Sabiki Security has launched a free AI Readiness Scan and auto-remediation tool for Microsoft 365 tenants. Data from 178 scanned tenants, the company says, shows widespread gaps in how organisations oversee AI-related identities.

The Singapore-based security company says a default Microsoft 365 tenant fails its benchmark for AI readiness. The benchmark combines Microsoft Secure Score recommendations with the CIS Microsoft 365 Foundations Benchmark and the NIST AI Risk Management Framework.

Across the 178 tenants scanned since the tool launched, Sabiki says 97% contained AI agent identities that had not been reviewed. It also found that 74% had no sensitivity labels or data loss prevention policies in place, 53% had external or anonymous sharing settings that could expose data through AI assistants, and 37% allowed users to grant apps access to company data without administrator approval.

The dataset also showed that 38% of tenants had known rogue non-human identities active in the environment. Sabiki says these identities were apps and service principals matching incident-response lists of applications documented as abused by threat actors in Microsoft 365 compromises, although it added that a match alone did not mean a tenant had been compromised.

In 8% of scans, Sabiki found what it described as agentic identities changing their own permission scopes without a human session involved. It identified those cases through Microsoft 365 audit records in which the identity whose permissions changed was also the identity that made the change.

"Nearly one in ten scans showed an AI agent expanding its own access with no human in the loop," said Mark Anderson, product manager at Sabiki Security.

Source link