The Microsoft corporate logo is illuminated at the Fira Gran Via booth during the Mobile World Congress in Barcelona, Spain, on March 5, 2026. The event marks the debut of the Microsoft Telecom Agentic Store reference framework and Azure Local for disconnected AI operations. The exhibition highlights the integration of Copilot Studio and the Microsoft Agent Factory, showcasing specialized AI agents powered by Azure OpenAI Foundry models running on NVIDIA-based GPU infrastructure. The booth features demonstrations of Azure Databricks Lakebase for real-time telecom transactions and sovereign cloud solutions developed in collaboration with global operators to ensure data residency and regulatory compliance across 5G-Advanced networks. (Photo by Joan Cros/NurPhoto via Getty Images)NurPhoto via Getty ImagesMicrosoft has quietly shifted most of its security workload to an in-house AI model, routing only the hardest problems to frontier systems — and cutting its compute bill in half — even as it owns 27% of OpenAI, holds a $5 billion stake in Anthropic and booked a $3.2 billion gain on that stake last week. On Monday it opened the public preview of an AI security system engineered to send those companies as little work as possible.The system is Project Perception, announced July 27 by Microsoft Security chief Hayete Gallot and in preview inside Microsoft Defender since Aug. 3. The workhorse underneath it is MAI-Cyber-1-Flash, a small model Microsoft built in-house. That model now carries about 90% of the workload in Microsoft’s vulnerability-scanning system. The hardest 10% still gets escalated to OpenAI's GPT-5.4. The compute bill drops by roughly half.Microsoft just demoted frontier models to an escalation tier inside its own product, and the demotion made the product better and cheaper at the same time.How Perception’s Agent Teams WorkProject Perception is an agentic security system with three teams of AI agents working in loops. Red agents probe Microsoft customers' systems for paths an attacker could take. Blue agents investigate the signals and decide which risks matter. Green agents write and deploy the fixes, with human approval required for high-impact actions. Gallot describes the goal as a defense layer that "can reason, prioritize and act at machine speed," priced by consumption through Security Compute Units.The more consequential release sits a layer down. MDASH is Microsoft’s vulnerability-finding harness, a system of more than 100 specialized agents that scan codebases, validate what they find and propose remediations. Until this release, MDASH ran entirely on rented intelligence: GPT-5.4, GPT-5.4 mini and GPT-5.3 codex, all from OpenAI.MORE FOR YOUThe new release replaces most of that rented capacity with MAI-Cyber-1-Flash, a code-heavy specialist derived from Microsoft's MAI-Thinking-1 model line. It runs on about 5 billion active parameters, a fraction of the size of the frontier models it displaces. What it lacks in scale it makes up in specificity. Microsoft trained it on its own record of real exploits and remediations, accumulated over decades of running security infrastructure for 1.6 million customers. No AI lab can buy that training set, because it only exists inside Microsoft.Reading The Benchmark HonestlyMicrosoft's headline claim is a score of 95.95 percent on CyberGym, which it says lands about 12 points above Anthropic's Mythos, the model widely treated as the frontier in AI security work. CyberGym is a serious yardstick. Built by UC Berkeley researchers, it draws 1,507 tasks from real vulnerabilities that were found and patched across 188 open-source projects. When it launched in mid-2025, the best agent configurations cleared roughly 20 percent.The honest reading of Microsoft's number comes with two qualifiers. The score belongs to the full MDASH harness, a multi-stage system, rather than to the small model alone, so comparing it against a standalone frontier model flatters the harness. And the figures are Microsoft's own; one independent check noted the result had not appeared on the benchmark's public leaderboard as of late July.Neither qualifier touches the fact that matters. Inside Microsoft's own harness, holding everything else constant, swapping rented frontier models for a house specialist moved the score from 88.4 to 95.95 while cutting cost in half. Whatever the right comparison to Mythos is, Microsoft replaced most of the rented brainpower in one of its products with its own, and the product improved.Why The Routing Split MattersThe 90/10 split is the detail with consequences far beyond security software, because it shows how money moves through the model layer once a platform owner controls the routing.MDASH decides, task by task, which model gets the call. Routine scanning passes, triage, and deduplication go to the 5-billion-parameter specialist. Deep exploit-chain analysis and proof-of-concept construction, the work Microsoft labels exceptionally hard, escalates to GPT-5.4. The frontier model keeps only the work a frontier model is genuinely required for, and by definition that is the smallest slice of any production workload.The structural point is that capability leadership and volume capture have come apart. OpenAI still makes the smartest model in this system. It now receives 10% of the calls. The specialist that receives the other 90% wins on different terms: cheaper, faster and trained on proprietary data the frontier labs cannot access. In a production system, those three qualities decide where the volume goes.Cheaper also means bigger. At half the cost per scan, vulnerability scanning stops being rationed, and Microsoft charges for Perception by consumption, so expanded scanning is expanded revenue. The same economics has been playing out in token prices for two years: the point of driving AI costs down is that the technology gets deployed against everything. A smaller bill per task and a much larger number of tasks can leave every layer earning more, including the frontier tier at the top of the routing stack.Owning Both Sides Of The Model LayerThe relationship behind this release makes it stranger and more instructive than a normal vendor swap. Microsoft is not a customer diversifying away from a supplier. It owns 27% of the supplier. The exclusivity and revenue-sharing arrangement between the two companies ended in April, and since then Microsoft has been free to compete with OpenAI while profiting from it.Its Anthropic position works the same way. Microsoft put in $5 billion, and Anthropic committed to purchase $30 billion in Azure services. In the same quarter Microsoft booked a $3.2 billion gain on that stake, it shipped a system that outscores Anthropic's security model by Microsoft's own accounting. Anthropic is simultaneously Microsoft's investment, its cloud customer, and its benchmark rival.Every outcome pays Microsoft something. If frontier labs stay ahead, its equity stakes appreciate and the labs train on Azure. Where frontier capability turns out to be replaceable, its in-house models cut costs and keep the margin. The labs carry the research risk; the platform holds a claim on both branches of the future.Microsoft is also not running this play alone. Google has shipped Gemini 3.5 Flash Cyber, and Cisco has released a security model called Antares. Each is a platform owner building a specialist for a domain where it holds proprietary data, rather than renting general intelligence for the whole job.What The Split Signals To InvestorsDefense is industrializing the way attack just did. Days before this preview opened, Palo Alto Networks documented a single operator wiring an open-source model into an agent harness and attacking 460 systems on autopilot. The economic logic on both sides is identical: agents do the volume, and expensive intelligence gets called only when something genuinely hard comes up.For investors trying to locate value in the model layer, the routing decision is the asset to watch. Whoever owns the product surface and the proprietary data decides how work gets divided, and captures the savings from dividing it well. The frontier labs keep a real business at the top of the stack, selling reasoning nobody else can. But the size of that tier is set by their customers' routers, and the routers keep improving.The frontier labs still get the hardest 10% of Microsoft's security work, and Microsoft now decides how much of the work counts as hard.