Microsoft on Monday unveiled its first custom-built cybersecurity model and a broader agentic defense platform, positioning the launch as part of an enterprise AI strategy focused on using smaller, cheaper models for most work while routing harder tasks to more powerful systems.

The company announced MAI-Cyber-1-Flash, a compact security model developed internally by its Microsoft AI (MAI) division. The model is embedded inside MDASH, Microsoft’s multi-agent harness for detecting and fixing software vulnerabilities. Microsoft says the combined system scores 96% on CyberGym, a benchmark that measures how well AI systems reason across large codebases to identify real vulnerabilities. The company said the result beats frontier models including Mythos, Gemini, and GPT, while reducing costs by roughly half compared with Microsoft’s current production configuration.

Microsoft also introduced Project Perception, an agentic security system built to coordinate several types of defensive agents: “red team” agents that search for possible paths to compromise, “blue team” agents that investigate and triage risks, and “green team” agents that remediate issues and harden defenses. Project Perception is scheduled to enter public preview on August 3, making the preview an early test of whether Microsoft can translate its model-and-harness approach into workflows security teams can evaluate outside the company.

In an exclusive interview with VentureBeat, Microsoft AI CEO Mustafa Suleyman said the announcement represents the start of a longer effort.

“We really do have a pretty significant data and harness and expertise moat, and that is enabling us to train models which are faster, better, cheaper, and I think this is genuinely the tip of the iceberg,” Suleyman said. “We haven't been working on this for long. The next model is going to be pretty phenomenal.”

Microsoft’s 90/10 architecture still uses OpenAI’s GPT-5.4

One of the most notable technical details is how Microsoft deploys MAI-Cyber-1-Flash rather than the model alone. The company designed MAI-Cyber-1-Flash to handle up to 90% of security tasks efficiently. MDASH then escalates the remaining 10% of especially difficult problems to a larger frontier model, OpenAI’s GPT-5.4. That means Microsoft’s flagship security AI system continues to rely on its longtime partner and increasingly visible competitor for the most demanding work.

Suleyman said the key component is the harness, an orchestration layer that routes each incoming problem to the model best suited to solve it. “The harness is like a router,” he told VentureBeat. “It's kind of like guardrails and a rule set of an organizing logic, which matches queries to... incoming problems to a model that suits the problem.”

He described the system as having three parts: the harness, the smaller and faster MAI-Cyber-1-Flash model that handles most queries, and GPT-5.4 operating alongside it as “just a generalist coding model.”

Asked how a system that depends on OpenAI’s model can outperform frontier competitors, Suleyman said the performance comes from the complete system rather than from any single model. “These are very complicated, long, agentic loops which require storing state, drawing on another database, consulting best practice... handing back to a small model, writing a bunch of code, validating that that was correct,” he said. “There's like hundreds of steps to solve that, and that's why it's really the system together that delivers the better performance.”

Suleyman said the choice of GPT-5.4 for escalation was also driven by cost. “GPT-5.6 is expensive. GPT-5.4 is incredibly good relative to its cost,” he said. “The whole game here is to reduce the costs. Mythos and so on are extremely expensive models... we want to be able to deliver better performance for cheaper. That's what customers want.”

The structure reflects Microsoft’s changing relationship with OpenAI. Microsoft remains a customer and partner in an arrangement that drew regulatory scrutiny in Brussels and Washington in 2024, while also moving to control more of the AI stack where it believes it has durable advantages. It also shows how Microsoft is separating model ownership from system ownership: even where it uses a partner model, it is emphasizing the routing, guardrails, and security-specific workflow around that model.

Token costs have become a major enterprise AI constraint

Microsoft says the new configuration delivers roughly 50% cost savings compared with the existing MDASH setup, which uses a blend of GPT-5.4, 5.4 mini, and 5.3 codex. In cybersecurity, where systems run continuously and process very large volumes of signals, token costs accumulate quickly. Microsoft argues that those costs have become a central constraint for defenders.

Suleyman connected the cost problem to the physical limits of computing infrastructure. “The key barrier to adoption is access to chips, and cost is a function of chips,” he said. “No matter how much money you've got, there's actually a limited supply of chips. Then trying to squeeze more model output on fewer chips is clearly super valuable.”

He also said enterprises are pushing back against the price of frontier models. Companies initially used the most capable models available, he said, but “then they realize they're sort of paying... a phenomenal amount of money, and people are absolutely token maxing everywhere across their business. So there's a massive pushback to reduce cost everywhere.”

Microsoft is positioning its approach alongside a broader trend toward cost-efficient, near-frontier AI models. Over the past year, such systems have appeared in releases including xAI’s recent Grok model and a wave of Chinese models built around similar cost-performance assumptions. Suleyman said Microsoft’s position as a platform company aligns it with enterprise cost pressures. “The top model providers want you to use the most expensive model continuously, whereas because we are a platform, we're on the side of the enterprise,” he said. “There's no point asking... Mythos what the capital of France is.”

Microsoft cites a 100-trillion-signal security data advantage

Microsoft’s cybersecurity argument also rests on the scale of its security telemetry. The company says it processes more than 100 trillion security signals every day, a figure consistent with its 2025 Digital Defense Report. That report also cited 4.5 million new malware files blocked and 5 billion emails screened per day. Microsoft says it draws operational insight from 1.6 million customers.

“We have trillions and trillions of data points going back decades,” Suleyman said. “It is, I think, the largest longitudinal cybersecurity dataset around,” partly because Microsoft serves governments “who have been consistently attacked for years, and we have been consistently attacked.”

Asked whether that creates an advantage competitors cannot match, Suleyman said: “That is definitely a moat for us. Both the data and the expertise, and just the experience in the institution of going through that process.”

Microsoft’s strategic claim is that cybersecurity can function as a live reinforcement-learning loop. Defenders take action, outcomes are observed, and models can improve. The company argues that connecting actions with outcomes — including what was exploited, contained, or blocked — provides training signals that pure model labs cannot simply buy or manufacture.

The benchmark claims also come with caveats. The CyberGym results are based on Microsoft’s own evaluation, and the detailed figure behind the headline 96% score is 95.95%. Vendor-run benchmarks that compare a tuned agentic system with competitors’ base models are not controlled model-versus-model tests. Microsoft has measured a full harness-plus-models configuration against what customers might otherwise assemble, which may be commercially relevant but is not a direct comparison of standalone models.

Microsoft says access will be gated because of dual-use risks

A model designed to find difficult vulnerabilities in complex codebases could also be useful to attackers seeking vulnerabilities. Microsoft’s own threat intelligence team, in joint research with OpenAI published in February 2024, documented nation-state actors from Russia, North Korea, Iran, and China probing large language models for reconnaissance, scripting, and vulnerability research. Microsoft’s 2025 Digital Defense Report also warned that AI agents could eventually automate the full attack lifecycle.

Suleyman said Microsoft will restrict access accordingly. “We're very strict about who gets access to the model, and we're very careful about that,” he said. “We constantly monitor the API and usage.” An approved user, he added, “has to be seen to be having good intent, but also have technical competence.”

He said the rollout will proceed in stages: “It's not going to be thousands next week. There will be tens, and then hundreds, and then thousands.”

Microsoft says MAI-Cyber-1-Flash was evaluated by its AI Red Team, tested through automated and expert-led adversarial exercises, and independently assessed by a third party. The company said deployment protections include tenant isolation, auditing, and sandboxed execution environments without internet access.

Suleyman also acknowledged Microsoft’s position relative to the newest frontier systems, framing its approach around caution and reliability. “Even though we might be a few months behind the absolute cutting edge at any given moment... it matters that we're doing it very carefully and thoughtfully, and we have a track record of doing that,” he said.

That emphasis follows a difficult security year for Microsoft in 2024, including its decision to delay the Recall feature over privacy concerns and its role in convening an industry summit after the CrowdStrike outage disabled about 8.5 million Windows devices.

Suleyman outlines Microsoft AI’s broader roadmap

Suleyman said MAI’s roadmap is accelerating roughly nine months after Microsoft established its superintelligence team. “We have the compute that we need. We certainly have the data we need. We have the talent,” he said. “Our momentum is accelerating rapidly.”

He said a leading enterprise request is for “agents that can produce arbitrary code to solve whatever problem they direct them at,” as vibe-coded internal tools move from experiments into production. The next phase, he said, will bring voice, transcription, image, and coding models “all integrated into the same harness.”

Suleyman also questioned the industry assumption that AI will converge into a single large unified model. “It remains to be seen whether one giant model that is fully multimodal is actually able to deliver additional transfer learning benefit because of the integration,” he said, “or whether it's just a big lumbering expensive giant.”

That view underpins Microsoft’s announcement. The company is arguing that enterprise AI competition is shifting from individual models to complete systems: routers, specialized small models, frontier-model fallback options, and proprietary data loops. In cybersecurity, Microsoft says its control of both security telemetry and defensive products strengthens that approach. Whether the same strategy applies in areas where Microsoft’s data advantage is smaller remains an open question for the MAI roadmap.

For now, Microsoft is presenting MAI-Cyber-1-Flash, MDASH, and Project Perception as a preview of how it intends to compete in the next phase of AI: not by relying only on the largest model, but by building a system around models that can route tasks efficiently. As Suleyman said, the company views this as “the tip of the iceberg.”