Microsoft has introduced an AI model for cybersecurity, MAI-Cyber-1-Flash, which surpasses Mythos 5 and GPT-5.5-Cyber.
Microsoft has made a significant breakthrough in the application of artificial intelligence for cybersecurity by releasing a specialized model, MAI-Cyber-1-Flash. This model has already been integrated into the MDASH vulnerability search system, which, according to management, demonstrates results surpassing well-known solutions such as Mythos 5 and GPT-5.5-Cyber, while being 50% cheaper than the existing MDASH configuration based on GPT-5.4, 5.4-Mini, and 5.3-Codex.
A key performance indicator was the score in the CyberGym benchmark, where the MAI-Cyber-1-Flash and MDASH combination achieved an impressive 95.95%. This test tasks AI agents with reproducing 1,507 known vulnerabilities in 188 open-source projects, measuring the percentage of successfully reproduced errors in a controlled environment. For comparison, GPT-5.5 Cyber scored 85.6%, Mythos 5 scored 83.8%, and GPT-5.6 Sol scored 83.6%. It is important to note that at the time of publication, these results had not yet been entered into public rankings, highlighting the novelty and exclusivity of the achievement.
The architecture of MAI-Cyber-1-Flash is based on a hybrid approach: the model independently handles up to 90% of tasks, while the most complex 10% are redirected to GPT-5.4. This solution significantly saves tokens while maintaining high accuracy. Within MDASH, over 100 specialized AI agents are deployed, each performing its own function: from code auditing and disputing the validity of findings to creating Proof-of-Concept — a working example confirming the presence of a vulnerability.
Microsoft CEO Satya Nadella noted that this is the first time an optimized LLM from the company has demonstrated such high efficiency: "In combination with MDASH, the MAI-Cyber-1-Flash model delivers world-class performance at 50% of the cost of leading models."
At the initial stage, MDASH is available to a limited number of users through the Microsoft Security Exposure Management service on the Defender portal. Clients can scan repositories on GitHub, analyze found vulnerabilities ranked from "unlikely" to "confirmed," and use Defender CLI to automatically generate code fix options, which are then passed on to developers for review.
Expert commentary: This move by Microsoft is not just a technological achievement but a signal of a paradigm shift in cybersecurity. Specialized AI models that are cheaper and more efficient than general-purpose ones could radically change the market, making high-quality code auditing accessible to small and medium-sized businesses. However, as with any AI tools, it is critically important to maintain human control during the result verification stage.