Microsoft AI Cybersecurity Project Perception Debuts

Microsoft (MSFT) on July 27 launched Project Perception and MAI‑Cyber‑1‑Flash, expanding its AI cybersecurity offerings with an agentic defense system and a specialized model integrated into Microsoft Defender. The system will enter public preview on August 3, 2026.

Project Perception Integrated Into Defender

Microsoft introduced Project Perception as a new agentic security system that “turns signals into real-time protections using AI to defend against AI.” The company described its architecture as a coordinated workforce of specialized AI agents—red, blue, and green—working alongside purpose-built models such as MAI‑Cyber‑1, estate-wide sensors and actuators, and an orchestration harness. This system is designed to reason, prioritize, and act at machine speed while keeping humans in control of critical decisions.

At launch, Microsoft integrated Project Perception directly into Microsoft Defender. The system continuously discovers and explains vulnerabilities across enterprise source code, cloud infrastructure, endpoints, and AI systems. It supports patching and remediation workflows and coordinates with existing tools by routing findings into dashboards and developer workflows alongside scanning and code-security products.

MAI‑Cyber‑1‑Flash and the MDASH Scanning Harness

MAI‑Cyber‑1‑Flash is Microsoft’s first cybersecurity-specialized AI model, built on the MAI‑Thinking‑1 reasoning backbone and embedded in MDASH, the company’s multi-model, multi-agent scanning harness. Within MDASH, MAI‑Cyber‑1‑Flash handles about 90% of routine vulnerability queries, escalating the most complex cases to a larger model.

Vendor benchmarking cited a roughly 96.0% success rate for MAI‑Cyber‑1‑Flash combined with a larger model inside MDASH. Microsoft executives said this pairing outperformed some competitors on those tests while costing about half as much as other commercial cybersecurity models.

MDASH is used internally across Microsoft products—including Windows, Hyper-V, Azure virtualization, and Active Directory services—to hunt for bugs and vulnerabilities. Early deployments found issues missed by human reviewers, illustrating MDASH’s role in augmenting existing security workflows.

Microsoft reported that vulnerabilities detected by MDASH generated roughly $7.7 million in bug-bounty awards over three months, representing about 66% of its vulnerability discoveries from the prior year. In tests on a Windows networking stack, cross-validation by a large pool of specialized agents delivered better than 90% accuracy in detection.

MDASH operates through continuous scanning with multi-model debate and specialized proof mechanisms to reduce false positives. While the system surfaces candidate issues, engineering teams and the Microsoft Security Response Center retain responsibility for final severity and prioritization. Microsoft is expanding MDASH across Windows, Office, Azure, and standard development pipelines to make AI-based vulnerability scanning a routine part of product development.

Alongside the product launch, Microsoft announced the External Red Team Alliance (EXTRA), which funds AI safety assessments on six continents, and joined the Open Secure AI Alliance, which references MDASH as an available tool for vulnerability detection. The company also introduced prompt-injection protections within Microsoft Defender for Office 365 to detect emails carrying hidden instructions designed to manipulate AI assistants, part of broader AI security updates.

Microsoft framed the launch as a response to a cyberthreat environment requiring defenders to use AI at attacker speed and scale. The combination of agentic orchestration and specialized, cost-efficient models aims to meet growing demand for AI protection and strengthen Microsoft’s position in the enterprise cybersecurity market, placing it in more direct competition with other major AI providers.

"It turns signals into real-time protections using AI to defend against AI," Microsoft said in its official blog.