Microsoft MDASH cybersecurity model tops rivals in company benchmark
Microsoft says MAI-Cyber-1-Flash helped MDASH score 95.95% on CyberGym while cutting costs versus its top setup.
By Theo Nakamura · Staff Writer
· 3 min read
Microsoft MDASH cybersecurity tooling is getting a new AI engine, and Microsoft says the upgrade beat several rival models on a vulnerability-hunting test while lowering costs. For investors tracking Microsoft’s AI buildout, the claim points to a practical use case: selling security software that can scan code more cheaply and more effectively.
Microsoft said it has released MAI-Cyber-1-Flash, its first cybersecurity-specific model, and integrated it into MDASH, a system designed to find software vulnerabilities. According to Microsoft, the combined system scored 95.95% on CyberGym, a benchmark for testing whether AI agents can reproduce known security flaws.
CyberGym evaluates agents against 1,507 known vulnerabilities from 188 open-source projects, Microsoft said. The score reflects the share of those vulnerabilities an agent can successfully reproduce in a controlled setting.
How did Microsoft MDASH score against other AI models?
Microsoft said the MDASH setup using MAI-Cyber-1-Flash outperformed GPT-5.5 Cyber, Mythos 5, GPT-5.6 Sol and Gemini 3.5 Flash Cyber on CyberGym. The company listed the comparison scores as 85.6% for GPT-5.5 Cyber, 83.8% for Mythos 5, 83.6% for GPT-5.6 Sol and 83.2% for Gemini 3.5 Flash Cyber.
The result is Microsoft’s own report. The score had not appeared on CyberGym’s public leaderboard at the time it was reported, although the benchmark uses a public test set and a defined scoring method.
What is Microsoft MDASH?
MDASH is the system around the model, rather than the model itself. Microsoft describes it as a vulnerability scanner with agents, tools and checks that look through code, test suspected issues, remove duplicate findings and produce proof that a bug can be triggered.
A model such as MAI-Cyber-1-Flash is the AI that reasons through code and proposes answers. A harness such as MDASH is the workflow that gives the model tasks, validates its work and turns findings into something security teams can review.
Microsoft said MAI-Cyber-1-Flash handles as much as 90% of the workload inside MDASH. The system sends the hardest 10% of cases to GPT-5.4, according to the company.
That split matters for cost. Tokens are the chunks of text an AI model reads and writes, and companies pay for them when models process code or generate responses. By routing most tasks to a more efficient cybersecurity model and reserving a larger model for tougher cases, Microsoft says the setup costs 50% less than its current top MDASH configuration.
Microsoft CEO Satya Nadella said in a post on X that MAI-Cyber-1-Flash was built to find difficult vulnerabilities in complex codebases and that, when used with MDASH, it offers “world-class performance at 50 percent of the cost of leading models.”
Microsoft said the scanner is available in private preview through Microsoft Defender. In that preview, security teams can review MDASH findings and generate proposed fixes, according to the company.
This story draws on original reporting from Decrypt.
