Fight AI with AI | Multi-Agent Security Defense

Match AI-powered attacks at machine speed with Project Perception. Point red, blue, and green AI agent teams at a known threat actor, confirm which vulnerabilities attackers can reach, then deploy KQL detections, harden your posture, and merge a tested code fix in minutes with Microsoft Defender.

Stay in control and approve key actions before agents run them. Run Microsoft's pre-built playbooks or build your own, and manage sessions from the Defender portal or from your terminal with the MCP plug-in. Keep token costs low with MAI Cyber Flash, a purpose-built security model inside MDASH.

Dave Weston, CVP Microsoft Security, shares how Microsoft's threat intelligence and incident response expertise power agents you direct. 

👥 Who it's for:

SOC analysts, security engineers, and red and blue teamers evaluating agentic AI for defense, plus AppSec and DevSecOps teams who own vulnerability remediation. 

⏱️ Chapters:

00:00 Fight AI-powered attacks with AI agents

00:45 How AI attacks adapt mid-breach

01:39 Jailbroken and abliterated models

02:04 Inside the Project Perception security stack

03:28 Red, blue, and green agent teams

04:07 Playbooks that orchestrate agent workflows

04:43 Ask Perception if you're protected

06:06 Red team agents emulate a threat actor

06:59 Approve high-impact agent actions

07:26 MDASH findings confirm reachable vulnerabilities

08:22 Blue team agent writes KQL detections

08:54 WAF, auth check, and tested code fix

09:36 Pull request merged into production

10:14 Session reports and MCP terminal plugin

11:02 MAI Cyber Flash keeps token costs low

11:57 Join the Project Perception preview

AI helps attackers find, weaponize, and exploit vulnerabilities at a speed and scale no human team can match. Jailbroken and abliterated models generate custom tooling that adapts mid-breach, leaving defenses that hunt for known techniques chasing a target that changes every time.

Project Perception answers with a full agentic security stack. It starts with trillions of daily security signals, correlates them in the Microsoft security graph, and uses multiple AI models, including purpose-built ones, to reason over risk and prioritize what matters most. Specialized agents act on that reasoning: red team agents simulate attacks and prove where you're vulnerable, blue team agents investigate and build detections, and green team agents harden posture and remediate. Playbooks orchestrate them through proven SOC workflows, and codified actuators let agents perform the fix instead of only recommending it.

In the demo, one prompt, "Is my organization protected against Onyx Sleet?", launches threat intelligence, reconnaissance, and pen test agents. They pull MDASH code-scanning findings and confirm an internet-exposed SQL injection. A detection authoring agent writes KQL detections to cover the gap, and the posture remediation agent shields the app with a web application firewall, adds an authorization check, and produces a tested code fix merged through a pull request. Agents stop and ask before any high-impact action, so you stay in control.

Every session produces a shareable report with the attack path, remediation plan, and timeline. An MCP tool plugin runs the same work from your terminal, and MAI Cyber Flash, a dedicated cybersecurity model inside MDASH, handles most vulnerability work to keep token costs low. 

🔗 Related links: 

► Get started at https://microsoft.com/perception

► Unfamiliar with Microsoft Mechanics?
Microsoft's Official Video Series for IT

— Subscribe https://www.youtube.com/c/MicrosoftMechanicsSeries
— Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
— Podcast: https://microsoftmechanics.libsyn.com/podcast

►Join us on social:

— https://twitter.com/MSFTMechanics
—  https://www.linkedin.com/company/microsoft-mechanics/
— https://www.instagram.com/msftmechanics/
— https://www.tiktok.com/@msftmechanics