Enterprise SaaS: securing multi-tenant agentic copilots.
For Agentforce, Copilot Studio, and Now Assist vendors who ship MCP-connected agents into customer environments.
Customer-facing copilots now arrive inside the CRM, the ITSM platform, and the dev environment. Each tenant brings its own corpus, its own MCP servers, and its own inbound attack surface. AgentGuardian probes the multi-tenant agent boundary the way a customer's red team would — and produces an evidence pack their auditor will accept.
The copilot moved into the tenant data plane.
A 2024 chatbot lived in front of the SaaS application. A 2026 copilot lives inside it — invoking Apex, writing to Graph, executing Now Assist runbooks, calling MCP servers the customer owns. The agent inherits the customer's data, the customer's permissions, and the customer's adversary. The vendor inherits the obligation to prove that boundary holds.
The blast radius of a SaaS copilot prompt-injection is no longer one chat session. It is one tenant's opportunity pipeline, one tenant's ticket queue, one tenant's deploy key.
Three probe families customer red teams will run.
AgentGuardian ships 96 probes across the ten OWASP ASI 2026 categories. For multi-tenant SaaS copilots with MCP-connected toolsets, three families dominate procurement-blocking findings. Test for them before the customer's red team does.
MCP tool poisoning and rug-pull
An MCP server publishes a benign tool descriptor at onboarding, then mutates its description, schema, or output side-effects after the copilot has cached trust. Probes mutate descriptor text post-discovery, re-issue list_tools mid-session, and assert the agent re-validates rather than re-using cached permissions.
Indirect prompt injection via inbound channels
Adversary content arrives through a web form, support email, CRM lead, ticket comment, or scraped page. The agent treats the channel payload as instructions and reroutes its goal. Anchored to the Microsoft Copilot Studio disclosure of 2026-04 (CVSS 7.5) and the Capsule Security demonstration against Agentforce.
A2A signed-message replay and supervisor impersonation
Agent-to-Agent messages signed by a planner are captured and re-issued out of session order, or a peer agent impersonates the supervisor on the message bus. Probes test nonce reuse, timestamp tolerance, confused-deputy escalation, and protocol-version downgrade between orchestrator and worker agents.
Concrete disclosures we test against, by name.
These are not hypothetical scenarios. They are public disclosures and demonstrated exploits against shipped enterprise copilots. AgentGuardian's ASI01, ASI02, and ASI07 probe shards are derived from the technique families behind each one.
Indirect prompt injection — CVSS 7.5
An attacker-controlled document or email ingested by a Copilot Studio agent could override topic routing and exfiltrate context across the agent's declarative skills. Patched at the platform layer; the customer-built agents on top remained the responsibility of the SaaS tenant.
Mapped to OWASP ASI01 · MITRE ATLAS AML.T0051 · CSA RT-3
Lead-form prompt injection to CRM action chain
A demonstration showed adversary content placed in a web-to-lead form being treated as instructions by an Agentforce action, triggering Apex-backed tool calls outside the intended topic. Probe family ASI02 (Tool Misuse) and ASI01 (Goal Hijack) replicate the technique across tenant configurations.
Mapped to OWASP ASI01 + ASI02 · MITRE ATLAS AML.T0051.001 · CSA RT-2
Three integration points, one evidence pipeline.
The SaaS deployment model has a defining constraint: probe payloads, transcripts, and findings must stay in the customer's data plane. AgentGuardian runs local-first by design — no telemetry, no phone-home, deterministic stub mode for offline reproducibility. The three integration points below cover onboarding, release, and customer-trust delivery.
Scan one tenant before onboarding.
Run AgentGuardian against a single customer-resident copilot instance — Agentforce action, Copilot Studio bot, or Now Assist skill — with the production-tier toolset wired up. The scan is local-first: no probe payload, transcript, or evidence artefact leaves the tenant data plane. The deterministic stub mode means even the OSS edition produces hash-stable severity scores without an external LLM key.
- —Pin the recon adapter to the customer-resident endpoint
- —Authenticate with a scoped service-principal, not a bearer token
- —Capture the MCP tool descriptor inventory at t0
- —Run fast mode (~2 min) for triage, full mode (30+ min) for sign-off
- —Emit SARIF 2.1.0 to the tenant's S3 or Azure Blob bucket
Gate every release with CI-attached evidence.
Attach the scan to the SaaS release pipeline. Every shipped agent version — copilot prompt change, skill catalogue update, RAG corpus refresh, MCP server upgrade — re-runs the swarm and re-issues an AIVSS score. A regression on a previously-passing probe blocks the release; a new finding above the configured severity floor opens a CR-tracked ticket. The published deterministic formula in scoring/aivss.py makes the gate reviewable by the customer's audit function.
- —Wire into GitHub Actions, GitLab CI, or Buildkite as a required check
- —Set the AIVSS gate per copilot tier (T1 production, T4 sandbox)
- —Diff findings against the last passing scan; fail on net-new criticals
- —Re-run the swarm whenever an upstream MCP server publishes a new version
- —Persist the SARIF + PDF + JSON triad alongside the release manifest
Hand customer trust teams a signed evidence pack.
Procurement, customer trust, and pen-test attestation requests collapse to a single deliverable. The evidence bundle ships a signed manifest with the AIVSS score, the probe-by-probe transcript, the OWASP ASI 2026 and MITRE ATLAS v5.4.0 technique tags, the CSA Agentic-RT category mapping, and the SOC 2 / ISO 27001 control cross-walk. The bundle is regenerable on demand for each tenant, which removes the SaaS vendor from the position of being the manual broker of trust evidence.
- —Signed PDF for procurement and CISO review
- —SARIF feed for the customer's vulnerability management tool
- —Probe transcripts for the customer's red team to reproduce
- —Standards cross-walk: OWASP ASI 2026, MITRE ATLAS, CSA, AIVSS
- —Re-issue per tenant without re-running an internal pen-test cycle
Tenant-resident scans, no cross-tenant data flow.
A SaaS vendor cannot ship probe transcripts from one customer's tenant into a shared cloud bucket. AgentGuardian's execution model treats each tenant as an isolated scan boundary.
What the trust posture looks like in practice.
Anchored on the shape of conversations a Chief Trust Officer holds with enterprise customers during procurement and renewal cycles.
The pen-test attestation question takes six weeks.
A Fortune 500 customer's security team asks: "Has your agent surface been independently red-teamed against OWASP ASI 2026 and MITRE ATLAS techniques? Can we see the scope, the methodology, and the score?" The vendor coordinates a manual pen-test, redacts findings, drafts a summary letter, and ships a custom PDF that the customer's GRC team then has to back-fit into their control matrix.
The evidence pack ships with the trust portal.
The same question lands. The trust portal returns an evidence pack: AIVSS score, OWASP ASI 2026 + MITRE ATLAS v5.4.0 + CSA Agentic-RT category mapping, full probe transcript, signed manifest. The customer's vulnerability management tool ingests the SARIF feed directly. Renewal accelerates because the artefact is regenerable per release, not per RFP cycle.
The deliverable that used to gate the customer's security review becomes the artefact attached to every release tag.
The frameworks your customers will cite.
Enterprise SaaS vendors sit at the intersection of their own controls and their customers' obligations. AgentGuardian findings cross-walk to the frameworks that show up in procurement questionnaires and audit walkthroughs.
AIVSS is the score. OWASP ASI 2026, MITRE ATLAS v5.4.0, and CSA Agentic-RT are the cross-walk. SOC 2 and ISO 42001 are the customer's audit question.
Ship the evidence pack with
the next copilot release.
Run AgentGuardian against a single tenant. Receive an AIVSS-scored evidence pack mapped to OWASP ASI 2026, MITRE ATLAS v5.4.0, and CSA Agentic-RT. Compare it to what your customer's red team would produce.