How Microsoft uses agents and AI to cut cybersecurity costs

It has been trained and optimised for a narrower scope: analysing complex software and identifying vulnerabilities that are difficult to spot.

Put simply, a standard language model has been through a vast library. MAI-Cyber-1-Flash has spent far more time in the section containing technical manuals, incident reports, patches, exploits and code analyses.

Microsoft claims to be able to draw on decades of experience in security, as well as **100,000 billion signals a day** from identities, devices, networks, the cloud and applications, together with operational insights generated by **1.6 million customers**. It is this wealth of data, rather than the model’s architecture alone, that constitutes the competitive advantage claimed by the company.

However, the model is not left to roam freely through corporate systems with a digital crowbar. It is integrated into MDASH, Microsoft’s multi-agent infrastructure for identifying, validating and rectifying vulnerabilities.

The process can be described in four steps.

The first is context analysis. The system examines the source code, software dependencies, application configuration and the relationships between the various components. A vulnerability, in fact, rarely stands alone. It is more like a crack in a bridge: it becomes dangerous depending on its location, the load it is under and any other nearby cracks.

The second step is the investigation. Various agents put forward hypotheses about possible flaws: memory management errors, incomplete authorisation checks, unfiltered inputs, weak configurations or unexpected combinations of components.

The third step is verification. The system attempts to determine whether the vulnerability can actually be exploited. This is the crucial moment, because traditional security scanners often produce long lists of potential issues. Many of these are false positives – a bit like an alarm that goes off even when the cat walks past.

The fourth step is correction. Agents can suggest a patch, check that it does not break other functions, and prepare the necessary information for the developers.

MDASH coordinates more than 100 agents and uses different models. MAI-Cyber-1-Flash is expected to handle up to 90 per cent of the tasks. For the remaining 10 per cent of the most complex issues, a larger model is deployed, currently configured as GPT-5.4.

It’s a bit like how an A&E department works. Routine cases are dealt with quickly. The consultant is called in when the X-ray starts to look like a Picasso painting.

Cybersecurity is an ongoing process. Every line of code analysed, every hypothesis tested and every agent activated consumes tokens and computing power.

Always using the largest model would be like delivering every parcel by helicopter. It works, but the cost quickly becomes a concern for the finance director.

According to Microsoft, the combination of MAI-Cyber-1-Flash and GPT-5.4 within MDASH achieves around 96 per cent on CyberGym, a benchmark that measures the ability to detect vulnerabilities in large codebases. The reported result is around 12 points higher than Mythos, representing a saving of nearly 50 per cent compared with the previous MDASH configuration, which was based on GPT-5.4, GPT-5.4 mini and GPT-5.3 Codex.

A side note written in thick marker is needed here. The 96 per cent figure refers to the entire system, not MAI-Cyber-1-Flash on its own. The engine utilises the Microsoft model, GPT-5.4, the agents, the tools and the orchestration provided by MDASH.

It is therefore a comparison of complete cars, not just of engines.

Furthermore, the data is published by Microsoft. It is significant, but in order to establish a definitive record, independent assessments and comparisons carried out using the same tools, computing budgets and access to the code will be required.

The key development is the shift from a chatbot that suggests a fix to a system that monitors the infrastructure, simulates attacks, assesses the risk, selects the appropriate model and proposes or applies a countermeasure. The battle for AI-based cybersecurity is therefore shifting. The first phase was: who has the most intelligent model? The second will be: who is best at linking models, data, tools, permissions and procedures?

Microsoft has a clear head start in the final stretch