Building on Microsoft’s extensive threat intelligence, security telemetry, and knowledge of customer environments, Project Perception’s specialized red, blue, and green team agents execute specialized playbooks to evaluate and update your security posture.
Microsoft announced a new AI-powered service that enables enterprise security teams to continuously evaluate and update their organization’s security posture through a series of AI agents that can find vulnerabilities, simulate attacks, detect and triage potential threats, and develop remediations.
Dubbed Project Perception, the new service will enter public preview on Aug. 3, and takes a multi-model approach, where the underlying harness decides which AI model is best suited to solve a particular task. This aims to strike a balance between quality and cost, as not all operations require the latest frontier model to complete successfully.
The company also unveiled its own AI model dubbed MAI-Cyber-1-Flash that was trained specifically to find vulnerabilities in complex codebases. When used within MDASH, Microsoft’s multi-model harness for vulnerability research, a combination of MAI-Cyber-1-Flash and GPT 5.4 achieved a considerably higher score on the CyberGym benchmark than Anthropic’s Mythos 5 and OpenAI GPT 5.6-Sol and it did so for nearly half the cost.
MDASH, previously announced in May, was built by a new Microsoft internal team called FORGE (Frontier Offensive Research & Generative Exploration) that’s led by Georgia Tech professor Taesoo Kim and consists of many of his current and former PhD students. Several of the Microsoft Security FORGE members were previous members of Team Atlanta, which won the DARPA AI Cyber Challenge (AIxCC), a two-year competition for developing autonomous AI systems capable of securing critical open-source software.
A team of specialized agents
Project Perception combines Microsoft’s extensive threat intelligence, security telemetry, and knowledge about customer environments to create a complex security graph. This knowledge is then leveraged by a series of specialized agents — red team, blue team, and green team — that execute specialized playbooks to achieve the desired tasks.
During its launch event, Microsoft demonstrated a case where a new threat intelligence report comes in about a new threat actor, complete with some indicators of compromise and TTPs. A human security analyst then tasks Perception to investigate whether their organization is protected against this threat group and the system automatically distributes tasks to the needed agents with the corresponding playbooks.
The agents will extract information from the report then perform reconnaissance to map the attacker’s TTPs to the organization’s exposed surface to determine which assets this threat group might target. A penetration testing agent will then be launched to identify potential exploitable vulnerabilities in those assets which will produce a report.
Because the report could contain tens of vulnerabilities of various severities, the agent will then reason to pinpoint the top ones that should be a priority for fixing and even more, the ones that are most likely to be targeted by this threat actor based on its modus operandi.
The information will then be automatically passed to another agent whose role is to generate custom detection rules that will run against collected logs and analytics to detect potential exploitation attempts for those vulnerabilities. A posture remediation agent (green) will also be launched to propose a remediation plan that can include deploying a blocking rule on the web application firewall, to suggesting code fixes and automatic patch submission to the internal repository hosting the code for the vulnerable application.
“We’ve gone from this taking hours and hours of manual work for multiple specialized folks across the security organization — appsec hunters, remediation engineers, you name it — to having a fix for all of this in minutes,” said David Weston, CVP at Microsoft Security and engineering leader for Perception. “Not only have we discovered the issues and prioritized them, but we have detection, posture fixing, and even a code fix.”
The Perception team even created an MCP implementation to enable security analysts who already work in command-line agentic harnesses such as GitHub Copilot or Claude Code to chat with the service directly and initiate playbooks without having to use the web-based interface in the browser.
The harness matters more than the model
What both Project Perception with its multi-model approach and Microsoft’s new MAI-Cyber-1-Flash model proves is that in practice, and especially for cybersecurity, organizations don’t need the latest and greatest frontier model to get great results. In fact, relying only on frontier models might cost too much to make economic sense for most tasks.
That’s because to push the boundaries of machine intelligence, models need to grow bigger and bigger and in general this translates to higher inference costs. Anthropic’s Mythos 5 has 10 trillion parameters and Fable 5 is estimated at around 6 trillion. It’s not known how many parameters OpenAI’s latest GPT 5.6-Sol model has, but Microsoft said that its MAI-Cyber-1-Flash model is around 10 times smaller than GPT 5.4, which is two generations behind 5.6.
Even so, MAI-Cyber-1-Flash is able to handle 90% of the typical cybersecurity tasks in the MDASH harness with GPT 5.4 taking care of the rest that might require heavier reasoning. This combination was able to achieve a 96% completion score on CyberGym, 12 points above Mythos, for around half the cost and this shows that a well-designed and purpose-built harness matters more than the model itself.
A recent study by researchers from the University of Toronto proved the same by creating a self-replicating AI-powered worm that relied on a free open-weight model small enough to run on enterprise-grade GPUs. To achieve this, the researchers built a special harness to guide the model and a database-based memory system to remember important information across different workflows.
Microsoft took the same approach with Project Perception for cost considerations and because not everyone in the world might have access to the latest frontier models. The US government has already issued an export control directive once to Anthropic to restrict the access of non-US nationals to Mythos 5 and Fable 5.
“At Microsoft, we have a security team, and they actually evaluate all the models that you can find out there, and we look at which ones are going to get us the best results,” Hayete Gallot, executive vice president for security at Microsoft, said. “The reason we do that is, number one, is we want the best quality. Number two is we want to make sure that this is affordable. Security is a 24/7 operation, so you need to make sure that this is scaling. And last but not least, the reason why we’re multi-model is that not every model is available everywhere. So we need that diversity of model to make sure that every customer can defend itself. We cannot be in a world of haves and have-nots.”