Microsoft Launches Project Perception to Counter Cyber Threats

Microsoft Launches Project Perception to Counter Cyber Threats

Microsoft has just unveiled Project Perception, an AI system capable of conducting attack simulations, investigations, detection, and remediation. It notably relies on MDASH and a new specialized model, MAI-Cyber-1-Flash.

Microsoft no longer wants to limit artificial intelligence to a supportive role for analysts. With Perception, the company presents a comprehensive agent-based security architecture designed to automate much of the work done in Security Operations Centers (SoC). Expected to enter public preview on August 3, 2026, the platform will coordinate several specialized AI agents, allowing them to work from a shared understanding of the environment to be protected and to chain tasks currently distributed among various cybersecurity roles.

Agents That Attack to Better Defend

Perception is structured around three families of agents, each responsible for a different stage of the response to cyber threats:

• Red teams: They adopt the attackers' perspective, seeking paths to compromise, identifying exposed services, and verifying whether detected vulnerabilities can be exploited.

• Blue teams: They handle defense, investigate collected signals, assess the threat, and decide on the appropriate response. They can also generate detection rules tailored to the observed attack.

• Green teams: Their role is to fix identified vulnerabilities and strengthen the environment. They can modify firewall rules, close ports, enhance authorization controls, or prepare patches in the code.

These agents do not work in isolation. Perception integrates them into a continuous loop, from attack simulation to remediation, based on a shared security context. Each team can thus leverage the results of the previous one, preventing analysts, pentesters, and developers from having to restart the work with each handoff.

The platform uses playbooks, predefined procedures that organize the various steps of responding to a threat. Teams can launch one of these scenarios or directly formulate their request in natural language. For example, they can ask whether their organization is protected against a recently identified malicious group, then let Perception select the agents to mobilize and the actions to chain.

MDASH Separates Theoretical Vulnerabilities from Exploitable Risks

Part of this work relies on MDASH, Microsoft's agent-based system dedicated to software vulnerabilities. Unveiled in May 2026 and integrated into Microsoft Defender, it analyzes code repositories, searches for vulnerabilities, and checks their exploitability.

MDASH aims to prevent security teams from facing dozens or even hundreds of potential vulnerabilities without knowing which ones to prioritize. Its results can then be used by other agents in Perception to contextualize the risk within the company's environment and determine the necessary actions.

For each vulnerability, the system details its impact and reconstructs the attack path that could lead to it. This information is valuable for security teams but could also serve as a manual if it falls into the wrong hands. Microsoft therefore plans to implement precise access rights to control who can initiate analyses, view their results, or manage discovered vulnerabilities.

MDASH also integrates with GitHub and Azure DevOps to help developers fix detected vulnerabilities. It can propose a patch, verify its relevance, and present the changes made before review. The change can then be submitted to the repository in the form of a pull request.

An In-House Model to Reduce the Cost of MDASH

To operate this system at scale, Microsoft integrates MAI-Cyber-1-Flash into MDASH, a model specialized in cybersecurity, designed to handle the majority of common queries.

This model will not work alone. Microsoft plans to assign about 90% of the queries to it, while GPT-5.4 will handle the more complex cases. This distribution aims to engage the most expensive model only when truly necessary.

Microsoft claims that this combination achieves a 96% success rate on CyberGym, a benchmark assessing AI systems' ability to reproduce known vulnerabilities from source code and a description of the flaw. It would also reduce the cost of MDASH by nearly 50% compared to its previous configuration. However, these results are still from the company and are not sufficient to measure the system's performance during searches on real software and unknown vulnerabilities.