Microsoft unveiled MAI-Cyber-1-Flash, its first cybersecurity-specialized AI model, alongside Perception, an agentic security platform deploying red, blue, and green team agents to automate vulnerability detection and remediation. Both tools are slated for preview on November 3.
Microsoft on Monday unveiled its first cybersecurity-specialized AI model and a new agentic security platform at a small event in San Francisco, entering a field already contested by Anthropic, Google, and OpenAI.
The model, called MAI-Cyber-1-Flash, is designed to identify vulnerabilities in complex codebases. It is built to power MDASH, Microsoft's software vulnerability identification and remediation harness, according to the company.
The accompanying platform, dubbed Perception, deploys teams of AI agents to assist with and automate security workflows — including detecting, prioritizing, and remediating software bugs. Perception can also integrate with MDASH.
Microsoft AI CEO Mustafa Suleyman, co-founder of DeepMind, said the new model outperforms several rivals on Cyber Gym, which he described as "the golden benchmark" for AI cybersecurity evaluation.
"We have MAI-1 Cyber Flash binded with GPT 5.4 inside of the MDASH harness — which beats out Gemini, GPT 5.5 Cyber, GPT 5.6 Sol, and Mythos 5 on Cyber Gym, which is the primary benchmark that we all use," Suleyman said. He added that Microsoft is "shipping this into production immediately."
Perception organizes its agents into three functional teams. Red teams simulate potential attacks, providing context about threat actors and likely vulnerabilities. Blue teams focus on detecting and triaging existing bugs. Green teams execute what the company calls "corrective actions" against those vulnerabilities.
Dave Weston, the lead engineer for Perception, framed the platform as a substantial efficiency gain for enterprise security teams. "We've gone from this taking hours and hours of manual work from multiple specialized folks across the security organization — appsec hunters, remediation engineers, you name it — and in minutes, we have a fix for all of this," he said. "Not only do we discover the issues and prioritize them, but we have detection, posture fixing, and even a code fix."
Hayete Gallot, Microsoft's vice president for security, described Perception as a means for enterprise defenders to "defend against AI with AI at the scale and speed that the attackers have" — a framing that reflects the company's broader argument that AI-enabled attacks require AI-enabled defenses.
Microsoft said both tools will be available in preview on November 3.
The launch places Microsoft in direct competition with platforms from rivals that have already staked out positions in AI-assisted cybersecurity. Earlier this year, Anthropic released Mythos, a security platform distributed through a limited partner program called Glasswing. OpenAI launched its own security solution in May through a program called Day Break.
The crowding of the AI cybersecurity market — with major model developers now offering dedicated security tooling alongside or built into their flagship products — signals a broader convergence between frontier AI development and enterprise security infrastructure. Whether benchmark performance translates to real-world defensive efficacy will be a central question as Perception and MAI-Cyber-1-Flash move toward general availability later this year.
Sara Montes de Oca is the Editor in Chief of TechEchelon. Previously a correspondent and producer in Washington, D.C., covering business, finance, and politics.
More from Sara →Federal prosecutors have charged American citizen Sam Tunick for allegedly using a GrapheneOS "duress password" to wipe his phone during a border detention at Atlanta's Hartsfield-Jackson airport in January 2025, testing a rarely invoked statute on destruction of property.
Hugging Face CEO Clem Delangue is demanding that OpenAI release logs from a rogue AI agent that breached Hugging Face's systems and commit $100 million in computing power to help the community build cyber defenses.
A malvertising campaign active since late 2024 is using fake Solana, Luno, and TradingView sites to assemble malware directly inside browser memory, bypassing network-layer detection tools, according to ad security firm Confiant.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.