Microsoft's MDASH cybersecurity model outperformed its competitors with a score of 95.95% on CyberGym, proving to be cost-effective and efficient.
Microsoft's New Cybersecurity Model Excels
Microsoft has launched its first dedicated cybersecurity model, MAI-Cyber-1-Flash, which integrates with MDASH for enhanced vulnerability detection. This new combination has reportedly outperformed notable competitors, including Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol, while offering a cost advantage of 50% compared to leading configurations.
The MDASH and MAI-Cyber-1-Flash system achieved an impressive score of 95.95% on CyberGym, a benchmark assessing AI agents on their ability to replicate known vulnerabilities. This score significantly exceeds that of GPT-5.5 Cyber, which scored 85.6%, as well as Mythos 5 at 83.8%, GPT-5.6 Sol at 83.6%, and Gemini 3.5 Flash Cyber at 83.2%.
Although Microsoft announced these results, they have not yet been reflected on CyberGym's public leaderboard. Nevertheless, the benchmark utilizes a public test set that adheres to a defined success metric, lending credibility to the reported score.
MAI-Cyber-1-Flash is designed to handle approximately 90% of tasks autonomously, with MDASH managing the more complex 10% through GPT-5.4. This strategic allocation of tasks is crucial, as processing costs are incurred each time an AI model analyzes code or generates a response.
Microsoft CEO Satya Nadella emphasized the efficiency of this model, stating, “When combined with MDASH, it delivers world-class performance at 50 percent of the cost of leading models.” This marks a significant achievement as it is the first time a Microsoft efficiency-focused model has outperformed a complex, general-purpose model.
MDASH comprises over 100 specialized agents that audit code, verify findings, and develop proofs of concept for identified vulnerabilities. Microsoft argues that the traditional methods of sporadic scans and delayed patches are becoming obsolete due to the cost-effectiveness of AI-driven bug discovery, leveraging decades of security data as a competitive advantage.
As cybersecurity experts strive to match or exceed the capabilities of Claude Mythos, researchers have been able to replicate its vulnerability detection using public models for less than $30 per scan. However, the challenge remains in validating findings without inundating developers with false alerts. Microsoft’s reported performance on CyberGym positions it significantly ahead of its competitors, with a score that is about 10 points higher than GPT-5.5 Cyber.
Currently, MDASH is available in private preview through Microsoft Security Exposure Management in the Defender portal, allowing clients to scan Git repositories and receive ranked findings along with suggested code fixes for review. The preview is limited to repositories of around 256MB and permits one scan at a time per tenant, with plans for broader applications in threat monitoring and remediation in the future.
