Microsoft's MAI-Cyber-1-Flash delivers top CyberGym scores at half the cost

Cybersecurity AI has a cost problem. The models powerful enough to find real vulnerabilities are expensive to run at scale, and the volume of code to scan grows faster than budgets. Microsoft thinks it has a solution: a tuned multi-model system that puts most of the work on a cheap, specialized model and saves the expensive ones for the hardest cases.

The company on Monday introduced MAI-Cyber-1-Flash, a compact model derived from the MAI-Thinking-1 lineage, and announced it would be the default model inside MDASH, its multi-agent vulnerability identification and remediation harness. Together, Microsoft says, they deliver 96% on the CyberGym benchmark, 12 percentage points above Mythos, a competitor from an unnamed lab. The whole system costs 50% less than Microsoft's previous best configuration using GPT-5.4, 5.4 mini, and 5.3 codex.

“Security is an always-on mission, and given the enormous volume of inbound attacks, token cost is now the real constraint for defenders,” the company wrote in a blog post.

Microsoft's claim rests on a division of labor: MAI-Cyber-1-Flash handles up to 90% of tasks, while a larger model (currently GPT-5.4) steps in for the remaining 10% that require deeper reasoning. That hybrid approach is not unique, Google's Gemini 3.5 Flash Cyber uses multiple Flash agent calls within CodeMender to produce a single vulnerability report, but Microsoft positions its data advantage as the differentiator. The company sees trillions of daily signals across identity, endpoint, cloud, and network from its own security estate, along with operational insight from 1.6 million customers.

“No one can manufacture this history,” the post says.

The competitive field for cybersecurity AI has grown crowded. Anthropic deliberately capped Claude Opus 5's cybersecurity abilities, creating a blind spot that specialists are already exploiting. Sakana AI's Fugu-Cyber found more confirmed vulnerabilities in the V8 JavaScript Engine than Claude Opus 4.6. Google's Gemini 3.5 Flash Cyber is locked to governments and trusted partners, limiting its market reach. Microsoft is making its model broadly available through MDASH, which it says already includes over 100 agents tuned by industry experts.

The cost claim deserves scrutiny. Microsoft compares the new system to its own previous best, not to competitors. A 50% savings on an expensive baseline is still expensive if rival models like Mythos or Gemini 3.5 Flash Cyber offer lower absolute prices. The company did not release standalone MAI-Cyber-1-Flash pricing, only the system-wide figure. The technical report promised in the blog post may clarify the numbers, but it's not yet public.

Microsoft also launches Perception, an agentic security system that uses teams of agents for ongoing monitoring and patching, expanding beyond the software vulnerability focus of MDASH. Perception will soon use MAI-Cyber-1-Flash for many workflows, a sign that Microsoft intends the model to become the default workhorse across its security product line.

The real test will come when security teams run their own benchmarks. A model that scores well on CyberGym may not generalize to every enterprise codebase or threat scenario. Microsoft claims MAI-Cyber-1-Flash was built from scratch in-house on the highest quality data, but third-party validation matters more than marketing. Without it, the 96% remains a number on a slide.