The New Cybersecurity Team Never Sleeps
Traditional security software waits for a signal, creates an alert, and asks a human team to investigate.
Project Perception is designed to go further. Microsoft says it continuously collects signals across identities, devices, applications, data, cloud infrastructure, and AI systems. Specialized agents then reason over that context and decide what matters.
The system organizes those agents into three teams:
- Red team agents search for possible paths an attacker could use.
- Blue team agents investigate the evidence and decide which risks are real.
- Green team agents take corrective action and improve the defenses.
That creates a closed loop: discover, evaluate, fix, learn, repeat.
No coffee breaks. No shift changes. No waiting until Monday morning.
More Than 100 Agents Hunting the Same Bug
The first major use case is software vulnerability management.
Microsoft’s MDASH system deploys more than 100 AI agents to inspect software for exploitable weaknesses. Instead of looking only for suspicious lines of code, the agents reason about data flow, business logic, and the chains of actions an attacker might combine into a real exploit.
Microsoft says MDASH, paired with its specialized MAI-Cyber-1-Flash model, achieved 96% on CyberGym, 12 percentage points above Mythos, while cutting costs by almost 50% compared with the existing MDASH configuration.
Those are Microsoft’s own benchmark claims, so independent real-world validation will matter. But the direction is difficult to ignore: AI security systems are moving from “tell me what happened” to “find the opening before someone uses it.”
Why This Is Happening Now
Attackers already use AI to write convincing phishing messages, generate malware variants, scan targets, and scale campaigns. The cost of launching an attack keeps falling.
Human defenders face the opposite problem. They have too many alerts, too many tools, and too little time.
The answer is not another dashboard.
It is autonomous defense that can operate at the same speed as autonomous offense.
Project Perception also uses multiple models instead of betting everything on one giant model. A fast specialized model can handle routine cyber tasks, while a more capable frontier model can be reserved for difficult reasoning. That matters because a security system must run continuously, and a brilliant agent that is too slow or expensive to keep online is not much of a defense.
The Part Microsoft Is Being Careful About
Giving AI the power to change security settings is useful. It is also dangerous.
A false positive could block legitimate work. A compromised agent could become a new attack path. An automated fix could break a production system faster than a human team can understand what happened.
Microsoft says humans remain in control and that the system inherits its existing governance, compliance, and security controls. The real test will be how much authority companies give these agents, and how clearly every automated decision can be audited.
The winning systems will not be the ones with the most autonomy. They will be the ones that know when to act, when to ask, and how to prove what they did.
What This Means for You
You probably will not deploy 100 security agents tomorrow.
But the pattern is bigger than cybersecurity:
- Break a complex job into specialized roles.
- Give every agent the same trusted context.
- Let them challenge and verify one another.
- Keep a human approval layer around high-impact actions.
- Measure outcomes, not how many messages the agents produce.
That blueprint can apply to research, customer support, finance, operations, and almost any workflow where one general-purpose assistant is not enough.
The next phase of AI will not be one super-agent doing everything.
It will be teams of agents working together, and the first serious battles are already beginning in cybersecurity.
---
Source: Microsoft’s official announcements on Project Perception and Microsoft Build 2026. Performance figures are vendor-reported.
The NEXAIUM Team
You follow the future. We decode it.