MAI-Cyber-1-Flash
Microsoft's first dedicated cybersecurity AI model combining efficiency and performance
Context window
256000
Input / 1M tokens
Not announced
Output / 1M tokens
Not announced
Provider
Microsoft
Data verified 2026-10-01
MAI-Cyber-1-Flash is Microsoft's first purpose-built cybersecurity model designed to identify security vulnerabilities in complex codebases. It employs a sparse mixture-of-experts architecture and handles up to 90% of security tasks independently, routing the remaining 10% of exceptionally complex cases to GPT-5.4. Integrated within the MDASH multi-agent harness and Project Perception platform.
Capability index
Relative estimates (0-100) to place this model against its peers, grounded in published benchmarks.
How to access it
Available through Microsoft's MDASH vulnerability scanning harness, embedded in Project Perception platform. Entering private preview through Microsoft Defender starting August 3, 2026.
Strengths
- ✓50% cheaper than current Microsoft MDASH configuration
- ✓Scores 95.95% on CyberGym benchmark
- ✓Efficient routing model reducing token costs
- ✓Built on 100+ trillion daily security signals
- ✓Available to broader audience vs restricted competitors
Best for developers who...
When to choose it (and when not to)
Reach for MAI-Cyber-1-Flash when...
- →When balancing cost and capability in security workflows
- →For routine vulnerability detection tasks (90% of workloads)
- →When integrated into structured agent-based security pipelines
Look elsewhere if...
- ✕As a standalone model (only available within MDASH/Project Perception)
- ✕For non-security use cases
How to use it
- ›Best used within MDASH's structured agent framework rather than direct prompting
- ›Designed for code analysis and vulnerability discovery workflows
Quickstart
Not availableModel available through Microsoft Defender and Project Perception integration, not as standalone APIRequires enrollment in private preview program; not currently available as standalone model per Microsoft
API model id: Not announced
Benchmarks
| Benchmark | Score | Notes |
|---|---|---|
| CyberGym | 95.95 | Self-reported by Microsoft; measures ability to reproduce 1,507 known vulnerabilities across 188 open-source projects. Exceeded GPT-5.5 Cyber (85.6%), Mythos 5 (83.8%), GPT-5.6 Sol (83.6%), and Gemini 3.5 Flash Cyber (83.2%) |
| CyberGym Level 1 | 95.95 | Combined MDASH+MAI-Cyber-1-Flash+GPT-5.4 system; 12 points above Mythos |
| CyberGym (any-crash) | 95.95 | MDASH system with MAI-Cyber-1-Flash + GPT-5.4 |
| CVEBench | 0.314 | Model-specific benchmark |
| CyberSecEval4 - Threat Intel | 0.553 | Model-specific benchmark |
| CyberSecEval4 - Malware Analysis | 0.33 | Model-specific benchmark |
| CRSBench | 0.651 | POV=1200 |
Source: Microsoft Official Announcement
Compare MAI-Cyber-1-Flash
Compare MAI-Cyber-1-Flash with any other model
Build a comparison →All model comparisons →