Microsoft's Project Perception Reaches Public Preview in Defender

Microsoft opened Project Perception to public preview, adding three AI agents to Defender that probe, investigate, and remediate security issues in live systems.

That's a step past tools that only flag problems for a person to fix. Humans still hold final sign-off, but the agents themselves make changes inside the system that defends production infrastructure.

Red probes for weaknesses the way an attacker would. Blue investigates like an incident responder. Green remediates and hardens the system.

The system runs on MAI-Cyber-1-Flash, Microsoft's first purpose-built security model. It carries about 90% of the workload inside what Microsoft calls the MDASH scanning harness, and routes the hardest 10% to GPT-5.4.

Microsoft says GPT-5.4 handles those harder cases at roughly half the cost of larger general-purpose models. Pricing across the system is consumption-based, through Security Compute Units.

One thing missing from Microsoft's own product page: benchmark numbers. No detection rate for Red, no accuracy figure for Blue, no success rate for Green.

That's the tell. Microsoft is charging for agents that act inside production systems without publishing one number proving any of the three works. If Project Perception performs the way Microsoft implies, benchmarks should surface as early customers build a track record. If they don't, the silence answers the question itself.