Microsoft (MSFT ) has announced Project Perception, an agentic security system that turns three classes of AI agents loose on a customer’s own environment, alongside MAI-Cyber-1-Flash, the first security model the company has trained in house. Public preview opens on August 3, 2026.
The case Microsoft is making is about price. Hayete Gallot, who rejoined the company as executive vice president of security in February 2026, set out the argument for what Microsoft calls a new Cyber Stack: defense has to run continuously, and continuous defense has to be affordable. Pointing a frontier model at every security task does not clear that bar, particularly as the cost of finding and exploiting a flaw keeps falling.
MAI-Cyber-1-Flash is the answer to that constraint. The model is small, tuned heavily on code, and descended from Microsoft’s MAI-Thinking-1 line. It sits inside MDASH, the harness of more than 100 agents Microsoft uses to find and fix software vulnerabilities, and is built to absorb up to 90% of the work there, escalating only the hardest tenth of tasks to OpenAI’s GPT-5.4.
Half the cost for the same benchmark score
Microsoft reports that MDASH running MAI-Cyber-1-Flash with GPT-5.4 scores 96% on CyberGym, which it places 12 points above Anthropic’s Mythos, and that the pairing runs at roughly half the cost of the configuration Microsoft ships today.
The score itself is not the change. At Build 2026 on June 2, 2026, Microsoft reported 96.55% for MDASH as the harness entered expanded preview. Three weeks earlier it had reported 88.45%, when the same system surfaced 16 vulnerabilities in the Windows networking and authentication stack, four of them critical remote-code-execution flaws, that Microsoft fixed in that month’s patch cycle. The capability curve has been flat since early June. The cost curve is what moved.
That distinction is the whole product. CyberGym is a UC Berkeley benchmark of 1,507 real vulnerabilities across 188 open-source projects, drawn from Google’s OSS-Fuzz corpus; an agent gets a codebase and a bug description and has to write an input that reproduces the crash. When Dawn Song’s group published it in June 2025, the strongest agent-and-model pairings they measured cleared about 20%. Saturating a benchmark that hard in thirteen months settles the capability question. What it leaves open for buyers is whether they can run that capability against their whole estate, every day, without the token bill deciding the scope of their scanning for them.
The Mythos comparison carries an asymmetry worth naming: Anthropic withheld that model from general release and distributes it to vetted defensive partners through Project Glasswing. Microsoft is selling the alternative as something an enterprise can simply buy. Nvidia (NVDA ) made a third argument on the same day, launching an alliance built around open-weight defensive models and shared tooling.
Red, blue and green agents
Perception divides the work into three roles. Red agents map routes an attacker could take. Blue agents work the resulting signals and decide what represents genuine risk. Green agents apply corrections and harden what they touch. Output passes between them without a human handoff at each stage, while Microsoft says high-impact actions stay under human sign-off.
Beneath the agents sits the layer that determines whether the economics work: a shared security context. Microsoft maintains a continuously updated picture of an organization’s assets, identities, relationships and activity, so agents begin from that map instead of rebuilding it out of raw telemetry on every run. The company frames this as an accuracy gain and a compute saving, which on an always-on system are the same problem.
Microsoft says the model was calibrated with a security-first bias, evaluated by its AI Red Team through automated and expert-led adversarial testing, and reviewed by an outside assessor. MDASH customers get tenant isolation, role-based access controls, audit logging, and sandboxed execution environments with no internet access.
What ships in preview
Perception arrives inside Microsoft Defender first and extends across the rest of Microsoft Security over time. Pricing is consumption-based and metered in Security Compute Units, with heavier agent tasks drawing more of them, so scanning breadth becomes a budget line rather than a licensing tier. Microsoft draws a clear line between Perception and Security Copilot, its chat assistant: one acts, the other assists.
Software vulnerability management is the first workflow MAI-Cyber-1-Flash handles. Microsoft says Perception will route more of its security workflows through the model as the preview widens, which is where the economics of AI-driven vulnerability discovery get tested against real customer estates rather than benchmark tasks.