Microsoft puts its first cybersecurity model into production as the AI defence race turns on cost
Microsoft has moved its first purpose-built cybersecurity model into production, announcing MAI-Cyber-1-Flash alongside an agentic security system called Project Perception at an event in San Francisco on 27 July. The company said the combined system scored 96% on CyberGym, the benchmark used to test how well AI systems reason across large codebases to find real vulnerabilities, placing it 12 percentage points above Anthropic’s Mythos and delivering a 50% cost saving against Microsoft’s own best existing configuration of GPT-5.4, 5.4 mini and 5.3 codex.
The model runs inside MDASH, Microsoft’s multi-agent vulnerability identification and remediation harness, and has been built to handle up to 90% of security tasks on its own, with OpenAI’s GPT-5.4 held back for the roughly 10% of work the company classifies as exceptionally hard. Project Perception enters public preview on 3 August and coordinates three classes of specialised agents: red team agents that identify routes to compromise before an attacker can use them, blue team agents that investigate and decide what represents meaningful risk, and green team agents that carry out fixes. Hayete Gallot, Executive Vice President for Microsoft Security, introduced the system in San Francisco alongside Mustafa Suleyman, Chief Executive Officer of Microsoft AI.
A new Cyber Stack is Microsoft’s answer to a machine-speed threat model
Writing on the Official Microsoft Blog, Gallot argued that security architectures designed for a world of human actors cannot keep pace with AI, agents and attacks that move at machine speed, and that the industry now requires what she called a new Cyber Stack. That stack, she said, must continuously perceive risk across the entire digital estate, reason across large volumes of context, take action at machine speed, and adapt as environments change around it.
Her post also redefined what a security system should be measured on. “The defining characteristic of the next generation of security systems will not be their ability to generate more alerts,” Gallot said, adding that the measure becomes an ability to “continuously perceive, reason and act.” She set a boundary on the automation as well, noting that “because security is ultimately a human mission, it must amplify defenders” with better insight and stronger ways to act. Project Perception leaves decision authority with security teams while its agents absorb the volume of work, and across the security vendor category autonomy is now being sold to buyers as added capacity for stretched teams.
Token cost has become the binding constraint on continuous defence
In the announcement post accompanying the model, Suleyman and Gallot said that as the cost of finding a flaw collapses, the older security posture of scanning occasionally and patching eventually is “now obsolete.” The argument is economic as much as technical. Attackers equipped with capable models can probe an expanding volume of code cheaply and repeatedly, and defenders who answer that volume with frontier-priced inference will exhaust their budgets long before they exhaust the code that needs inspecting.
The routing architecture follows directly from that calculation, assigning each task to the cheapest model capable of completing it and escalating only where the work genuinely demands a larger system. Gallot made the same point in her blog post, writing that effective defence at scale “requires applying the right model to the right task.” Satya Nadella, Chief Executive Officer of Microsoft, said on X that building the harness, context and action space separately from any single model family is what allows the company to “advance the frontier of cost to outcome.” For enterprise buyers, continuous scanning becomes a consumption line item rather than a capability reserved for the best-funded security teams, and the competitive question in this category becomes whose system can run all day without exhausting a budget.
Specialisation and adversarial debate do work a single large model cannot
MDASH itself began as competition research. Taesoo Kim, Vice President of Security Research at Microsoft and leader of the newly launched Microsoft Security FORGE Labs, joined the company roughly six months ago with members of Team Atlanta, the group that won DARPA’s Artificial Intelligence Cyber Challenge. Kim, who remains a professor at Georgia Tech, told Microsoft’s Command Line publication that his team spent more than 100 billion tokens on a single OpenAI model over the two-year competition, and that the lessons drawn from that spend shaped every design decision that followed at Microsoft.
MDASH now orchestrates more than 100 specialised agents, each given narrow instructions about the single class of vulnerability it should pursue, because a general instruction to find bugs leaves a model spending its context working out what a bug even is. “We can use the right model for the right job,” Kim said, explaining that a general reasoning model still runs continuously behind the specialists and catches more than half of all bugs, though those tend to be the shallower flaws at the weakest points in a repository. Findings then pass into a validation stage where agents built as personas, one taking the position of a defensive software developer and one taking the position of an exploit writer, argue the case until they reach consensus or record their uncertainty. Kim explained that the system goes further by generating a working input that crashes the target program, so that an auditor can reproduce the flaw rather than take a model’s word for it.
Vulnerability discovery is moving out of periodic audits and into the build pipeline
MDASH began as an internal Microsoft project built for the company’s own developers, integrated with the Copilot SDK so that engineers could run it from their laptops. Windows teams found that scanning their codebases through the harness sharply increased the rate at which they discovered high-fidelity vulnerabilities, and the tool has since been wired into CI/CD pipelines and Azure DevOps across much of the company. Kim described the result as automated penetration testing that developers receive against their repository before a release goes out, which places security work inside the development cycle itself, close to the point where the code is written.
Several classes of vulnerability remain out of reach. Kim identified side channels as a persistent difficulty, because reasoning about them requires holding performance characteristics and implementation detail together, and pointed to specification-driven logic errors as a second hard case, since models trained on unstructured input struggle against formal specifications. His team is now working on automated exploit generation, which would allow a system to measure the severity of a finding and test whether a generated patch actually prevents exploitation, and on extending the approach to binaries such as Windows device drivers that carry no source code or symbols.
Independent verification is the question Microsoft has yet to answer
Microsoft said MAI-Cyber-1-Flash was developed with security-first calibration, evaluated by the company’s AI Red Team, tested through automated and expert-led adversarial exercises, and independently assessed by a third party, with enterprise controls including tenant isolation, auditability and sandboxed execution environments without internet access. GeekWire reported, citing The New York Times, that the model was not given to independent testers ahead of release. The two statements are difficult to reconcile, and enterprise buyers evaluating the preview will want the discrepancy explained.
The comparison set complicates matters further. Two of the four systems Microsoft benchmarked against, Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol, are currently restricted to small groups of government-approved customers, which means the strongest rival systems in the category are subject to distribution controls that Microsoft’s offering is not. That restriction is also what prompted a separate announcement on the same day, when NVIDIA convened the Open Secure AI Alliance to build open-source models, harnesses and standards for cybersecurity, with Microsoft among the founding members and contributing MDASH to the effort. OpenAI, Anthropic and Google are absent from the roster.
Microsoft’s own answer to the comparison points to scale, in the form of a reinforcement learning loop running across more than 100 trillion security signals a day and operational insight from 1.6 million customers, which the company presents as the asset competitors cannot replicate once model access itself stops being scarce. Whether that holds depends on evidence the preview period will produce rather than on the benchmark published this week. Kim, for his part, said the underlying shift changes the odds in a way he has not seen before in his career, describing the moment as “the first time where the defender might win this game.”
