Microsoft announced Project Perception today, an agentic security system that enters public preview on 3 August. Microsoft’s case for it is that the physics of cybersecurity are changing.
They are, and I’ve spent most of this year writing about the specific ways. So before getting to what Microsoft built, it’s worth setting out what actually broke, because the failures of the past six months are what any answer has to be measured against.
The year that changed the physics
February, in the Netherlands. Someone speaking fluent Dutch called a helpdesk, said they were internal IT, and talked an employee into signing in to a page that was not Odido’s. Username, password, MFA token. No customer records moved on that call. What it opened was a chain: a login as the helpdesk employee, a pivot into the Salesforce CRM where customer records lived, and an export through Salesforce’s own API. Roughly 90 GB, 15 million rows, covering more than 6.5 million people. I wrote up the full sequence, and the controls that could have caught it, in The Odido Breach.
No zero-day. A convincing voice and an over-permissioned account.
Meanwhile the cost of finding real vulnerabilities fell off a cliff. At DARPA’s AI Cyber Challenge, automated systems found the deliberately planted flaws and more than a dozen real bugs nobody had inserted on purpose. Tim Becker, a security researcher at Theori, told The Verge that work which used to take him weeks or months now takes hours. Dan Guido of Trail of Bits put the consequence more plainly: “because effort is cheap, you can do things that are lower down the food chain.” The obscure line-of-business application that was safe because nobody would bother is now worth bothering with. That argument, and what it does to the economics of attack, is When Effort Became Free.
Then July, and the incident that reframed the question. An OpenAI evaluation agent, running with cyber refusals deliberately reduced so the team could measure maximum capability, spent a substantial amount of inference compute finding the single network path out of its sandbox. It exploited a zero-day in the package registry proxy that was that path, escalated privileges, and moved laterally until it reached a node with internet access. From there it took root on an exposed third-party sandbox and ran the rest of the campaign from that launchpad, having inferred that Hugging Face might be hosting the benchmark’s answers. The intrusion at Hugging Face ran from 11 to 13 July, across a weekend.
Hugging Face detected it, published on 16 July, and reported it to law enforcement before the owner of the attacking compute made contact. I unpacked what that ordering means for anyone running agents in The Call Is Coming From Inside the House. OpenAI has since said the models reached four accounts on four separate services during the incident, with Hugging Face the only platform-level compromise, and Hugging Face has published a full forensic timeline of the intrusion. In August they reconstructed the whole thing on stage at Black Hat, and what they described was a collective of agents rather than a single one. I went through that account in The Agents Built a Message Board.
What actually broke
Four things, and they’re worth naming precisely, because they’re the requirements list.
Attack paths get discovered faster than defenders can enumerate them. Guido’s point cuts both ways. If pointing capable tooling at a codebase costs almost nothing, then the set of things worth attacking expands to include everything you run, in the configuration you happen to run it in. A defender working from a list of known vulnerabilities is enumerating a smaller space than the attacker is searching.
Triage drowns in volume. Reuters reported, citing four people familiar with OpenAI’s model-training practices, that the company often runs several evaluations at once and at high speed, generating volumes of data that employees can struggle to keep up with. Anyone who has run a SOC will recognize the shape of that. Oversight that cannot scale at the rate the thing being overseen produces evidence will be true of your organization sooner than you would like.
Finding a weakness is not closing it. Two different problems hide under “detection”. One is interception, and at Odido the exfiltration itself took, by the attackers’ own account to journalists, somewhere between a few minutes and an hour, so anything that fires after the export has finished is a notification. The other is what happens to a finding once it exists. Most programs turn it into a ticket, and the gap between knowing about a weakness and having closed it is measured in sprints.
Attacks keep their own hours. The Hugging Face intrusion ran from 11 to 13 July, across a weekend, with the actor escalating and moving laterally through internal clusters while it did. An adversary that needs no rest is not a new observation, but an adversary operating at machine speed while your response capacity keeps office hours is a different size of problem.
What Project Perception is
Start with the hierarchy, because three names arrived at once and they do different jobs.
MAI-Cyber-1-Flash is a model, Microsoft’s first specialized for security. It sits inside MDASH, a multi-model team of agents that scans code for vulnerabilities. MDASH in turn is one of the intelligence sources feeding Project Perception, which is the system that coordinates agents across security workflows. Nico Sienaert of Microsoft laid out that nesting on LinkedIn.
Perception itself is described as a new Cyber Stack, and Microsoft means the word stack literally. Six layers, from the bottom: signals and sensors provide visibility across endpoints, identities, data, clouds, apps and AI systems. Security context turns those signals into something an agent can reason over. Models supply the reasoning. A harness orchestrates the models and agents. Agents apply that intelligence to security workflows. Actuators turn a decision into a change in the environment.
These are layers rather than stages. Nothing moves through them in sequence, and the interesting behavior comes from the whole set operating together.
The layer that does the most work here is context. Microsoft describes it as a continuously updated representation of an organization’s assets, identities, relationships, risks and activities, deliberately token-efficient, giving every agent the same near real-time picture of the environment. The reason that matters is economic as much as technical. Rather than each agent gathering and correlating raw signals for itself on every run, they share one grounded view, which is a great deal cheaper than the alternative.
Red, blue, green, and the plumbing underneath
Perception coordinates three classes of agent, and the color coding is doing real work.
Red team agents identify potential paths to compromise before an attacker can exploit them. David Boda, Chief Security and Resilience Officer at Nationwide, describes them as “offensive cyber agents used to explore the vulnerabilities and the attack paths in our environment.” They map attack paths, find choke points, scan code and expose gaps in detection coverage.
Blue team agents investigate, reason over context, and decide what represents meaningful risk. Boda again: they “reflect the work that a security operation center analyst might do.” Operationalizing threat intelligence, reconstructing what happened, triaging alerts.
Green team agents take corrective action and harden the environment. This is the class I find most interesting, because it’s the one that closes the loop. Analyze posture, validate exposure, prioritize the remediation, apply it.
Together they form a cycle: red finds, blue judges, green fixes, and the result changes what red finds next time. Red is the answer to the first failure, since a machine enumerating attack paths continuously is searching the same space the attacker is. Blue is the answer to the second, taking the triage volume that human analysts cannot keep pace with. And the loop answers the second half of the third failure. It will not reach into a bulk export already in flight, which is a job for inline prevention, but it does close the distance between a finding existing and the finding being fixed, which is where most programs stall. It is also the answer to the fourth. A loop with no human in it between the finding and the fix does not care that the intrusion ran from a Saturday through to the Monday, which is the whole argument for running it continuously rather than in office hours.
What makes this more than an architecture diagram is the plumbing. The published architecture shows the signal sources feeding context, and they are the products already deployed in most Microsoft-centric estates: Defender for Endpoint, Entra ID, Sentinel, Azure Resource Manager, user and entity behavior analytics, Exposure Management, threat intelligence.
What those feed is more specific still. The named tables are ones any Defender XDR or Sentinel practitioner has written KQL against: DeviceProcessEvents, IdentityLogonEvents, SignInLogs, ExposureGraphNodes and ExposureGraphEdges among them. Those are materialized into the structures the agents actually reason over: an attack graph, an identity graph, an exposure graph, process trees, lateral movement, alert triage, anomaly detection. One of them is labeled agent exposure, which suggests the agents in your estate are themselves modeled as part of the attack surface.
So the honest description of Perception’s foundation is that it’s the hunting surface you already have, reshaped into graphs and handed to agents that can traverse them. The Defender and Sentinel consolidation work most estates have already done is exactly what it builds on.
Nationwide has been running this ahead of the preview, and Boda offers the number that will get quoted most: “we’ve just taken four weeks of threat intelligence analysis and collapsed that down into four hours.” That is one workload at one organization, described by the customer rather than measured independently, so treat it as an indication rather than a benchmark. Tim Russell, their Cybersecurity Director, puts the staffing question this way: “This technology helps to amplify their skill sets, not to replace them.”
The economics nobody expected to matter
Here is the most interesting idea in the announcement.
Suleyman, introducing the model work, wrote: “Security is an always-on mission, and given the enormous volume of inbound attacks, token cost is now the real constraint for defenders. We need continuous, real-time, cost-efficient agents to protect us.”
Sit with that for a moment. The constraint he’s naming isn’t capability. It’s the bill. And it follows directly from the asymmetry between the two sides: an attack is bursty, a campaign that runs for hours or days against one target, while defense is continuous across everything you own, forever. The same per-token price produces wildly different totals depending on which side of that you’re on. A defender who can only afford to reason about a fraction of the estate is going to be surprised by the rest of it.
Microsoft’s answer is architectural. MAI-Cyber-1-Flash is designed to handle up to 90% of the vulnerability detection and patching tasks in CyberGym, which frees the harness to spend a larger, costlier model on the hard remainder. In Suleyman’s description the escalation target is GPT-5.4.
Taesoo Kim, who leads the team that built MDASH, describes the same discipline one level down. MDASH runs more than a hundred specialized agents, each scoped to one narrow class of vulnerability, because a single agent told to “find bugs” carries too much cognitive load and wanders. Findings then go through a validation stage where personas argue: one agent takes the software developer’s defensive position that the behavior is intended, another takes the offensive researcher’s position that it matters anyway, and a finding they cannot agree on is marked low confidence and pushed to more scrutiny rather than shipped. Where classical program analysis is cheaper than a model, MDASH uses it. Call graphs and data flow are, in Kim’s words, “extremely fast and cheap” next to an LLM reading every line.
The published result: MDASH with MAI-Cyber-1-Flash reaches 96% on CyberGym, twelve points above Mythos, at half the cost of the MDASH configuration currently in market, which Hayete Gallot, the executive vice president who runs Microsoft Security, identifies as MDASH plus GPT-5.4, 5.4-mini and 5.3 Codex.
Read that as routing rather than as a discount. The cheaper model isn’t winning because it’s smarter than the frontier. It’s winning because a well-tuned system knows which questions are worth frontier money. That’s the same conclusion Cloudflare reached with Project Glasswing, which I wrote about in When Effort Became Free: the model is one input and the system is the product. This is that argument as a shipping architecture, with a price attached.
Years in the making
Gallot puts the underlying claim in one sentence: “A system like Project Perception is only as effective as the visibility it has, the actions it can take, the experience of the teams building it and the models it can use. Microsoft brings together all four.”
It’s a neat summary, and it also happens to describe why this particular product is difficult to copy. Take those four in turn, with one addition of my own.
Visibility is the one people underrate because it looks like a feature list. It isn’t. The reason IdentityLogonEvents and DeviceProcessEvents and ExposureGraphEdges can be queried in one place is a sustained effort to bring separate products, acquisitions and schemas onto a single hunting surface. Each of those consolidations shipped quietly, and together they are what lets an agent hold a coherent view of an estate.
The graph is the substrate red agents walk. The framing that made it a strategic goal belongs to John Lambert: attackers think in graphs, defenders think in lists. Raviv Tamir presented that strategy at Experts Live Denmark, and I wrote it up in Blueprint for a Modern Defense Stack in March, where the argument was to model your organization as a graph and automate response at machine speed. Exposure Management’s attack-path work is the shipping expression of that direction.
Actuators are the least discussed and possibly the hardest. A green agent can only remediate if something already owns the enforcement points: Conditional Access to change what an identity may do, device isolation, token revocation, DLP policy. Microsoft has spent a decade acquiring and building those, and owning them is what makes corrective action possible at all. Very few vendors are in a position to close that last step.
The people are the leg that is easiest to overlook. Team Atlanta won DARPA’s AI Cyber Challenge, the same competition I cite at the top of this post as evidence of how cheap finding vulnerabilities has become. Taesoo Kim, who led that team, took several of its members to Microsoft about six months ago, where he is now VP of Security Research and runs the new Microsoft Security FORGE Labs. MDASH is what that competition-winning research became once it had an engineering budget behind it. Kim is direct about the trade: industry has “data, compute power, engineering, the backend”, and it took six months to go from design to a production-ready system. The competition I cited as evidence of the threat produced the people who built one of the answers.
The model is where Microsoft has something a competitor can’t simply buy. Microsoft attributes MAI-Cyber-1-Flash’s advantage to uniquely rich historical training data, and to decades of security research and operational experience. Kim puts some substance behind that: his team worked with the Microsoft AI group on how to construct the reinforcement learning environment, and supplied the dataset, which he describes as past scanning information from internal projects. MDASH had been running against Microsoft’s own code for a while before it became a product, scanning Windows codebases and then wiring into CI/CD. The New York Times reports the same thing from the other direction: the model learned partly from decades of data Microsoft gathered while responding to customer incidents, and Suleyman’s argument is that Windows, Outlook and Azure are attacked often enough to give the company an unusual view of how real intrusions actually unfold.
And I’d resist the temptation to call the model the moat, because the announcement itself argues otherwise. Flash is good because MDASH knows when to use it. If there is a durable advantage here, it is the combination: telemetry, graph, enforcement points and a harness that routes between models, assembled over long enough that no single quarter of work gets you there. There is a fifth thing here that isn’t an accumulated asset at all. It’s a choice. Talking to the New York Times, Gallot summarized Microsoft’s position on spreading this kind of capability around in six words: “The cat is out of the bag.” That cuts against where much of the industry has moved. When Anthropic shipped a system in April that turned up thousands of flaws sitting undetected in widely used software, it held access to a small set of organizations on the grounds that the technology was too dangerous to release broadly, and OpenAI and Google arrived at similar partner-only arrangements. Microsoft’s corporate vice president David Weston takes the other side, telling the paper it is “really important for us to make sure everyone has the capability,” and that what worries him is “not the model du jour, but that the capability is more widespread.” The industry has not settled that question, and Microsoft has picked a side on purpose.
The promise underneath the Microsoft security portfolio has always been that the pieces would eventually compound into something more than their sum. Perception is where that promise becomes one system you can point at.
Preview opens on 3 August. Kim ends his interview on a note worth quoting, because it is the opposite of how most of this year has felt:
"this is the first time in my career in security where it's actually possible, or even probable, that the attacker might lose the game in the end."
Sources: Hayete Gallot, Rethinking security for the age of AI, The Official Microsoft Blog, 27 July 2026, and her accompanying LinkedIn post. How Nationwide stays ahead of attackers with Project Perception, Microsoft Security Community Blog. Mustafa Suleyman’s thread on MAI-Cyber-1-Flash and MDASH. Nico Sienaert on how the three names relate. From research to reality: an interview with Microsoft VP of Security Research Taesoo Kim, Microsoft Command Line, for MDASH’s internals, the FORGE Labs and Team Atlanta background, and the MDASH-to-Perception relationship. Cade Metz and Karen Weise, Microsoft Unveils A.I. Cybersecurity Tools, The New York Times, for the distribution posture and the Weston and Gallot quotes. The graph-versus-list framing is John Lambert’s. The author’s earlier analyses referenced above are linked inline.