Microsoft has introduced Project Perception, a new artificial intelligence-driven cybersecurity platform designed to detect, investigate, and respond to cyber threats with minimal human intervention. The company says the platform marks a significant shift from traditional security tools by enabling AI agents to actively identify vulnerabilities and apply protective measures.
Unlike a standard security assistant or an upgraded version of Microsoft Defender, Project Perception functions as an agentic security system, as Microsoft describes it. It combines AI models, organisational context, and specialised autonomous agents that continuously monitor systems, assess risks, and coordinate responses.
AI Agents Take on Specialised Roles
Project Perception operates through three categories of AI agents, each assigned a specific cybersecurity function.
Red team agents simulate cyberattacks to uncover potential weaknesses and attack paths.
Blue team agents analyse security signals, investigate suspicious activity, and determine which threats require attention.
Green team agents implement fixes, strengthen defences, and help eliminate identified vulnerabilities.
Together, these agents create a continuous security cycle that monitors environments, evaluates whether vulnerabilities can be exploited, and recommends or carries out corrective actions. Microsoft says this approach reduces dependence on traditional alert-based systems that often leave security teams overwhelmed by large volumes of notifications.
Despite the platform’s automation capabilities, Microsoft emphasised that organisations will retain control over security policies, permissions, and governance. Human administrators will continue to define how much authority AI agents have within their environments.
MAI-Cyber-1-Flash Powers the Platform
At the core of Project Perception is MAI-Cyber-1-Flash, Microsoft’s first AI model built specifically for cybersecurity.
The compact model specializes in analyzing software code to detect vulnerabilities across large codebases. It belongs to Microsoft’s MAI-Thinking-1 family and works alongside the company’s MDASH multi-agent vulnerability detection and remediation system.
Microsoft says MAI-Cyber-1-Flash handles around 90% of routine cybersecurity tasks, while more advanced models, including GPT-5.4, address the remaining complex cases.
According to Microsoft’s internal testing, the combination of MDASH, MAI-Cyber-1-Flash, and GPT-5.4 achieved a 95.95% success rate on CyberGym, a benchmark designed to evaluate vulnerability detection in large software projects.
The company claims the system performs roughly 12 percentage points better than the previous benchmark leader, Mythos, while reducing operational costs by approximately 50%. These figures come from Microsoft’s own testing and have yet to be independently verified in real-world enterprise environments.
Project Perception introduces a broader security architecture called Cyber Stack, which consists of six layers: signals and sensors, security context, AI models, orchestration, autonomous agents, and actuators.
One of its key components is the actuator layer, which enables the platform to move beyond identifying security issues. Instead of simply generating alerts, the system can prioritize vulnerabilities, validate their severity, and initiate remediation through integrated Microsoft security products.
The platform gathers data from identities, endpoints, applications, cloud services, and enterprise security tools such as Microsoft Defender, Microsoft Entra ID, and Microsoft Sentinel.
Microsoft says it processes more than 100 trillion security signals every day and supports approximately 1.6 million customers worldwide.
Public Preview Arrives in August
Microsoft plans to launch the public preview of Project Perception on August 3, 2026.
The initial release will focus on software vulnerability management through MDASH, with broader integration across Microsoft’s security portfolio planned for the future.
While questions remain about the level of autonomy AI agents will have in enterprise environments and which actions will require human approval, Microsoft’s latest announcement signals its broader cybersecurity strategy.
Rather than limiting AI to analysing incidents or summarising alerts, the company aims to deploy systems that can continuously monitor threats, make informed decisions, and actively strengthen organisational security.
