Microsoft has released its first cybersecurity model built in-house, and the most interesting thing about MAI-Cyber-1-Flash is what it cannot do. Trained to find and patch software flaws, it scores zero across every category of ExploitGym, a test that asks a model to turn a known vulnerability into working attack code. That is by design. Microsoft says the model was taught to defend, not to exploit. A five-billion-active-parameter model that cannot write malware but can drive a discovery pipeline is, the company argues, exactly the tool a defender wants.
The headline claim is a benchmark score: 95.95 percent on CyberGym, a suite of more than 1,500 real vulnerability-reproduction tasks. Microsoft frames that as roughly 12 points ahead of Anthropic's Mythos. But the number belongs to a system, not a model. MAI-Cyber-1-Flash runs inside MDASH, Microsoft's harness of more than 100 specialised agents, and the score reflects MDASH plus the new model plus OpenAI's GPT-5.4 working together. Microsoft's vice president of agentic security put the philosophy plainly: "The model is one input, the system around it is the product."
The economics are the real pitch. The small model is designed to handle up to 90 percent of tasks, escalating only the hardest 10 percent to the more expensive GPT-5.4. Microsoft says that routing cuts costs by about half compared with its previous all-frontier configuration. Microsoft AI chief Mustafa Suleyman was blunt about why his company uses a rival's model for the hard tier: "GPT-5.6 is expensive. GPT-5.4 is incredibly good relative to its cost." He cast Microsoft as siding with enterprises against frontier labs that want customers on the priciest model at all times.
It is worth slowing down on the numbers, because the framing invites a before-and-after reading the data does not quite support. The Hacker News checked CyberGym's public leaderboard on July 28 and found Microsoft's 95.95 percent result was not listed; Wiz's Atlas agent led at 90.9 percent, and Microsoft's own May submission still sat at 88.4 percent. An earlier 96.55 percent Microsoft figure counted any crash, including non-target ones, so it cannot be read as a clean improvement. Microsoft has not disclosed the token use, latency or task mix behind the 50 percent cost claim, which means no outsider can yet reproduce it.
The model is one piece of Project Perception, a broader system entering public preview on August 3 that coordinates red-team agents hunting for weaknesses, blue-team agents triaging them and green-team agents fixing them, with humans still signing off on high-impact actions. Microsoft leans on its scale as the moat: it says it processes more than 100 trillion security signals a day across 1.6 million customers. "That is definitely a moat for us," Suleyman said.
Access is deliberately narrow. Because a strong vulnerability-finder is also a strong vulnerability-finder for attackers, Microsoft is gating the model behind a private preview, rolling out to tens of users, then hundreds, then thousands, with tenant isolation and sandboxed, offline execution. The caution reflects the central tension of defensive AI: the same capability that lets a model close holes faster than human teams could is precisely what makes it dangerous if it leaks. Microsoft's answer is to build a model that can find the door but was never taught to kick it in.