Inside Microsoft's AI Security's New Architecture: How MDASH's Multi-Agent System Actually Works

Microsoft calls its current AI security architecture Project Perception, built as six coordinated layers rather than a model bolted onto existing tooling. One of its founding components, a vulnerability discovery system called MDASH, already runs inside Microsoft's own release pipeline. 

This guide goes past the headline architecture and into how it actually works. The reasoning behind each layer, and why the design deliberately avoids relying on one strong model. 

It also covers how MDASH validates its own findings before a human ever sees them, where the current limits genuinely sit, and what any team building agentic tooling can take from it. 

The Six Layers, and Why Each One Exists 

Signals and sensors sit at the bottom, providing visibility across endpoints, identities, data, cloud, apps, and AI systems themselves. Without this layer, everything above it is reasoning over an incomplete picture. 

Context is the layer worth pausing on. Feeding agents raw signals directly is expensive, since every agent would otherwise need to reconstruct the same understanding from scratch. 

A shared, continuously updated context layer, assets, identities, relationships, risk, activity, means agents reason over the same near-real-time picture instead of rebuilding it independently. That single design choice is what keeps compute cost and cross-agent inconsistency manageable at scale. 

Models provide reasoning, deliberately plural rather than singular, for reasons covered below. A harness coordinates those models and agents across workflows, deciding which agent handles which task and how findings flow between them. 

Agents apply that intelligence to specific jobs. Actuators turn agent decisions into actual changes in the environment, rather than another alert for a human to action manually. 

The architecture's real bet is that alert volume was never the bottleneck. Reasoning and acting fast enough was. Every layer here exists to shorten the distance between "something looks wrong" and "something has actually been fixed." 

Why the Design Avoids One Strong Model 

The models layer is deliberately built as a multi-model system rather than standardised on a single one. The reasoning is that no model is optimal for every task once you weigh quality, reliability, latency, and cost together, not raw capability in isolation. 

Microsoft backed that with a purpose-built model, MAI-Cyber-1-Flash, its first specialised cybersecurity model. Full detail on its benchmark performance is worth a separate look. 

The architectural point that matters here is simpler. A smaller, task-specific model beat a general frontier model on this particular job, at meaningfully lower compute cost. 

That changes how a model-selection decision should actually be made. Less "pick the strongest model available," more "match the model to the economics and demands of the specific task." 

For teams designing their own agentic tooling, that's the transferable principle regardless of vendor. Route by task requirements, not by defaulting to whichever model tops a general leaderboard. 

MDASH: How Validation Actually Gets Built Into the Architecture 

The clearest way to see this architecture working is inside MDASH, Microsoft's multi-agent, multi-model system for finding and fixing vulnerabilities before code ships. 

Given a large repository, MDASH doesn't stop at flagging potential issues. It runs a validation stage before anything reaches a human reviewer. 

Rather than trusting one model's first read, it assigns AI personas to argue opposing interpretations of each flagged issue. One argues the defensive case, that it's intended behaviour rather than a genuine flaw. Another argues the offensive case, that it's exploitable and worth fixing. 

Those positions get weighed against each other. Findings that reach consensus move forward with high confidence. Anything without consensus gets marked as lower confidence, and the pipeline spends extra effort validating it before anyone acts on it. It's a voting mechanism built directly into the reasoning process, not a review step added afterwards. 

MDASH also insists on proof rather than plausibility. Most static scanning stops at "there's a potential issue here." MDASH tries to resolve two harder questions: reachability, can an attacker actually get to this code path, and constraint, can the triggering condition actually be created. 

For a PDF parser, that means generating an actual malformed file that crashes the viewer, giving a security team something reproducible rather than a theoretical claim. 

Architecturally, MDASH runs over 100 specialised agents, each scoped narrowly to one class of vulnerability, alongside a single general-purpose reasoning model running continuously in the background. That general model reportedly catches over half of all findings, the relatively shallow, easier-to-spot issues. 

The specialised agents exist specifically to catch what a general model would otherwise miss. Narrow scope keeps each agent's context window uncluttered, which meaningfully improves accuracy compared with asking one model to hold every vulnerability class in mind simultaneously. 

Traditional program analysis techniques, data flow analysis, core graph tooling, aren't replaced here either. They're used wherever they're faster and cheaper than having an LLM read an entire codebase from scratch, with agents deciding when to invoke them rather than defaulting to LLM reasoning for everything. It's a hybrid system by design, not an all-AI one. 

The result runs inside Microsoft's actual CI/CD pipeline via Azure DevOps, scanning code before release rather than sitting as a research demo. 

Where the Architecture Still Genuinely Struggles 

Worth being direct here, since overselling a security architecture is its own kind of risk. Two categories remain genuinely hard, by the development team's own account. 

Side-channel vulnerabilities require reasoning about performance characteristics and runtime behaviour in ways current models aren't well suited to yet. 

Spec-driven vulnerabilities, logical errors tied tightly to a formal specification, sit awkwardly for LLMs trained to handle unstructured input, since correctly balancing rigid formal requirements against loosely structured code remains genuinely unresolved. 

These aren't treated as edge cases internally. They're described as active research directions, alongside work on automating exploit generation to properly assess severity, and extending coverage to binaries without source code or debug symbols, a common situation for things like device drivers. 

One detail worth flagging for anyone designing defensive systems of their own: the same team is actively exploring how obfuscation techniques, traditionally used to prevent human reverse engineering, might also slow down or confuse LLM-powered code analysis. 

That's a genuinely open research question, and one with real implications for how organisations might eventually need to protect their own codebases against AI-powered analysis, not only how they use AI to analyse others'. 

Design Principles Worth Borrowing, Regardless of Scale 

Very few organisations need to replicate MDASH directly. That level of investment makes sense for a platform vendor securing infrastructure at Microsoft's scale, not for most engineering teams. What does transfer is the underlying discipline behind it. 

Don't let a single model's unchallenged output drive a security decision on its own. Scope agents narrowly around specific problem types rather than asking one model to hold everything in context at once. 

Treat validation as part of the architecture from the start, not a review step bolted on for compliance later. Keep proven traditional tooling in the loop wherever it's faster or cheaper than LLM reasoning, rather than replacing everything with AI by default. 

For teams already running Copilot, Copilot Studio, or custom agents inside Microsoft 365, the more immediate application is closer to home: which agents currently exist across your environment, what are they actually scoped to access, and is anyone validating their outputs with anything like the rigour MDASH applies to its own? 

Where Precio Fits 

Building your own MDASH isn't the goal for most organisations, and it shouldn't be. Knowing exactly what your existing Microsoft 365 agents can see, who governs them, and how their outputs actually get validated, is a much more achievable goal. 

That's the goal that matters day to day, and it's where most of the real risk actually sits. 

We work with technical and IT leadership teams to build that governance layer inside Microsoft 365, mapping which agents and Copilot instances exist across an environment, scoping their access properly, and setting up the monitoring and validation processes that keep agentic AI accountable as it scales. 

To talk through what an AI agent governance review would surface in your Microsoft 365 environment, contact our team. 

Frequently Asked Questions