Three teams, one continuous loop
Microsoft is trying to turn a familiar security exercise into a system that never really stops.
Project Perception, announced on Monday, coordinates three kinds of AI agent. Red-team agents look for routes an attacker could use. Blue-team agents investigate what they find and decide which risks matter. Green-team agents make corrections and strengthen the environment.
The idea is a closed loop: find a weakness, judge it, fix it, then keep watching. Microsoft says the public preview will begin on 3 August.
That is more ambitious than an assistant that writes an incident summary or recommends a patch. Perception is meant to connect signals, reasoning and action across identities, endpoints, applications, data, cloud services and AI systems.
The part to watch is the last one. Finding and explaining a problem is useful. Changing a live system is where an agent becomes operational, and where a small mistake can travel.
The first job is software vulnerability management
Microsoft is starting with a narrower workflow rather than opening every control at once.
The first announced use is software vulnerability management inside MDASH, Microsoft's multi-agent system for finding, validating and remediating flaws. Microsoft says MDASH uses more than 100 agents and is already deployed by large companies.
A new compact model called MAI-Cyber-1-Flash is intended to handle up to 90% of the work. Larger models are reserved for the difficult remainder. That routing is central to Microsoft's pitch: use the expensive model only when the task earns it.
The company says verified defenders will get access to the model through MDASH rather than as an unrestricted standalone release. It also lists role-based controls, tenant isolation, encryption, audit logs and sandboxed execution without internet access.
Those controls make the shape of the product clearer. They do not yet tell a security team which corrective actions can run automatically, which need approval or how a bad recommendation is rolled back.
The benchmark result comes from Microsoft
Microsoft reports that MDASH with MAI-Cyber-1-Flash and GPT-5.4 scored 96% on CyberGym, a benchmark built around finding real vulnerabilities in large codebases.
The company says that is 12 percentage points above Mythos. It also reports a 50% cost saving against its current MDASH mix of GPT-5.4, GPT-5.4 mini and GPT-5.3 Codex.
Those are specific, useful numbers. They are also company results. Microsoft has not published a customer study showing how the same system performs across ordinary enterprise code, noisy alerts and production constraints.
Its announcement says the cyber model was independently assessed by a third party, but the assessor, method and detailed findings are not named on the public page.
A benchmark can test whether a system finds a known class of flaw. It does not fully capture false alarms, unusual environments, patch quality or the cost of investigating an agent that sounds certain and is wrong.
Human control needs a more concrete definition
Microsoft says people remain firmly in control. That is the right promise, but it needs a product-level meaning.
A useful preview would show where approval is mandatory, what context an operator sees before accepting a change and how the system behaves when several agents disagree. It would also show whether customers can set different limits for a test environment and a production service.
The architecture adds another question. Perception can route work across frontier models and specialised cyber models. That may improve cost and accuracy, but it also means teams need a clear record of which model made which judgement.
For security leaders, the audit trail may matter as much as the answer. A patch applied at machine speed still has to survive a post-incident review, a regulator and the engineer on call.
None of those details are impossible. They are simply not public yet.
What is confirmed, claimed and still open
Confirmed: Project Perception is a Microsoft security system built around red, blue and green agent roles. The first workflow uses MDASH for vulnerability management, and the public preview is scheduled for 3 August.
Microsoft's claims: its new model mix reaches 96% on CyberGym, costs half as much as its current configuration and can move from finding a flaw to addressing it in real time. These figures have not been independently reproduced in a public report.
Still open: pricing, eligibility for the preview, measured false-positive and false-negative rates, customer outcomes and the exact list of actions the system can take without a person approving them.
Project Perception matters because it joins several steps that security teams usually keep separate. That can shorten the gap between discovery and repair. It can also compress the time available to notice a wrong decision.
The preview should make that trade-off easier to judge. Until then, this is a credible product direction with promising internal numbers, not proof that autonomous security has been solved.
Sources
- Microsoft — Rethinking security for the age of AIPrimary announcement published 27 July 2026. Source for Project Perception's agent roles, architecture, first workflow, preview date and Microsoft-reported benchmark and cost figures.
- Microsoft AI — Introducing MAI-Cyber-1-Flash inside MDASHPrimary model announcement. Source for the model-routing design, MDASH agent count, reported evaluation, deployment controls and limits on access.
- Microsoft AI — MAI-Cyber-1-Flash model pagePrimary product page used to verify availability through MDASH, the verified-defender restriction and the stated role of the compact model.
