Microsoft’s Project Perception opens public preview Aug 3

Microsoft has put a name on the idea of defenders running their own swarm of agents to keep up with attackers who are increasingly running theirs. In a post from Microsoft Security, the company introduced Project Perception, an agentic security system that enters public preview on August 3, structured around three teams. Red team agents look for paths to compromise. Blue team agents reason over context and decide what represents meaningful risk. Green team agents take corrective actions.

The framing worth paying attention to is not the three colours, which is standard SOC vocabulary, but the model choice underneath. Microsoft is not betting a single frontier model can do all of this. Hayete Gallot, Executive Vice President of Microsoft Security, writes that “no single model will be optimal for every security task”, and pairs the multi-agent stack MDASH with a specialised cyber model, MAI-Cyber-1-Flash. The company’s claim is that MDASH running MAI-Cyber-1-Flash delivers 96% on CyberGym, an industry leading benchmark, +12 points above Mythos, at almost 50% of cost savings vs. the current MDASH configuration in market today.

Those are the two numbers a CISO will actually weigh. A vendor-run benchmark score deserves the usual pinch of salt, but the cost line is the more interesting one. If Microsoft can genuinely halve the inference bill of a security-agent stack it already sells, the economics of standing up round-the-clock coverage shift for a lot of customers who cannot afford it today. Perception plugs into the pieces Microsoft already owns: Defender for Endpoint, Entra ID, Sentinel, Azure Resource Manager.

The honest caveat is that the post does not disclose pricing, does not name preview customers, and does not describe the authorisation model for the green-team agents taking corrective actions inside your identity and endpoint stack. “Security teams do not need more information. They need better outcomes,” Gallot writes, which is a good line and also the point at which a careful buyer wants to see the guardrails.

What is worth watching for the next few weeks is not whether Perception ships, it clearly does on August 3, but whether the specialised-cyber-model pattern gets copied. If a purpose-built model like MAI-Cyber-1-Flash beats general-purpose frontier models on real security work at close to half the cost, every rival with a SOC platform now has a template to build against.