Microsoft Launches Cyber-Specific AI Model and Security Agents

Microsoft has launched a specialized cybersecurity AI model and a platform of autonomous security agents designed to accelerate vulnerability detection and response as organizations face increasingly sophisticated AI-powered attacks.

Why it matters

The cybersecurity industry is entering an arms race where both attackers and defenders are deploying AI models to automate their work. Organizations need tools that can match the speed of AI-driven hacking without requiring proportional increases in security staff or budgets.

Project Perception and security agents

Microsoft introduced Project Perception at a San Francisco event on Monday, unveiling a platform built around specialized AI agents that collaborate to replicate the functions of human security teams. The initial release includes three agents—designated Red, Blue, and Green—that work together to identify software vulnerabilities, assess risk levels, and write and deploy patches.

These agents share security intelligence across the platform, creating an integrated defense system that operates continuously without human intervention for routine tasks.

MAI-Cyber-1-Flash performance benchmarks

The company also revealed MAI-Cyber-1-Flash, its first in-house trained security model. According to David Weston, Microsoft's corporate vice president of AI security, the model handles approximately 95% of the work previously performed by Microsoft's MDASH vulnerability-finding system. More demanding computational tasks are routed to GPT-5.4.

When combined with GPT-5.4, the system achieved a 95.95% score on the CyberGym benchmark, which evaluates a model's ability to generate functional proof-of-concept exploits for known vulnerabilities. Competing models from Anthropic and OpenAI scored around 83% on the same benchmark.

Microsoft will make MAI-Cyber-1-Flash available exclusively through Azure AI Foundry rather than releasing it publicly, using the company's existing customer vetting and GPU provisioning procedures.

Cost optimization through specialization

Weston explained that Microsoft deliberately designed a smaller, specialized model to handle most vulnerability analysis work, reserving larger frontier models only for the most complex tasks. This architecture reduces the cost of scanning large software repositories while maintaining high performance.

Industry context and caution

Microsoft's announcement follows similar cybersecurity AI releases from Google and Cisco in recent days, reflecting an industry-wide push to help defenders keep pace with attackers using AI automation.

However, Weston acknowledged that defenders remain cautious about fully autonomous AI security agents. Microsoft expects organizations to gradually build trust in the technology before granting agents greater independence. "We still have to 'earn the right' to make those systems more autonomous," Weston said.

Microsoft plans to begin public preview of MAI-Cyber-1-Flash next week and will expand Project Perception with additional specialized security agents over time.

These details were first reported by Axios.