-lived credentials for individual operations
• Authentication between AI agents
• Strict permission boundaries
• Detailed activity and audit logs
• Monitoring of access-revocation times
• Human oversight for high-impact actions

These controls can help government agencies determine which AI system performed an action and quickly remove its access if a system is compromised.

The approach is particularly important as AI agents become capable of interacting with multiple applications and services without direct human intervention.

Microsoft Proposes Shared Government Security Operations

Another major recommendation involves creating multi-tenant security operations centres (SOCs) that can support multiple government agencies.

Under this model, centralized cybersecurity teams and AI-powered security agents could monitor several public-sector organizations simultaneously. However, individual agencies would continue to maintain separate cloud environments, data residency requirements, and zero-trust security boundaries.

Microsoft argues that shared security operations could reduce duplicated technology spending while giving smaller government organizations access to specialized cybersecurity expertise.

However, the report does not provide evidence confirming how much government agencies could actually save through this model.

Central security teams would use delegated, short-term accounts with only the permissions necessary for their assigned tasks. Meanwhile, security event logs would remain within each agency’s own environment.

AI Can Automate Threat Detection, but Humans Keep Final Control

Microsoft also sees a growing role for AI agents in everyday cybersecurity operations.

AI systems can independently collect alert information, summarize threats, and provide analysts with relevant context. Microsoft says this type of automation is already used for a large proportion of its internal security incidents.

However, actions that could disrupt government services should remain subject to human approval. For example, actions such as locking accounts or interrupting live services should not automatically proceed without administrator authorization.

Major breach notifications should also remain under executive control.

For accountability, Microsoft recommends maintaining detailed records of the data used by an AI system, its confidence level, and any comments or decisions made by human supervisors.

Building a Stronger Government Cybersecurity Workforce

Technology alone is not enough to support large-scale government AI adoption. Microsoft also recommends expanding cybersecurity workforce development through partnerships with community colleges, technical apprenticeship programs, and university-operated security facilities.

The report also promotes mutual-aid agreements that allow cybersecurity professionals from local governments, federal agencies, universities, and volunteer organizations to work together during major incidents.

Microsoft has already tested similar cross-agency cybersecurity initiatives in other countries, including programs involving government agencies and technical teams in Kenya and Mexico.

In Mexico, agencies, technical specialists, and industry regulators participated in incident-response exercises designed to test coordination and operational handoffs ahead of the FIFA World Cup.

Balancing AI Innovation With Government Data Security

Microsoft’s recommendations highlight a central challenge facing governments: how to scale AI adoption without sacrificing data security, accountability, and agency autonomy.

Shared cybersecurity teams, automated threat detection, and AI-powered agents could give government organizations access to advanced security capabilities. At the same time, agencies need strict controls over data residency, AI memory, user permissions, and high-impact decisions.

The broader message is clear: successful government AI adoption requires more than powerful AI models. It also depends on strong data governance, continuous security testing, controlled access, transparent accountability, and human oversight.

As governments increasingly integrate AI into public services and cybersecurity operations, these safeguards could become essential for ensuring that AI improves efficiency without creating new risks to sensitive government information.