The time between discovering a vulnerability and applying a fix still depends heavily on human judgment and verification. While attackers use AI to accelerate reconnaissance and exploit development, defenders' response speed has failed to keep pace—a structural gap that remains unchanged. On July 27, 2026, Microsoft announced a move to address this gap: its own in-house cybersecurity AI, "MAI-Cyber-1-Flash," along with the autonomous defense system built around it, "Project Perception." The company states that its proprietary model handles roughly 90% of vulnerability-response processing, while the remaining 10%—the most difficult tasks—continue to be routed to OpenAI's GPT-5.4. The reality, then, looks less like a declaration of independence and more like a hybrid architecture optimized to the last dollar for cost efficiency.
What Exactly Is MAI-Cyber-1-Flash?
MAI-Cyber-1-Flash is Microsoft's first in-house AI model built specifically for cybersecurity. Derived from the company's general-purpose "MAI-Thinking-1" model lineage, it adopts a lightweight design specialized for identifying vulnerabilities and generating remediation code. It was unveiled at a launch event held in San Francisco on July 27 and integrated as the core engine of "MDASH," Microsoft's vulnerability identification and remediation platform.
MDASH itself is not new. Microsoft first announced MDASH on May 12, 2026, as a vulnerability-scanning platform combining multiple models and agents. At that time, it recorded a score of 88.45% on CyberGym, a benchmark measuring AI models' ability to discover and fix vulnerabilities, and it uncovered 16 previously unknown Windows vulnerabilities (including four critical remote code execution flaws), most of which were patched in that month's Patch Tuesday. The July announcement is thus an update that swaps the core model of this existing platform from a general-purpose frontier model to a proprietary, low-cost model—not an entirely new project.
MAI-Cyber-1-Flash is also planned to be made available standalone via Azure AI Foundry, though it will be subject to customer vetting. This policy of not unconditionally releasing high-misuse-risk models to the public mirrors moves by Google and Anthropic, discussed below.
How Red, Blue, and Green Divide the Work of Autonomous Response
Project Perception is an autonomous defense system in which three types of agents divide responsibilities. Red探索s threat pathways within a network from an attacker's perspective, identifying exploitable weaknesses. Blue investigates the risks these findings pose and determines response priorities. Green actually creates the remediation patches and handles deployment.
Hayete Gallot (EVP, Microsoft Security) explained that security requires a new cyber stack capable of continuously sensing, reasoning, and acting. David Weston (CVP, Enterprise & OS Security) likewise noted that expanding agent autonomy requires building trust incrementally, and the system is designed so that high-impact operations—such as isolating a device or cutting off access—require human approval. The division of labor among the three agents for reconnaissance, judgment, and execution is intended to preserve this caution while running the entire defense cycle at machine speed.
Project Perception will begin a public preview on August 3, 2026, with initial integration into Microsoft Defender. It will be available to organizations worldwide and includes the capability to autonomously isolate devices and cut off network access. Designed to handle everything from detection to remediation in one continuous flow, it marks a shift from the "AI that suggests" model that Security Copilot has represented, to an "AI that acts."
The "Breaking Free from OpenAI" Narrative vs. the Reality of a Hybrid Design
While MAI-Cyber-1-Flash handles roughly 90% of processing within MDASH, the remaining 10%—the most difficult tasks—continues to be routed to OpenAI's GPT-5.4. This is not a full replacement of vulnerability response with an in-house model. Rather, it is a selective architecture that internalizes only routine processing while leaving the hardest judgment calls to an external model.
Microsoft Security Copilot has historically operated on an architecture dependent on the Azure OpenAI Service's foundation model layer. This MDASH overhaul does not eliminate that dependency structure. It is instead a design change that shifts only the routine tasks—which make up the bulk of processing volume—to the in-house model, thereby reducing the number of costly frontier-model calls. CEO Satya Nadella posted on X (formerly Twitter): "MAI-Cyber-1-Flash is our first cybersecurity model, and combined with MDASH, it achieves world-class performance at 50% of the cost of leading models." This statement effectively acknowledges that the focus is on cost rather than performance.
Security Copilot's current pricing is $4 per hour per SCU (Security Compute Unit) within the provisioned allotment, rising to $6 for overages. If calls to frontier models can be cut by 90%, the cost basis of this usage-based billing drops accordingly, improving gross margins—and it is Microsoft itself that benefits most from this improved cost structure. Meanwhile, OpenAI retains a technical presence in the security domain, but one now confined to just the 10% of the most difficult tasks.
Products from independent vendors such as CrowdStrike and SentinelOne are, in some enterprises, run alongside Defender. If Defender comes to autonomously handle everything from detection to remediation on its own, Microsoft will effectively be internalizing a portion of the endpoint detection and response (EDR) territory that independent vendors have long occupied, weakening the incentive to pay extra for running both in parallel. Cross-sell opportunities for those vendors would narrow accordingly.
From 88.45% to 95.95%: What the Score Trajectory Reveals About the Cost of Optimization
At the time of the initial announcement on May 12, 2026, MDASH's CyberGym score stood at 88.45%. By Build 2026 on June 3, it was reported to have risen to 96.55%. Yet at the official July 27 announcement, the score was given as 95.95%—a slight retreat from the June peak.
Microsoft states that this 95.95% score exceeds Anthropic's "Mythos" by 12 points. However, the benchmark comparison chart Microsoft published places four competing models, including Mythos, in a range of roughly 83–86%, without clearly identifying which figure corresponds specifically to Mythos alone. It's also impossible to determine from publicly available information whether the 96.55% figure from June reflects performance before the transition to the current hybrid configuration—90% in-house model, 10% GPT-5.4. Still, given that Microsoft announced both a roughly 50% cost reduction and the 95.95% score simultaneously, it's reasonable to infer a trade-off in which cost was compressed while performance was largely preserved.
Project Perception has been announced as being offered under the same SCU (Security Compute Unit)-based usage pricing model as Security Copilot, but the specific consumption rate per agent has not been disclosed as of July 27. For reference, under Security Copilot's existing SCU billing structure, M365 E5/E7 contracts reportedly include 400 SCUs per month for every 1,000 licenses, capped at 10,000 SCUs monthly. How the claimed 50% reduction in operating costs will translate into this billing structure remains a question to be verified once the preview begins on August 3.
The Limited-Release Race Between Google and Anthropic, and Implications for Japanese Enterprises
Google DeepMind announced "Gemini 3.5 Flash Cyber" on July 21, 2026—six days before Microsoft's announcement. The company says it will soon begin a limited pilot rollout for government agencies and trusted partners. It reportedly has already discovered 55 vulnerabilities in the V8 browser engine, surpassing the 47 found by the general-purpose Gemini 3.5 Flash alone and the 36 found by Claude Opus 4.6 (though it is not specified whether all three models were compared under an identical number of trial runs). The concentration of specialized-model announcements within the same week is no coincidence—it is the culmination of a race among the three major players that began when Anthropic unveiled its undisclosed "Mythos" model in April.
Anthropic announced "Mythos" on April 7, 2026, but has not made it publicly available, instead offering it to 12 partner organizations for defensive purposes only under "Project Glasswing." The model has a track record of autonomously discovering and demonstrating a 17-year-old remote code execution vulnerability in FreeBSD. What Google, Anthropic, and Microsoft all share in common is a reluctance to release without restriction cutting-edge models that could also be repurposed for attacks.
Microsoft describes its model as having been "independently evaluated by a third party," but GeekWire reports that the New York Times pointed out that independent testers were not given advance access. The specifics of who conducted the evaluation and by what methodology are not disclosed in the July 27 announcement materials. At present, there is little basis beyond the announcing company's own explanation for judging the credibility of the 95.95% CyberGym figure.
Microsoft has previously disclosed that its security business generates over $20 billion in annual revenue—a figure that, converted at the roughly 40-year-low yen exchange rate of around ¥163 to the dollar (as of July 26, 2026), amounts to approximately ¥3.26 trillion. The July 27 announcement materials cite a customer base of 1.6 million. While the announcement makes no mention of a timeline for Project Perception's rollout in Japan or Japanese-language support as of July 27, given that it is delivered via integration into Defender, Defender customers in Japan should be able to access this autonomous defense capability at a relatively early stage. If the public preview beginning August 3 produces measured data on how much the time from vulnerability discovery to patch deployment is shortened, it will, for the first time, provide numerical evidence of whether this 90%-in-house, 10%-outsourced split was a decision driven primarily by performance or by cost.