Microsoft unveils MAI-Cyber-1-Flash, promising fast, low-cost vulnerability detection

“Today, we are announcing a series of updates that give customers frontier-grade security at half the cost,” Microsoft’s CEO & Chairman, Satya Nadella, said in a July 27 statement.

“MAI-Cyber-1-Flash is our first cyber security model, built ground up to find the most challenging vulnerabilities in complex code bases. When combined with MDASH, it delivers world-class performance at 50 per cent of the cost of leading models.”

Rather than relying on a single large language model, MDASH uses a multi-model approach, assigning MAI-Cyber-1-Flash to handle around 90 per cent of vulnerability analysis tasks and reserving larger, more computationally expensive models for the most complex cases. Microsoft said this architecture achieved a 96 per cent score on the CyberGym benchmark, outperforming competing models including Mythos, Gemini, and GPT.

Alongside the new model, Microsoft also announced Perception, an agentic security system that uses teams of AI agents to automate security workflows including vulnerability monitoring, patching and remediation.

The company said Perception will increasingly leverage MAI-Cyber-1-Flash across a broader range of security operations beyond software vulnerability management.

Microsoft attributed the platform's performance to three components: a cybersecurity-specific AI model, decades of proprietary security telemetry and a multi-agent orchestration layer refined by security researchers.

VIEW ALL

“We are bringing this capability to market through Project Perception, a complete agentic security offering grounded in real-world signals and security workflows,” Nadella said.

“Teams of specialised agents work together to simulate attacks, detect and triage/investigate, and fix and remediate.”

Microsoft also emphasised the platform's security controls, saying MAI-Cyber-1-Flash was developed using a security-first approach and evaluated through internal red teaming, adversarial testing and independent third-party assessment. Enterprise deployments include role-based access controls, tenant isolation, encryption, audit logging and sandboxed execution environments without internet access.

“This is the benefit of building the harness, context/signals, and action space separate from one model family,” Nadella said.

“By combining specialised models and data with the right agents, tools, security context, and harness, we can advance the frontier of cost to outcome.”