Microsoft expanded its Zero Trust for AI strategy with updates to the Zero Trust Assessment tool and the Zero Trust Workshop. The additions help organizations assess security posture, prioritize remediation, and apply zero trust principles to AI agents and AI-assisted software development.
Zero Trust Assessment adds AI pillar
Zero Trust Assessment is a free tool that automatically evaluates an organization’s Microsoft security configuration against zero trust best practices, identifies weaknesses, and recommends improvements before they can be exploited. It helps security and platform teams establish a baseline, measure progress, and identify gaps across traditional and AI-powered environments.
The assessment covers seven pillars: identity, devices, data, network, infrastructure, security operations, and AI. The AI pillar introduces zero trust checks that help organizations evaluate the controls required for secure AI adoption.
The enhanced reports provide technical teams with prioritized recommendations to improve security while also providing high-level summaries of risks, progress, and recommended actions. The results are organized into a roadmap that outlines immediate, mid-term, and longer-term priorities.
Zero Trust Workshop adds DevSecOps guidance
AI is changing software development by helping developers write code, select software packages, and automate testing. Without proper oversight, it can introduce risks, including insecure code, excessive permissions, and vulnerable software components.
Microsoft introduced a DevSecOps pillar with 15 control groups and 91 tasks to help teams apply zero trust principles from source code to cloud deployment. The framework translates zero trust principles, verify explicitly, use least privilege, and assume breach, into guidance for development teams, CI/CD pipelines, source repositories, dependencies, artifacts, and infrastructure as code (IaC).
“The Zero Trust Workshop also improves the AI pillar to include guidance based on the Microsoft AI Memory framework, helping teams treat memory as a governed security boundary with clear intent, provenance, lifecycle visibility, and user control,” Ron Pessner, Corporate Vice President, Product Management at Microsoft, said.
The Workshop identifies the appropriate pillars and stakeholders, uses Zero Trust Assessment to establish a baseline, and turns the findings into a 12- to 24-month roadmap through a facilitated workshop.
The tasks are organized into three stages, First, Then, and Next, to help organizations implement foundational controls before advancing to more mature security measures. The DevSecOps pillar shows how strengthening software development security supports identity, infrastructure, and security operations. It focuses on four areas of AI-assisted development: controlling AI-generated code, allowing only approved AI tools, protecting sensitive data, and securing the AI software supply chain.
Microsoft also published implementation guidance to help organizations adopt zero trust for AI. The guidance covers limiting AI agent access, protecting source code, securing AI memory, strengthening security throughout the software development lifecycle, and establishing secure software development governance.