Microsoft has opened public preview of Project Perception on August 3, putting a new multi-agent security system into Microsoft Defender for a limited set of business customers already testing its MDASH vulnerability-analysis harness. The practical change is not a new Defender alert type: Microsoft is attempting to move customers from AI-assisted investigation toward AI systems that can probe code, triage findings and propose or take corrective action under human control.
The launch pairs Project Perception with MAI-Cyber-1-Flash, Microsoft’s first in-house model built specifically for cybersecurity work. As detailed in Microsoft’s July 27 announcement and separately reported by Axios, TechRadar and Directions on Microsoft, the model is not a general-purpose chatbot for security teams. It is an optimized component inside MDASH, Microsoft’s multi-agent vulnerability identification and remediation harness, where it handles routine code-security work and routes especially difficult cases to a larger GPT-5.4 model.
For Windows administrators and security operations teams, the immediate message is more restrained than the branding suggests: Project Perception is a preview-layer extension of work Microsoft had already begun with MDASH, not a broadly available autonomous patching service for every Defender tenant. Microsoft has not published SCU rates, workload limits, supported repository types, agent permissions, or a complete list of Defender and security-product integrations available on day one. Those omissions will decide whether the platform reduces backlogs or simply adds a new consumption meter to the security budget.
Microsoft says MDASH running MAI-Cyber-1-Flash with GPT-5.4 achieved a 95.95% success rate on CyberGym, which the company presents as roughly 12 percentage points ahead of Anthropic’s Mythos result. That number is attention-grabbing, but it belongs to the combined MDASH system—the specialized model, the fallback model, the agent workflow, the tools and the orchestration—not to MAI-Cyber-1-Flash in isolation.
Microsoft’s own description makes that architecture explicit. MAI-Cyber-1-Flash is intended to complete up to 90% of tasks, while GPT-5.4 handles the most difficult 10%. The company says this routing arrangement cuts costs by about 50% versus its prior MDASH configuration. In other words, Microsoft’s main technical bet is that a cheaper specialist model can absorb the bulk of continuous scanning without paying frontier-model prices on every repository or finding.
That is a consequential design decision for enterprise security. Vulnerability discovery becomes expensive when a system must repeatedly read large codebases, validate attack paths, generate proof-of-concept material and re-run checks after changes. A lower-cost model can make continuous scanning financially plausible in a way a single premium model often cannot.
But the 95.95% result should not be read as evidence that Microsoft has solved autonomous remediation. CyberGym’s Level 1 benchmark supplies a vulnerability description and an unpatched codebase, then measures whether an agent can reproduce the already known vulnerability with a working proof of concept. The benchmark contains 1,507 historical vulnerabilities from 188 open-source projects, collected from bugs previously discovered and patched through OSS-Fuzz.
That is a rigorous and valuable test of code reasoning and vulnerability reproduction. It does not measure whether a system will discover an unknown zero-day in a customer’s Windows service, whether it will correctly prioritize an exploitable issue amid thousands of findings, or whether an automatically generated patch is safe to deploy into production.
There is also a public-record gap in Microsoft’s benchmark presentation. CyberGym’s public leaderboard currently lists Microsoft’s MDASH agent at 88.4%, dated May 12, but does not show the newly claimed 95.95% MAI-Cyber-1-Flash-plus-GPT-5.4 result. Microsoft may have run the newer configuration under conditions awaiting publication, but the claimed result is not yet independently inspectable on the benchmark’s leaderboard. Microsoft’s headline is therefore a vendor-reported system result, not a publicly reproduced ranking.
Microsoft calls the system’s action layer “actuators.” The term matters because it describes the line between an AI system that produces advice and one that changes the environment. A red agent finding a reachable flaw is useful. A blue agent connecting that flaw to an internet-facing workload, privileged identity or sensitive data is more useful. A green agent opening a pull request, changing a policy or applying a fix can remove work from a queue—but it can also create an outage or break an application if the controls are poorly designed.
Microsoft says humans will remain in control of critical decisions, and SiliconANGLE reported that high-impact actions require human sign-off. Yet Microsoft has not publicly defined what qualifies as high impact, which actions are approved automatically, or how those approval gates differ across Defender, Azure, endpoint management and source-code workflows.
That is the operational question customers need answered before giving agents access to production tools. “Human in the loop” is not a control model by itself. Administrators will need to know whether an agent may create branches, file tickets, modify configurations, disable identities, block network activity, initiate containment, or deploy code changes—and which of those actions receive an auditable approval record.
Microsoft says Project Perception will begin in Defender and spread across its security products over time. Directions on Microsoft reports that the preview is worldwide for Microsoft business customers already testing MDASH. That limits the immediate audience considerably. A normal Microsoft Defender customer should not assume that Perception has appeared in their tenant merely because the public preview date has arrived.
This pricing structure aligns with the technical reason Microsoft built MAI-Cyber-1-Flash: continuous security analysis requires a predictable cost envelope. It also shifts an important governance problem from licensing to operations. A conventional per-user security license is relatively stable; consumption-based agentic scanning can rise with repository size, scan frequency, complexity, incident volume and the number of escalations to expensive models.
Microsoft has not disclosed numeric SCU pricing, agent-by-agent consumption rates, included capacity, rate limits, or a cost estimator for the new system. It has also not published the conditions behind its “50%” savings claim in enough detail for customers to compare their own workloads. The company says the new configuration is half the cost of its best current MDASH offering, but it has not provided average token volumes, model-routing frequency, codebase size, latency, or task mix.
That is more than a purchasing detail. Security teams are likely to set scanning depth, frequency and agent autonomy according to cost. If a vulnerability-management platform becomes expensive at scale, the first response may be fewer scans, shallower analysis or narrower repository coverage—the opposite of the continuous defense Microsoft is promoting.
Before enabling Perception, preview customers should establish SCU budgets and alerts, identify which source repositories and cloud environments agents may access, and create explicit approval rules for every action that can alter code, identity, endpoint or network state. They should also retain their current vulnerability-management process rather than treating a green-agent recommendation as a production-ready patch.
It does not mean Project Perception will autonomously patch Windows fleets. The public preview is aimed at security workflows, initially through Microsoft Defender, and the available reporting points to code analysis, triage and remediation orchestration. Microsoft has not announced a Perception capability that silently writes or deploys Windows Update packages, changes Group Policy, or remediates arbitrary enterprise software without customer-defined controls.
The more realistic early use is likely to be triage acceleration: identifying reachable weaknesses in code, correlating them with exposed assets and permissions, assembling evidence, and giving analysts proposed remediation steps. That would still be useful. Most organizations do not lack scanners; they lack enough staff time to establish which of the resulting findings can actually be exploited and which change will remove the risk without causing a second problem.
The company has not yet shown the data that matters most to an IT organization making deployment decisions: real customer false-positive rates, patch acceptance rates, remediation rollback rates, SCU costs under sustained use, supported integrations, and the precise scope of agent permissions. Nor has the 95.95% CyberGym result appeared on the benchmark’s public leaderboard.
For now, Project Perception should be treated as a tightly governed preview of an agentic vulnerability-management system, not a reason to retire existing review, testing and change-control processes. Its first meaningful milestone will be whether preview customers can show that it burns down real vulnerability queues faster than it consumes security budget and operator attention.
For Windows administrators and security operations teams, the immediate message is more restrained than the branding suggests: Project Perception is a preview-layer extension of work Microsoft had already begun with MDASH, not a broadly available autonomous patching service for every Defender tenant. Microsoft has not published SCU rates, workload limits, supported repository types, agent permissions, or a complete list of Defender and security-product integrations available on day one. Those omissions will decide whether the platform reduces backlogs or simply adds a new consumption meter to the security budget.
The important claim is a system score, not a model score
Microsoft says MDASH running MAI-Cyber-1-Flash with GPT-5.4 achieved a 95.95% success rate on CyberGym, which the company presents as roughly 12 percentage points ahead of Anthropic’s Mythos result. That number is attention-grabbing, but it belongs to the combined MDASH system—the specialized model, the fallback model, the agent workflow, the tools and the orchestration—not to MAI-Cyber-1-Flash in isolation.Microsoft’s own description makes that architecture explicit. MAI-Cyber-1-Flash is intended to complete up to 90% of tasks, while GPT-5.4 handles the most difficult 10%. The company says this routing arrangement cuts costs by about 50% versus its prior MDASH configuration. In other words, Microsoft’s main technical bet is that a cheaper specialist model can absorb the bulk of continuous scanning without paying frontier-model prices on every repository or finding.
That is a consequential design decision for enterprise security. Vulnerability discovery becomes expensive when a system must repeatedly read large codebases, validate attack paths, generate proof-of-concept material and re-run checks after changes. A lower-cost model can make continuous scanning financially plausible in a way a single premium model often cannot.
But the 95.95% result should not be read as evidence that Microsoft has solved autonomous remediation. CyberGym’s Level 1 benchmark supplies a vulnerability description and an unpatched codebase, then measures whether an agent can reproduce the already known vulnerability with a working proof of concept. The benchmark contains 1,507 historical vulnerabilities from 188 open-source projects, collected from bugs previously discovered and patched through OSS-Fuzz.
That is a rigorous and valuable test of code reasoning and vulnerability reproduction. It does not measure whether a system will discover an unknown zero-day in a customer’s Windows service, whether it will correctly prioritize an exploitable issue amid thousands of findings, or whether an automatically generated patch is safe to deploy into production.
There is also a public-record gap in Microsoft’s benchmark presentation. CyberGym’s public leaderboard currently lists Microsoft’s MDASH agent at 88.4%, dated May 12, but does not show the newly claimed 95.95% MAI-Cyber-1-Flash-plus-GPT-5.4 result. Microsoft may have run the newer configuration under conditions awaiting publication, but the claimed result is not yet independently inspectable on the benchmark’s leaderboard. Microsoft’s headline is therefore a vendor-reported system result, not a publicly reproduced ranking.
Project Perception turns MDASH into an operating model
Project Perception is Microsoft’s effort to put MDASH into a wider security workflow. Its structure follows familiar security-team color roles: red agents look for likely attack paths, blue agents investigate signals and determine which findings actually matter, and green agents carry out corrective actions and strengthen defenses.Microsoft calls the system’s action layer “actuators.” The term matters because it describes the line between an AI system that produces advice and one that changes the environment. A red agent finding a reachable flaw is useful. A blue agent connecting that flaw to an internet-facing workload, privileged identity or sensitive data is more useful. A green agent opening a pull request, changing a policy or applying a fix can remove work from a queue—but it can also create an outage or break an application if the controls are poorly designed.
Microsoft says humans will remain in control of critical decisions, and SiliconANGLE reported that high-impact actions require human sign-off. Yet Microsoft has not publicly defined what qualifies as high impact, which actions are approved automatically, or how those approval gates differ across Defender, Azure, endpoint management and source-code workflows.
That is the operational question customers need answered before giving agents access to production tools. “Human in the loop” is not a control model by itself. Administrators will need to know whether an agent may create branches, file tickets, modify configurations, disable identities, block network activity, initiate containment, or deploy code changes—and which of those actions receive an auditable approval record.
Microsoft says Project Perception will begin in Defender and spread across its security products over time. Directions on Microsoft reports that the preview is worldwide for Microsoft business customers already testing MDASH. That limits the immediate audience considerably. A normal Microsoft Defender customer should not assume that Perception has appeared in their tenant merely because the public preview date has arrived.
Microsoft is selling always-on defense by consumption
The company will charge for Perception using Security Compute Units, or SCUs, the same consumption approach associated with Microsoft Security Copilot. Agents consume SCUs when they run scenarios, with more compute-intensive tasks consuming more units.This pricing structure aligns with the technical reason Microsoft built MAI-Cyber-1-Flash: continuous security analysis requires a predictable cost envelope. It also shifts an important governance problem from licensing to operations. A conventional per-user security license is relatively stable; consumption-based agentic scanning can rise with repository size, scan frequency, complexity, incident volume and the number of escalations to expensive models.
Microsoft has not disclosed numeric SCU pricing, agent-by-agent consumption rates, included capacity, rate limits, or a cost estimator for the new system. It has also not published the conditions behind its “50%” savings claim in enough detail for customers to compare their own workloads. The company says the new configuration is half the cost of its best current MDASH offering, but it has not provided average token volumes, model-routing frequency, codebase size, latency, or task mix.
That is more than a purchasing detail. Security teams are likely to set scanning depth, frequency and agent autonomy according to cost. If a vulnerability-management platform becomes expensive at scale, the first response may be fewer scans, shallower analysis or narrower repository coverage—the opposite of the continuous defense Microsoft is promoting.
Before enabling Perception, preview customers should establish SCU budgets and alerts, identify which source repositories and cloud environments agents may access, and create explicit approval rules for every action that can alter code, identity, endpoint or network state. They should also retain their current vulnerability-management process rather than treating a green-agent recommendation as a production-ready patch.
The Windows connection is real, but it is not a Windows patching feature
MDASH already has a meaningful Microsoft-internal record. Microsoft said the earlier harness found 16 previously unknown flaws in Windows networking and authentication components, including four critical remote-code-execution vulnerabilities that were fixed in May’s Patch Tuesday release. That demonstrates that agentic analysis can surface material issues in complex Windows-adjacent code and gives the project more credibility than a benchmark-only announcement.It does not mean Project Perception will autonomously patch Windows fleets. The public preview is aimed at security workflows, initially through Microsoft Defender, and the available reporting points to code analysis, triage and remediation orchestration. Microsoft has not announced a Perception capability that silently writes or deploys Windows Update packages, changes Group Policy, or remediates arbitrary enterprise software without customer-defined controls.
The more realistic early use is likely to be triage acceleration: identifying reachable weaknesses in code, correlating them with exposed assets and permissions, assembling evidence, and giving analysts proposed remediation steps. That would still be useful. Most organizations do not lack scanners; they lack enough staff time to establish which of the resulting findings can actually be exploited and which change will remove the risk without causing a second problem.
The real test begins outside CyberGym
Microsoft’s announcement amounts to a credible architectural argument: use a smaller cyber-specialized model for the common case, escalate difficult work to a larger model, coordinate specialist agents, and connect validated conclusions to approved actions. The company’s security telemetry, Defender distribution and experience operating MDASH internally give it an advantage that a standalone model vendor cannot easily copy.The company has not yet shown the data that matters most to an IT organization making deployment decisions: real customer false-positive rates, patch acceptance rates, remediation rollback rates, SCU costs under sustained use, supported integrations, and the precise scope of agent permissions. Nor has the 95.95% CyberGym result appeared on the benchmark’s public leaderboard.
For now, Project Perception should be treated as a tightly governed preview of an agentic vulnerability-management system, not a reason to retire existing review, testing and change-control processes. Its first meaningful milestone will be whether preview customers can show that it burns down real vulnerability queues faster than it consumes security budget and operator attention.
References
- Primary source: Cloud Wars
Published: 2026-08-03T14:00:00+00:00
Loading…
cloudwars.com - Related coverage: techradar.com
Loading…
www.techradar.com - Related coverage: itpro.com
Loading…
www.itpro.com - Related coverage: axios.com
Loading…
www.axios.com - Related coverage: ndtvprofit.com
Loading…
www.ndtvprofit.com - Related coverage: europapress.es
Loading…
www.europapress.es - Related coverage: theinformation.com
Loading…
www.theinformation.com - Related coverage: paperswithcode.com
Loading…
paperswithcode.com - Related coverage: microsoft.com
Beyond the benchmark: Advancing security at AI speed | Microsoft Security Blog
Read how Microsoft Security has advanced its agentic vulnerability detection system, codename MDASH, integrating into real-world workflows across Windows, Azure, and identity systems.www.microsoft.com - Related coverage: siliconangle.com
Loading…
siliconangle.com - Related coverage: axios.com
Loading…
www.axios.com - Related coverage: microsoft.ai
- Related coverage: blogs.microsoft.com
Rethinking security for the age of AI - The Official Microsoft Blog
Why security needs a new Cyber Stack — Introducing Project Perception The physics of cybersecurity are changing. Autonomous systems can now reason, adapt and operate continuously. At the same time, the cost of offense is falling, while the volume, velocity and complexity of what must be secured...blogs.microsoft.com - Related coverage: microsoft.ai
- Related coverage: techcommunity.microsoft.com
Loading…
techcommunity.microsoft.com - Related coverage: techcommunity.microsoft.com
Loading…
techcommunity.microsoft.com - Related coverage: cdn-dynmedia-1.microsoft.com
- Related coverage: techriver.com
- Related coverage: cdn-dynmedia-1.microsoft.com
Secure Future Initiative
Cybersecurity Strategy, Secure Engineering, AI Security, Cyber Governance, Cloud Resilience, Secure-by-Design Principlescdn-dynmedia-1.microsoft.com
- Related coverage: download.microsoft.com
- Related coverage: explainx.ai
Loading…
www.explainx.ai - Related coverage: directionsonmicrosoft.com
Loading…
www.directionsonmicrosoft.com - Related coverage: kingy.ai
Loading…
kingy.ai - Related coverage: microsoft.com
Loading…
www.microsoft.com - Related coverage: 01net.it
Loading…
www.01net.it - Related coverage: briefia.fr
Loading…
www.briefia.fr - Related coverage: abijita.com
Loading…
www.abijita.com - Related coverage: annielytics.com
Loading…
www.annielytics.com
