Microsoft has introduced a security system designed to do more than answer questions about threats. Project Perception is meant to connect signals from across an organization, reason about them with multiple AI agents, and pass approved actions into existing security tools.
The product enters public preview on August 3. Its first practical use is vulnerability management, where Microsoft is combining a new specialist model called MAI-Cyber-1-Flash with MDASH, the company’s existing system of more than 100 agents for finding, confirming and fixing software flaws.
The interesting part is not simply that another cybersecurity model exists. It is how Microsoft divides the work. The smaller specialist model handles up to 90 percent of tasks. The hardest 10 percent are escalated to GPT-5.4, a larger and more expensive model. That routing strategy could make continuous security analysis more affordable without asking one model to be equally good at every problem.
The announcement is easier to understand when its products are separated.
MAI-Cyber-1-Flash is the model. Microsoft says it is compact, optimized for code-heavy security work and derived from its MAI-Thinking-1 model.
MDASH is the operational harness around the model. A harness is the software that gives an AI model tools, assigns jobs, checks results and coordinates other agents. In this case, MDASH can use different models and specialized agents to reproduce a vulnerability, inspect a codebase and propose a repair.
Project Perception is the broader system. It brings together security signals, organizational context, models, agents and actions. Microsoft describes red-team agents that search for attack paths, blue-team agents that investigate risk and green-team agents that help remediate problems. It is intended to work across the company’s security products, including systems that manage identities, endpoints and sensitive data.
That distinction matters because the headline performance figure belongs to the configured MDASH system. It is not a score for MAI-Cyber acting alone.
Microsoft reports that MDASH with MAI-Cyber-1-Flash and selective GPT-5.4 escalation scored 95.95 percent on CyberGym. CyberGym is a benchmark built from 1,507 known vulnerabilities in 188 open-source projects. The task is not merely to describe a flaw. A system must inspect the relevant software and produce evidence that it can reproduce the vulnerability.
The company says the result is about 12 percentage points above the next system it compared and that the new configuration costs almost 50 percent less than its current MDASH setup. Those two claims point to the product’s practical proposition. A security team may be able to run more checks if routine work goes to a fast specialist and only ambiguous cases consume frontier-model capacity.
This is a familiar engineering pattern. Customer support systems route difficult cases to senior staff. Cloud platforms send different workloads to different processors. Project Perception applies the same logic to AI reasoning, with the added complication that errors can affect production systems.
Microsoft says the system includes role-based access, tenant isolation, encryption, audit records and sandboxed execution without internet access. These controls matter more than the model’s conversational fluency. A security agent needs permission boundaries, a record of what it did and a safe environment in which to test potentially harmful code.
The 95.95 percent result is substantial, but it remains a vendor-reported benchmark. Independent coverage noted that it had not appeared on CyberGym’s public leaderboard at the time of publication. Microsoft says the model was red-teamed and assessed by third parties, but it has not published enough detail for outsiders to reproduce every part of the system result.
CyberGym also tests known vulnerabilities in open-source projects. That is useful evidence for software analysis, but it does not establish how well Project Perception will handle a novel attack, a poorly documented internal application or a noisy corporate network. It says even less about whether an automatically proposed fix will preserve business logic.
The preview will therefore be a test of operations as much as intelligence. Buyers should ask which actions require human approval, how false positives are measured, what evidence accompanies each recommendation, and whether the system can explain why it escalated a case to the larger model. Pricing, regional availability and the exact set of supported integrations also remain unclear in the public announcement.
The immediate audience is enterprise application-security and security-operations teams, especially organizations already using Microsoft’s identity, endpoint and cloud-security products. The system is not being presented as a standalone model for general developers. Its value depends on the surrounding data, permissions, integrations and review process.
For those teams, the useful question is not whether AI can find vulnerabilities. Several tools already attempt that. It is whether model routing can deliver reliable findings at a cost low enough for frequent use, while keeping every proposed action governed and reviewable.
Project Perception offers a concrete architecture for that tradeoff. The public preview will show whether the controls and evidence are strong enough to turn an impressive lab score into a dependable workplace tool.