This triumvirate of tools present a cohesive and unified platform that tells a compelling story: 

• Microsoft Security Copilot as the assistive AI experience and extensible agent platform for security and IT work;  

• Project Perception as the coordinated multi-agent defense system that executes Red, Blue, and Green workflows. 

• MDASH as the specialized multi-model agentic code-scanning harness for discovering, validating, proving, and helping remediate exploitable source-code vulnerabilities. 

Security Copilot helps analysts and teams ask, summarize, investigate, report, and extend workflows. Project Perception coordinates agents that reason and act across the defense lifecycle. MDASH feeds high-confidence vulnerability findings into broader security workflows, including Project Perception. 

 

 

Security Copilot, Project Perception, and MDASH should not be positioned as interchangeable AI security tools. They sit at different layers of the security operating model: Security Copilot is the broad assistance and agent platform across Microsoft Security experiences; Project Perception is the coordinated multi-agent defense system for continuous defense; MDASH is the specialized code-security harness whose findings can feed Project Perception workflows. 

  

 

All three use AI for security reasoning, but at different levels. Security Copilot grounds analyst-facing assistance through prompts, plugins, connectors, and organization context. Project Perception coordinates agents across security workflows. MDASH uses a specialized multi-model harness for code vulnerability analysis and proof-oriented validation. 

Security Copilot and Project Perception overlap most clearly around investigations. The difference is the operating model: Security Copilot is optimized for human-assisted investigation; Project Perception is optimized for coordinated multi-agent workflows. 

MDASH and Project Perception overlap around vulnerability discovery, exploitability validation, prioritization, and remediation. MDASH focuses on code vulnerabilities, while Project Perception can use MDASH findings with threat intelligence and broader security context to prioritize and drive remediation actions. 

Security Copilot agents automate specific security and IT tasks. Project Perception coordinates Red, Blue, and Green defense agents across end-to-end workflows. MDASH orchestrates specialized scanning agents inside the code vulnerability pipeline. 

1. Lead with Security Copilot for analyst productivity, MDASH for source-code vulnerability discovery, and Project Perception for coordinated agentic defense.


2. Project Perception is not a Security Copilot rebrand. Position the product as a distinct multi-agent defense system that complements Security Copilot. Each of these products complement each other rather than replace any of them.


3. MDASH is not a general SOC platform. In essence, it is a specialized code vulnerability discovery and validation capability. 

Security Copilot is a great entry point for organizations starting their Frontier journey and how AI can empower their security analysts, investigations and autonomous agent deployments. Project Perception is a coordinated agentic defense system. MDASH is a specialized code-security analysis engine. A simple, concise explanation would be: 

 Copilot assists humans analyzing vast amount of security sources, MDASH discovers software vulnerabilities at machine speed level, and Project Perception coordinates security agents to determine what’s exploitable before an attacker does. 

The newly updated documentation  adds a clearer operating model for Project Perception: a continuous cycle to perceive risk, reason across security context, and act with human oversight. It also describes the underlying cyber stack and the role of the purpose-built MAI-Cyber-1-Flash model. 

Perceive, reason, and act 

1. Perceive: Continuously identify emerging risk across endpoints, identities, clouds, applications, and broader security signals.


2. Reason: Apply threat intelligence, organizational context, and security signals to determine which risks are meaningful.


3. Act: Help defenders move from findings to protective action faster, while retaining human judgment and approval for high-impact decisions. 

MAI-Cyber-1-Flash and the MDASH relationship 

MAI-Cyber-1-Flash is a Microsoft purpose-built cybersecurity model optimized for software vulnerability analysis. It operates as one model within the multi-model MDASH system, supporting selected stages of vulnerability discovery and analysis. MAI-Cyber-1-Flash provides specialized reasoning, while MDASH coordinates multiple models and scanning agents, and Project Perception connects those findings to broader defense workflows. 

 Governance and human control 

1. Human oversight remains part of the operating model, especially for critical or high-impact actions.


2. Agent activity should be positioned as governed, logged, auditable, and aligned to least-privilege access.


3. Project Perception is designed to inherit enterprise security, governance, privacy, and compliance foundations rather than operate outside them. 

Project Perception is built around a coordinated virtual team of specialized AI agents. Just as human security organizations employ Red Teams, Blue Teams, and Security Engineering functions, Project Perception introduces AI agents that perform analogous activities at machine speed while maintaining human oversight for critical decisions. 

Red Agents are responsible for identifying weaknesses before attackers can exploit them. 

Typical activities: 

1. Discover attack paths


2. Identify exposed assets


3. Detect privilege escalation opportunities


4. Analyze risky configurations


5. Correlate exposures across systems


6. Surface previously unknown attack opportunities 

Business value: Red Agents help organizations move from reactive security to proactive exposure management by continuously searching for conditions that could enable compromise. 

Blue Agents investigate and validate risk. Once a potential exposure or threat is identified, Blue Agents determine whether it represents a meaningful security concern. 

Typical activities: 

1. Analyze alerts and incidents 


2. Correlate telemetry 


3. Validate exploitability 


4. Assess likelihood of attack 


5. Prioritize findings 


6. Evaluate business impact 


7. Generate investigative conclusions 

Business value: Blue Agents reduce alert fatigue and help security teams focus on the threats and vulnerabilities that present the highest operational risk. 

Green Agents focus on remediation and hardening. After a risk has been identified and validated, Green Agents help eliminate or reduce that risk. 

Typical activities: 

1. Recommend fixes 


2. Validate remediation strategies 


3. Propose configuration changes 


4. Reduce attack surface 


5. Improve security posture 


6. Coordinate hardening activities 


7. Track remediation progress 

Business value: Green Agents help close the gap between identifying a problem and fixing it, accelerating risk reduction across the environment. 

Overlap with Security Copilot 

Security Copilot and Project Perception share some capabilities but are optimized for different operating models. Security Copilot is fundamentally an analyst-facing experience whose primary objective is to make humans more effective. 

1. Incident investigation 


2. Threat hunting 


3. Alert analysis 


4. Report generation 


5. Threat intelligence research 


6. Security summarization 


7. Security operations assistance 


8. Workflow automation through Security Copilot agents 

Positioning statement 

Security Copilot helps security professionals perform their jobs faster and more effectively. 

 

 

MDASH differs significantly from Security Copilot because it is focused specifically on software and source-code security. Its mission is vulnerability discovery, exploitability validation, and remediation guidance rather than general security operations. 

Simple explanation 

In simple terms:

Security Copilot assists humans. MDASH discovers software vulnerabilities. Project Perception coordinates security agent’s activities and actions. Within Project Perception, Red Agents identify weaknesses, Blue Agents determine what matters, and Green Agents reduce risk. 

 

Getting started with Project Perception

Project Perception FAQ

Codename MDASH Overview

Introducing MAI-Cyber-1-Flash inside MDASH

Getting started with Security Copilot

Security Copilot is now included for Microsoft 365 E5 and E7 organizations

The AI Strategy Roadmap: Five drivers of successful AI transformation

The AI Strategy Roadmap: How organizations are achieving Frontier Transformation (pdf)