Microsoft introduces Project Perception for agentic cyber defence

On 27 July 2026, Microsoft introduced Project Perception, an agentic security system intended to collect signals continuously, assess risk and initiate protective action. A public preview is scheduled for 3 August, with software vulnerability management as the first scenario.

The notable part of the announcement is the move from separate AI assistants to a closed loop of discovery, evaluation and remediation. Microsoft also says that security professionals remain in control. For an enterprise customer, that does not remove established security processes; it adds an automation layer above asset inventory, telemetry, change management and incident response.

How the proposed model works

Project Perception coordinates three classes of specialist agent:

• red-team agents identify potential paths to compromise before an attacker can exploit them;
• blue-team agents correlate signals with context and determine which events represent meaningful risk;
• green-team agents perform corrective actions and strengthen the environment.

Beneath them is a new Cyber Stack comprising signals and sensors, shared security context, multiple models, a harness that coordinates the agents and actuators that translate decisions into protection. The objective is to avoid sending every raw log to a model. Instead, the system provides a connected representation of assets, identities, dependencies and risks.

That approach is reasonable in a large environment. The same vulnerability has a very different priority on an isolated test server and on an internet-facing node connected to a critical system. Without context, an agent can only rank alerts. With context, it can explain a risk path and propose an ordered response.

What is known about the first scenario

Microsoft identifies software vulnerability management as the initial use case. The MAI-Cyber-1-Flash specialist model is added to MDASH, its multi-model team of agents. The company reports a 96% score on CyberGym, a 12-percentage-point lead over Mythos and nearly 50% lower cost than the current MDASH configuration.

These are vendor-reported results from a particular benchmark. They do not establish equivalent performance in a customer’s environment, where outcomes depend on the asset estate, telemetry quality, prioritisation rules and permitted level of autonomy. A pilot using representative internal data is required before production use.

Why “human in control” needs precise rules

Human control is a principle, not a permission model. An enterprise deployment must decide in advance which actions are allowed:

1. An agent may collect context and prepare a risk explanation automatically.
2. Low-risk, reversible operations may run under an approved policy.
3. Changes to network access, identities and production systems require approval.
4. Every automated step retains its inputs, model decision, tool invocation and outcome.
5. An incorrect change has a tested rollback procedure.

Otherwise, faster response can become faster propagation of an error. Permission design and action verification are covered in our guide to secure AI-agent architecture, while the minimum-trust model is explained in Zero Trust architecture.

What to measure in a pilot

Project Perception is entering preview, so a sensible pilot should begin with observation and recommendations rather than autonomous changes. It should measure:

• completeness of the asset and identity inventory;
• the share of alerts for which the agent assembled valid context;
• prioritisation accuracy compared with analyst decisions;
• time from signal to a verified recommendation;
• unsafe or incorrect proposed actions;
• cost per confirmed risk processed;
• export of a complete event trail to the enterprise SIEM;
• behaviour when a model, sensor or actuator API is unavailable.

The test set should include incomplete inventories, conflicting signals, stale asset data and attempts to inject instructions through external content. Ordinary cases demonstrate throughput; edge cases reveal whether the control system is genuinely robust.

What this changes for enterprise security

The announcement points to a broader market shift. The value of AI in cyber defence is moving from summarising alerts towards coordinating specialist agents and executing governed actions. The foundations, however, remain the same: reliable data, segmentation, least privilege, observability and clear accountability.

Organisations do not need to wait for fully autonomous protection. They can already document their assets, telemetry sources, decision classes and operations that may be delegated. Any agentic security platform can then be judged against measurable requirements rather than the number of polished demonstrations.

Source: Official Microsoft Blog; the original URL is provided in the article metadata.