Microsoft's Project Perception introduces Red/Blue/Green review loop

Microsoft thinks the old model of cybersecurity — humans staring at dashboards, triaging alerts one by one — is already obsolete. The reasoning is simple enough: attackers now use AI to generate exploits faster and cheaper than ever, and a system built around human reaction time just can't keep up. So the company is rolling out Project Perception, an agentic security platform that enters public preview on August 3, and it's structured less like a tool and more like a standing army of specialized bots.

The setup borrows a familiar cybersecurity drill — red team versus blue team — and adds a third color. Red team agents probe an organization's systems looking for paths an attacker could exploit, before anyone malicious finds them first. Blue team agents take what red team finds, weigh it against real context, and decide what actually matters versus what's noise. Green team agents then go fix things, patching and hardening the environment. Loop that continuously, and Microsoft says you get a system that gets sharper the longer it runs, rather than one that just piles up more alerts for a tired analyst to ignore.

What's notable is Microsoft's insistence that no single AI model should run this whole show. Instead, Project Perception mixes frontier models with Microsoft's own purpose-built cyber models, picking whichever is cheapest and most accurate for a given job. The first concrete example: MDASH, Microsoft's vulnerability-management agent team, now runs on a new model called MAI-Cyber-1-Flash and reportedly scores 96% on the CyberGym benchmark — 12 points ahead of a rival system called Mythos — while cutting operating costs nearly in half. That's a specific, testable claim, and if it holds up under independent scrutiny, it's a real signal that specialized smaller models can outperform bigger general ones on narrow, well-defined security tasks.

Underneath all this sits what Microsoft calls a new