--- title: "Agents in a Box: What Windows Execution Containers Solve, and What Still Needs Endpoint Telemetry" id: "40194" type: "post" slug: "windows-ai-execution-containers-endpoint-telemetry" published_at: "2026-11-03T07:29:10+00:00" modified_at: "2026-11-03T07:58:18+00:00" url: "https://www.kitecyber.com/blog/windows-ai-execution-containers-endpoint-telemetry/" markdown_url: "https://www.kitecyber.com/blog/windows-ai-execution-containers-endpoint-telemetry.md" excerpt: "Table Of Content What containment does well Where the gaps remain A practical way to layer the controls Where Kitecyber […]" taxonomy_category: - "AI Security" - "Data Security" - "DLP" - "Endpoint Security" --- Table Of Content - [What containment does well](#what-containment-does-well) - [Where the gaps remain](#where-the-gaps-remain) - [A practical way to layer the controls](#a-practical-way-to-layer-the-controls) - [Where Kitecyber fits](#where-kitecyber-fits) Related Posts ## [Agents in a Box: What Windows Execution Containers Solve, and What Still Needs Endpoint Telemetry](https://www.kitecyber.com/blog/windows-ai-execution-containers-endpoint-telemetry/) ## [From Alerts to Baselines: Dynamic Risk Scoring for AI Tools, Device by Device](https://www.kitecyber.com/blog/dynamic-risk-scoring-ai-tools/) ## [The Agent Runtime You Don’t Control](https://www.kitecyber.com/blog/the-agent-runtime-you-dont-control/) Table Of Content - [What containment does well](#what-containment-does-well) - [Where the gaps remain](#where-the-gaps-remain) - [A practical way to layer the controls](#a-practical-way-to-layer-the-controls) - [Where Kitecyber fits](#where-kitecyber-fits) [ZTNA](https://www.kitecyber.com/ztna/) [User Identity Theft](https://www.kitecyber.com/user-identity-theft/) [Snowflake marketplace cybersecurity](https://www.kitecyber.com/snowflake-marketplace-cybersecurity/) [Snowflake incident](https://www.kitecyber.com/snowflake-marketplace-cybersecurity/snowflake-incident/) [Snowflake](https://www.kitecyber.com/snowflake-marketplace-cybersecurity/snowflake/) [Sensitive Data Theft](https://www.kitecyber.com/sensitive-data-theft/) [Secure Web Gateways](https://www.kitecyber.com/swg/) [SaaS App Sprawl](https://www.kitecyber.com/saas-app-sprawl/) [Private Access VPN](https://www.kitecyber.com/private-access-vpn/) [Private Access Solution](https://www.kitecyber.com/private-access-solution/) # Agents in a Box: What Windows Execution Containers Solve, and What Still Needs Endpoint Telemetry - November 3, 2026 - [Srikanth Chavali](https://www.kitecyber.com/author/shrikant/) **Quick Answer:** AI Security Posture Management (AISPM), also called AI Posture Management, is the continuous process of discovering, monitoring, and controlling how AI tools, models, and agents interact with your company's data and systems. It covers everything from spotting an unapproved AI app on someone's laptop to blocking a customer record from being pasted into a public chatbot. Most teams that manage AI posture well pair a discovery layer with policy enforcement at the point where employees actually use AI, which is the endpoint. **Kitecyber | Data & Gen AI Security** Containment answers “what can this agent reach?” Security teams also have to answer “what did it do, and what was it holding when it did it?” On 7 October, Microsoft laid out its vision for Windows as a platform for “hybrid intelligence”: AI agents that run locally when needed, call the cloud when appropriate, and operate with built-in security and manageability. A headline item was that Microsoft Execution Containers (MXC) are now generally available on Windows, alongside identity and manageability capabilities meant to help organizations control what agents can access and understand which agent performed an action. This is a meaningful step. Running an agent inside a boundary is exactly the right instinct. It also raises a question every security team should ask before declaring the problem solved: what does a container tell you, and what does it leave out? ## What containment does well A container narrows an agent’s blast radius. It constrains the files, processes and resources the agent can touch, and it gives administrators a place to attach policy. Paired with agent identity, it helps answer attribution questions. These are deterministic controls wrapped around a non-deterministic system, which is a sound design principle. ## Where the gaps remain - **Data inside the permitted boundary still moves.** An agent allowed to read a project folder and call an approved tool can still carry sensitive content into a prompt, a summary or an outbound request. The container permits the access; it does not judge whether the data should travel. Classification of what the agent actually handled is a separate question. - **Not every agent will be in the box.** Developers install coding assistants, desktop AI apps, browser extensions and local model runtimes on their own. Many fleets are mixed across Windows, macOS and Linux. A control that applies to agents launched through the sanctioned path says little about the ones that were not. - **Containment is a prevention layer, not an evidence layer.** After an incident, the first questions are what ran, what it read, what it sent, and who was logged in. Those answers come from process, file, network and user activity on the device, recorded consistently across every agent, contained or not. - **Local and cloud intelligence blur together.** Hybrid designs route work to a local model or the cloud depending on the task. For governance, the useful unit is the data flow: what left the device, what stayed, and why. That is visible at the endpoint. ## A practical way to layer the controls - **1. Contain what you sanction.** Use platform containment for agents you deploy deliberately. - **2. Inventory what you did not.** Discover every AI app, agent, extension, MCP server and local model on each device, whether or not it was launched through the approved path. - **3. Classify the data in motion.** Tie agent activity to data classification so a policy can distinguish a draft memo from customer records. - **4. Record the activity as evidence.** Keep a device-level timeline of process, file, network and user events for every agent, so investigations start from facts. - **5. Enforce on the device.** Apply allow, warn, redact or block decisions where the action happens, including for agents outside the container. ## Where Kitecyber fits Kitecyber’s Gen AI and data security runs on the endpoint, where agents execute. It combines device posture, operating system and process activity, network activity, user activity and [data classification](https://www.kitecyber.com/glossary/data-classification/) (80+ categories), and enforces policy on the device. That complements platform containment: the container limits reach, and Kitecyber shows what AI tools are present, what data they handle and how policy applies to each. A lightweight agent (under 2% CPU) and typical deployment in around a day keep it practical. **Book a Kitecyber walkthrough** at [kitecyber.com](https://www.kitecyber.com/) to see every agent on your endpoints, inside the box and outside it. [https://www.kitecyber.com/author/shrikant/](https://www.kitecyber.com/author/shrikant/) [Srikanth Chavali](https://www.kitecyber.com/author/shrikant/) With over a decade of experience steering cybersecurity initiatives, my core competencies lie in network architecture and security, essential in today's digital landscape. At Kitecyber, our mission resonates with my quest to tackle first-order cybersecurity challenges. My commitment to innovation and excellence, coupled with a strategic mindset, empowers our team to safeguard our industry's future against emerging threats. Since co-founding Kitecyber, my focus has been on assembling a team of adept security researchers to address critical vulnerabilities and enhance our network and user security measures. Utilizing my expertise in the Internet Protocol Suite (TCP/IP) and Cybersecurity, we've championed the development of robust solutions to strengthen cyber defenses and operations. [mailto:skc@kitecyber.com](mailto:skc@kitecyber.com) [https://www.kitecyber.com/](https://www.kitecyber.com/) Posts: 103 [https://www.kitecyber.com/author/shrikant/](https://www.kitecyber.com/author/shrikant/) [Srikanth Chavali](https://www.kitecyber.com/author/shrikant/) With over a decade of experience steering cybersecurity initiatives, my core competencies lie in network architecture and security, essential in today's digital landscape. At Kitecyber, our mission resonates with my quest to tackle first-order cybersecurity challenges. My commitment to innovation and excellence, coupled with a strategic mindset, empowers our team to safeguard our industry's future against emerging threats. Since co-founding Kitecyber, my focus has been on assembling a team of adept security researchers to address critical vulnerabilities and enhance our network and user security measures. Utilizing my expertise in the Internet Protocol Suite (TCP/IP) and Cybersecurity, we've championed the development of robust solutions to strengthen cyber defenses and operations. [mailto:skc@kitecyber.com](mailto:skc@kitecyber.com) [https://www.kitecyber.com/](https://www.kitecyber.com/) Posts: 103