Microsoft’s Copilot, Agents, and Platform organization is changing how it builds software around agentic coding, but Charles Lamanna’s central message is more conservative than the headlines suggest: AI-generated output is meant to buy engineering time for reliability, performance, security, and product judgment—not simply inflate feature counts.
Lamanna, Microsoft’s executive vice president for Copilot, Agents, and Platform, laid out that position in a recent post on X, as reported by Neowin and subsequently republished in closely matching form by ARY News. The two articles should not be treated as independent confirmation of the operational claims: ARY News follows Neowin’s structure, examples, and framing so closely that it appears to be a rewrite rather than separately sourced reporting.
The important development is nevertheless real and broader than a single executive’s social-media post. Microsoft’s own published material confirms that Lamanna runs an organization spanning Copilot, Power Platform, Dynamics 365, SharePoint, OneDrive, Microsoft 365 services, and agent technologies. His remit gives him unusually direct influence over both the company’s AI products and the engineering practices used to ship them.
For Windows administrators and enterprise developers, the practical takeaway is not that Microsoft has announced a new Copilot SKU or a new Windows feature. It is that the company is treating AI-assisted development as a production-engineering change, with the quality of its updates—and the volume of security fixes customers must absorb—becoming the metric that matters.
Lamanna’s description of the work is familiar to teams already using GitHub Copilot, Claude Code, or other code agents: engineers increasingly direct systems that can draft implementations, refactor code, construct tests, and investigate failures. In that model, the human role shifts upward toward defining constraints, selecting architecture, reviewing changes, and deciding what should be built.
That shift can create real leverage, but it has an inconvenient property: generation is cheaper than verification. Producing a candidate patch, a test suite, or a new feature is no longer necessarily the slow part. Understanding whether a change is correct across supported configurations, dependencies, accessibility paths, tenant settings, hardware, and customer workloads remains hard.
Lamanna’s most consequential claim is therefore not that Microsoft can ship more features. He says his teams are deliberately trying to hold feature volume steady and reinvest available capacity in reliability, performance, and security. That is the right target, particularly for a company whose products sit at the center of large enterprise estates. A faster release train without stronger validation would merely move the bottleneck from development to IT operations.
Microsoft’s recent Windows security disclosures show the company understands that constraint. In July, Windows and Devices chief Pavan Davuluri said Microsoft is expanding AI use in vulnerability discovery, triage, candidate remediation, regression-test selection, and validation. The company says its internal process uses separate scanning and proof stages to filter false positives before findings reach engineers, while human reviewers remain involved in code review and risk decisions.
The distinction is important. A code agent that creates a plausible patch is not a secure update pipeline. Microsoft is publicly committing to use AI within a process that includes proof, testing, rollout controls, customer telemetry, and Known Issue Rollback. The value of the approach will be measured in whether that process catches regressions before broad deployment, rather than in how much code an agent can write.
The published reporting does not identify the exact percentage reduction, the start and end dates, the definition of a “ticket,” the customer segment involved, whether the count refers to support cases or internal engineering bugs, or whether a change in product telemetry and case categorization affected the result. It also does not establish which team or release drove the decline. A chart referenced by Neowin is not clearly labeled as Power Automate-specific.
That omission matters because ticket volume is sensitive to factors beyond product quality. It can fall because a service is more reliable, but also because a support workflow changed, self-service documentation improved, customers moved to another channel, incident classification changed, or usage declined in a specific segment. Without a denominator—such as active tenants, executed flows, monthly users, or support contacts per customer—the result cannot be separated from changes in scale.
Microsoft’s public Power Automate material often presents business cases in terms of automation time saved and workflow-development efficiency. Those are useful measures of customer value, but they do not independently verify Lamanna’s stated ticket reduction. No other outlet located in this reporting has published the underlying Power Automate support data or the metric definition.
The company should publish that context if it intends the figure to demonstrate that agentic development has improved service quality. A vague double-digit improvement is a leadership talking point; an auditable service-quality metric would be evidence.
This creates a direct operational tension. AI can help an engineering group implement a feature more quickly, but it can also uncover flaws at a pace that adds work to the same organization. Microsoft’s answer is to apply automation to the entire chain: scan code, validate candidates, prioritize risk, propose fixes, select likely regression tests, and retain human review where correctness and customer impact are at stake.
The company’s MDASH—its multi-model agentic scanning harness—illustrates why the surrounding process matters more than a single model. Microsoft says the system combines multiple models and specialized agents, then attempts to prove findings rather than simply filing a large number of suspected bugs. In tests against historical Microsoft Security Response Center cases, the company reported high recall for two Windows components, while also acknowledging that retrospective benchmarks cannot predict future discovery rates.
For IT professionals, the outcome is likely to be a continued increase in update volume and a greater premium on disciplined deployment practices. Microsoft itself advises organizations to use the Security Update Guide to map exposure, prioritize high-value assets, test releases, and sequence deployments. The old assumption that a monthly update cycle was a mostly predictable, low-frequency maintenance task is already becoming less reliable.
The risk is not limited to security patches. A development organization that can create more code and more fixes must also decide which changes are ready for release, which need staged rollout, and which should be held back. Lamanna’s emphasis on judgment identifies the true constraint, even if it is less flashy than the claim that engineers can delegate programming work to agents.
For a mature enterprise, that does not mean allowing an autonomous agent to merge production code because it passed a superficial test. It means defining boundaries for what agents may access, which repositories and data they can use, where human approval is mandatory, how generated code is attributed and reviewed, and which quality gates cannot be bypassed for speed.
The governance issue is especially acute for organizations building on Microsoft’s stack. Lamanna’s group oversees products used to create customer agents and business workflows, including Copilot Studio and Power Platform. A company that adopts agentic development while also deploying agentic business automation is expanding both its software delivery surface and the number of systems capable of acting on enterprise data.
Microsoft has framed its own approach around keeping people in the loop for risk decisions and code review. Customers should demand the same discipline from internal teams and systems integrators. The right question is not whether an AI assistant produced an application or a fix; it is whether the organization can prove who reviewed it, what it touched, how it was tested, and how it can be rolled back.
The strongest evidence so far is narrower: Microsoft is putting AI into vulnerability discovery and remediation workflows, and Lamanna says his organization is using the capacity created by coding agents to improve existing software rather than merely build more of it. Those claims align with the company’s published Windows and MSRC strategy, but the business-quality result remains largely unquantified.
For administrators, the consequence is concrete. Expect Microsoft’s engineering systems to find and service more issues faster, while retaining the need to test cumulative updates, stage deployments, monitor known issues, and keep rollback plans ready. AI may reduce the time required to create a fix; it does not remove the operational cost of proving that the fix is safe to deploy.
The important development is nevertheless real and broader than a single executive’s social-media post. Microsoft’s own published material confirms that Lamanna runs an organization spanning Copilot, Power Platform, Dynamics 365, SharePoint, OneDrive, Microsoft 365 services, and agent technologies. His remit gives him unusually direct influence over both the company’s AI products and the engineering practices used to ship them.
For Windows administrators and enterprise developers, the practical takeaway is not that Microsoft has announced a new Copilot SKU or a new Windows feature. It is that the company is treating AI-assisted development as a production-engineering change, with the quality of its updates—and the volume of security fixes customers must absorb—becoming the metric that matters.
Microsoft is moving engineers toward supervision and verification
Lamanna’s description of the work is familiar to teams already using GitHub Copilot, Claude Code, or other code agents: engineers increasingly direct systems that can draft implementations, refactor code, construct tests, and investigate failures. In that model, the human role shifts upward toward defining constraints, selecting architecture, reviewing changes, and deciding what should be built.That shift can create real leverage, but it has an inconvenient property: generation is cheaper than verification. Producing a candidate patch, a test suite, or a new feature is no longer necessarily the slow part. Understanding whether a change is correct across supported configurations, dependencies, accessibility paths, tenant settings, hardware, and customer workloads remains hard.
Lamanna’s most consequential claim is therefore not that Microsoft can ship more features. He says his teams are deliberately trying to hold feature volume steady and reinvest available capacity in reliability, performance, and security. That is the right target, particularly for a company whose products sit at the center of large enterprise estates. A faster release train without stronger validation would merely move the bottleneck from development to IT operations.
Microsoft’s recent Windows security disclosures show the company understands that constraint. In July, Windows and Devices chief Pavan Davuluri said Microsoft is expanding AI use in vulnerability discovery, triage, candidate remediation, regression-test selection, and validation. The company says its internal process uses separate scanning and proof stages to filter false positives before findings reach engineers, while human reviewers remain involved in code review and risk decisions.
The distinction is important. A code agent that creates a plausible patch is not a secure update pipeline. Microsoft is publicly committing to use AI within a process that includes proof, testing, rollout controls, customer telemetry, and Known Issue Rollback. The value of the approach will be measured in whether that process catches regressions before broad deployment, rather than in how much code an agent can write.
The Power Automate ticket claim lacks the numbers needed to judge it
Neowin reports that Lamanna cited a double-digit, year-over-year decline in Power Automate tickets as evidence of improved customer outcomes. It is a potentially meaningful outcome, but Microsoft has not supplied enough context to make it a usable measure of engineering improvement.The published reporting does not identify the exact percentage reduction, the start and end dates, the definition of a “ticket,” the customer segment involved, whether the count refers to support cases or internal engineering bugs, or whether a change in product telemetry and case categorization affected the result. It also does not establish which team or release drove the decline. A chart referenced by Neowin is not clearly labeled as Power Automate-specific.
That omission matters because ticket volume is sensitive to factors beyond product quality. It can fall because a service is more reliable, but also because a support workflow changed, self-service documentation improved, customers moved to another channel, incident classification changed, or usage declined in a specific segment. Without a denominator—such as active tenants, executed flows, monthly users, or support contacts per customer—the result cannot be separated from changes in scale.
Microsoft’s public Power Automate material often presents business cases in terms of automation time saved and workflow-development efficiency. Those are useful measures of customer value, but they do not independently verify Lamanna’s stated ticket reduction. No other outlet located in this reporting has published the underlying Power Automate support data or the metric definition.
The company should publish that context if it intends the figure to demonstrate that agentic development has improved service quality. A vague double-digit improvement is a leadership talking point; an auditable service-quality metric would be evidence.
AI is increasing the security workload Microsoft must carry
The timing of Lamanna’s comments is notable because Microsoft has also acknowledged a different AI effect: vulnerability discovery is accelerating. The company’s MSRC team said in April that recent AI systems can identify software weaknesses more quickly and across a broader surface area than conventional approaches, while Windows leadership said in July that customers should expect a higher volume of fixes in security releases as defenders find more issues.This creates a direct operational tension. AI can help an engineering group implement a feature more quickly, but it can also uncover flaws at a pace that adds work to the same organization. Microsoft’s answer is to apply automation to the entire chain: scan code, validate candidates, prioritize risk, propose fixes, select likely regression tests, and retain human review where correctness and customer impact are at stake.
The company’s MDASH—its multi-model agentic scanning harness—illustrates why the surrounding process matters more than a single model. Microsoft says the system combines multiple models and specialized agents, then attempts to prove findings rather than simply filing a large number of suspected bugs. In tests against historical Microsoft Security Response Center cases, the company reported high recall for two Windows components, while also acknowledging that retrospective benchmarks cannot predict future discovery rates.
For IT professionals, the outcome is likely to be a continued increase in update volume and a greater premium on disciplined deployment practices. Microsoft itself advises organizations to use the Security Update Guide to map exposure, prioritize high-value assets, test releases, and sequence deployments. The old assumption that a monthly update cycle was a mostly predictable, low-frequency maintenance task is already becoming less reliable.
The risk is not limited to security patches. A development organization that can create more code and more fixes must also decide which changes are ready for release, which need staged rollout, and which should be held back. Lamanna’s emphasis on judgment identifies the true constraint, even if it is less flashy than the claim that engineers can delegate programming work to agents.
“Rebuild the workflow” is a governance demand, not a tooling tip
Lamanna argues that teams should not simply add AI to existing processes. Taken literally, that is a call to redesign planning, code review, testing, incident response, and accountability around the fact that machine-generated changes can arrive faster than traditional teams were built to assess them.For a mature enterprise, that does not mean allowing an autonomous agent to merge production code because it passed a superficial test. It means defining boundaries for what agents may access, which repositories and data they can use, where human approval is mandatory, how generated code is attributed and reviewed, and which quality gates cannot be bypassed for speed.
The governance issue is especially acute for organizations building on Microsoft’s stack. Lamanna’s group oversees products used to create customer agents and business workflows, including Copilot Studio and Power Platform. A company that adopts agentic development while also deploying agentic business automation is expanding both its software delivery surface and the number of systems capable of acting on enterprise data.
Microsoft has framed its own approach around keeping people in the loop for risk decisions and code review. Customers should demand the same discipline from internal teams and systems integrators. The right question is not whether an AI assistant produced an application or a fix; it is whether the organization can prove who reviewed it, what it touched, how it was tested, and how it can be rolled back.
What Windows and Microsoft 365 customers should watch next
There is no new customer-facing release attached to Lamanna’s post, no timetable for adoption across Microsoft product groups, and no published baseline showing how much code his organization now delegates to agents. Microsoft also has not said whether its internal practices will become reusable controls or reporting features for GitHub Copilot, Azure DevOps, Copilot Studio, or Power Platform customers.The strongest evidence so far is narrower: Microsoft is putting AI into vulnerability discovery and remediation workflows, and Lamanna says his organization is using the capacity created by coding agents to improve existing software rather than merely build more of it. Those claims align with the company’s published Windows and MSRC strategy, but the business-quality result remains largely unquantified.
For administrators, the consequence is concrete. Expect Microsoft’s engineering systems to find and service more issues faster, while retaining the need to test cumulative updates, stage deployments, monitor known issues, and keep rollback plans ready. AI may reduce the time required to create a fix; it does not remove the operational cost of proving that the fix is safe to deploy.
References
- Primary source: Neowin
Published: 2026-08-06T08:18:01+00:00
Loading…
www.neowin.net - Independent coverage: arynews.tv
Published: 2026-08-06T10:45:14+00:00
- Related coverage: techradar.com
Microsoft introduces its first agent-powered cybersecurity model and Project Perception AI patching system - can it avoid making the same mistakes OpenAI made? | TechRadar
Project Perception looks to use AI for patching needswww.techradar.com - Related coverage: windowscentral.com
Microsoft pays security researchers $20M following AI-backed surge in bug reports | Windows Central
Security researchers earned $20 million finding flaws in Microsoft software, driven partly by the rise of AI tools.www.windowscentral.com - Related coverage: itpro.com
Microsoft forks out record-breaking sums with expanded bug bounty program | IT Pro
Hundreds of security researchers won a share of $20 million after the tech giant expanded its bug hunting scheme.www.itpro.com - Related coverage: blogs.windows.com
Evolving Windows vulnerability management to meet the speed of AI-powered discovery
Windows has adapted to emerging threats for decades, all while operating at unparalleled scale. It's our responsibility to bring clarity, transparency and sustained investment so customers understand what is happening, what Microsoft is doing and howblogs.windows.com - Related coverage: microsoft.com
- Related coverage: microsoft.com
Defense at AI speed: Microsoft’s new multi-model agentic security system tops leading industry benchmark | Microsoft Security Blog
Today Microsoft is announcing a major step forward in AI-powered cyber defense: a new multi-model agentic scanning harness (codenamed MDASH).www.microsoft.com - Related coverage: pcworld.com
Microsoft is now using AI to fix Windows bugs before hackers exploit them | PCWorld
As AI helps hackers find exploits faster, Microsoft says it's now using AI as well. Expect more security fixes in future Windows patches.www.pcworld.com
- Related coverage: axios.com
AI is shrinking the time to patch software vulnerabilities
Organizations now only hours — not days or weeks — to patch affected systems after a vulnerability is discovered..www.axios.com
- Related coverage: techcommunity.microsoft.com
- Related coverage: arstechnica.com
Microsoft unveils AI security tools it says outperform competing platforms - Ars Technica
Microsoft says tools cost less than competing ones and outperform them, too.arstechnica.com - Related coverage: news.microsoft.com
- Related coverage: news.microsoft.com
MORSE security team takes proactive approach to finding bugs - Source
See how the Microsoft Offensive Research Security Engineering (MORSE) team tracks and prevents ransomware attacks.news.microsoft.com - Related coverage: techcommunity.microsoft.com
- Related coverage: marketingassets.microsoft.com
Security-editable-Dial-Chart_92Y
Young female freelancer sitting on a window bench in her apartment while working from home. Beautiful young woman with red hair using laptop for work.marketingassets.microsoft.com
- Related coverage: fortune.com
I lead Microsoft’s enterprise AI agent strategy. Here’s what every company should know about how agents will rewrite work | Fortune
History shows that breakthrough technologies don’t just slot into existing systems, they make us rethink those systems entirely.fortune.com
- Related coverage: learn.microsoft.com
Listen to the WHY of the Power Platform with Charles Lamanna | Microsoft Learn
The Visionary Episode: Join Dona and Sarah as we talk to Charles Lamanna, CVP of low code platforms at Microsoft why exactly he believes in the Power Platform. If you want to know the 'WHY' behind Power Platform, then join us and become part of the conversation! We also have a great RPA demo...learn.microsoft.com - Related coverage: fastcompany.com
- Related coverage: cdn-dynmedia-1.microsoft.com
- Related coverage: theinformation.com
Microsoft Overhauls AI Leadership, Nadella to Take More Direct Oversight of Copilot — The Information
Microsoft is overhauling its executive ranks to give CEO Satya Nadella more direct oversight of engineering teams working on its Copilot chatbots, Nadella said in a memo to staff Tuesday. The reorganization will bring together engineering divisions working on the consumer version of Copilot...www.theinformation.com - Related coverage: gossipherald.com
Microsoft’s Office and LinkedIn chief takes over Teams in latest executive reshuffle
Ryan Roslansky, CEO of LinkedIn at Microsoft, expanded his responsibilities last year as he took charge of Office, and he is now assuming a greater role amid the latest leadership changes at Microsoft. Sources reveal that Microsoft Teams is...www.gossipherald.com - Related coverage: linkedin.com
Charles Lamanna Executive Keynote | Microsoft Customer Success Day | Microsoft Power Platform Community
Check out Charles Lamanna's Executive Keynote from Microsoft Customer Success Day, as he shares exciting news on the latest #BizApps product updates to help customers achieve their business outcomes.www.linkedin.com
- Related coverage: newsroom.workday.com
Workday and Microsoft to Deliver Unified AI Agent Experience for the Enterprise - Sep 16, 2025
PDF documentnewsroom.workday.com
- Related coverage: s205.q4cdn.com
- Related coverage: msrc.microsoft.com
Security Update Guide - Microsoft Security Response Center
msrc.microsoft.com
- Related coverage: service.alaska.edu
Distributed Software Rates
Find the current software recharge rates for distributed and ad-hoc software including Adobe Pro and Creative Cloud; AI Licenses such as Google Gemini and Microsoft Co-Pilot; Microsoft M365 and Micrsoft add-ons including Project Pro, Visio Pro, and PowerAutomate Pro; SPSS; SAS; Salesforce Marketi...service.alaska.edu
- Related coverage: tei.forrester.com
The Total Economic Impact™ Of Microsoft 365 For Business
Cost Savings And Business Benefits Enabled By Microsoft 365 For Business
tei.forrester.com
- Related coverage: msrc.microsoft.com
Blog MSRC | Microsoft Security Response Center
Microsoft Security Response Center Blogmsrc.microsoft.com