YouTube Video
Match AI-powered attacks at machine speed with Project Perception. Point red, blue, and green AI agent teams at a known threat actor, confirm which vulnerabilities attackers can reach, then deploy KQL detections, harden your posture, and merge a tested code fix in minutes with Microsoft Defender.
Stay in control and approve key actions before agents run them. Run Microsoft’s pre-built playbooks or build your own, and manage sessions from the Defender portal or from your terminal with the MCP plug-in. Keep token costs low with MAI Cyber Flash, a purpose-built security model inside MDASH.
Dave Weston, CVP Microsoft Security, shares how Microsoft’s threat intelligence and incident response expertise power agents you direct.
👥 Who it's for:
SOC analysts, security engineers, and red and blue teamers evaluating agentic AI for defense, plus AppSec and DevSecOps teams who own vulnerability remediation.
⏱️ Chapters:
00:00 Fight AI-powered attacks with AI agents
00:45 How AI attacks adapt mid-breach
01:39 Jailbroken and abliterated models
02:04 Inside the Project Perception security stack
03:28 Red, blue, and green agent teams
04:07 Playbooks that orchestrate agent workflows
04:43 Ask Perception if you're protected
06:06 Red team agents emulate a threat actor
06:59 Approve high-impact agent actions
07:26 MDASH findings confirm reachable vulnerabilities
08:22 Blue team agent writes KQL detections
08:54 WAF, auth check, and tested code fix
09:36 Pull request merged into production
10:14 Session reports and MCP terminal plugin
11:02 MAI Cyber Flash keeps token costs low
11:57 Join the Project Perception preview
AI helps attackers find, weaponize, and exploit vulnerabilities at a speed and scale no human team can match. Jailbroken and abliterated models generate custom tooling that adapts mid-breach, leaving defenses that hunt for known techniques chasing a target that changes every time.
Project Perception answers with a full agentic security stack. It starts with trillions of daily security signals, correlates them in the Microsoft security graph, and uses multiple AI models, including purpose-built ones, to reason over risk and prioritize what matters most. Specialized agents act on that reasoning: red team agents simulate attacks and prove where you're vulnerable, blue team agents investigate and build detections, and green team agents harden posture and remediate. Playbooks orchestrate them through proven SOC workflows, and codified actuators let agents perform the fix instead of only recommending it.
In the demo, one prompt, "Is my organization protected against Onyx Sleet?", launches threat intelligence, reconnaissance, and pen test agents. They pull MDASH code-scanning findings and confirm an internet-exposed SQL injection. A detection authoring agent writes KQL detections to cover the gap, and the posture remediation agent shields the app with a web application firewall, adds an authorization check, and produces a tested code fix merged through a pull request. Agents stop and ask before any high-impact action, so you stay in control.
Every session produces a shareable report with the attack path, remediation plan, and timeline. An MCP tool plugin runs the same work from your terminal, and MAI Cyber Flash, a dedicated cybersecurity model inside MDASH, handles most vulnerability work to keep token costs low.
🔗 Related links:
► Get started at https://microsoft.com/perception
► Unfamiliar with Microsoft Mechanics?
Microsoft’s Official Video Series for IT
— Subscribe https://www.youtube.com/c/MicrosoftMechanicsSeries
— Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
— Podcast: https://microsoftmechanics.libsyn.com/podcast
►Join us on social:
— https://twitter.com/MSFTMechanics
— https://www.linkedin.com/company/microsoft-mechanics/
— https://www.instagram.com/msftmechanics/
— https://www.tiktok.com/@msftmechanics
#Cybersecurity #MicrosoftDefender #AIAgents #SecOps
Stay in control and approve key actions before agents run them. Run Microsoft’s pre-built playbooks or build your own, and manage sessions from the Defender portal or from your terminal with the MCP plug-in. Keep token costs low with MAI Cyber Flash, a purpose-built security model inside MDASH.
Dave Weston, CVP Microsoft Security, shares how Microsoft’s threat intelligence and incident response expertise power agents you direct.
👥 Who it's for:
SOC analysts, security engineers, and red and blue teamers evaluating agentic AI for defense, plus AppSec and DevSecOps teams who own vulnerability remediation.
⏱️ Chapters:
00:00 Fight AI-powered attacks with AI agents
00:45 How AI attacks adapt mid-breach
01:39 Jailbroken and abliterated models
02:04 Inside the Project Perception security stack
03:28 Red, blue, and green agent teams
04:07 Playbooks that orchestrate agent workflows
04:43 Ask Perception if you're protected
06:06 Red team agents emulate a threat actor
06:59 Approve high-impact agent actions
07:26 MDASH findings confirm reachable vulnerabilities
08:22 Blue team agent writes KQL detections
08:54 WAF, auth check, and tested code fix
09:36 Pull request merged into production
10:14 Session reports and MCP terminal plugin
11:02 MAI Cyber Flash keeps token costs low
11:57 Join the Project Perception preview
AI helps attackers find, weaponize, and exploit vulnerabilities at a speed and scale no human team can match. Jailbroken and abliterated models generate custom tooling that adapts mid-breach, leaving defenses that hunt for known techniques chasing a target that changes every time.
Project Perception answers with a full agentic security stack. It starts with trillions of daily security signals, correlates them in the Microsoft security graph, and uses multiple AI models, including purpose-built ones, to reason over risk and prioritize what matters most. Specialized agents act on that reasoning: red team agents simulate attacks and prove where you're vulnerable, blue team agents investigate and build detections, and green team agents harden posture and remediate. Playbooks orchestrate them through proven SOC workflows, and codified actuators let agents perform the fix instead of only recommending it.
In the demo, one prompt, "Is my organization protected against Onyx Sleet?", launches threat intelligence, reconnaissance, and pen test agents. They pull MDASH code-scanning findings and confirm an internet-exposed SQL injection. A detection authoring agent writes KQL detections to cover the gap, and the posture remediation agent shields the app with a web application firewall, adds an authorization check, and produces a tested code fix merged through a pull request. Agents stop and ask before any high-impact action, so you stay in control.
Every session produces a shareable report with the attack path, remediation plan, and timeline. An MCP tool plugin runs the same work from your terminal, and MAI Cyber Flash, a dedicated cybersecurity model inside MDASH, handles most vulnerability work to keep token costs low.
🔗 Related links:
► Get started at https://microsoft.com/perception
► Unfamiliar with Microsoft Mechanics?
Microsoft’s Official Video Series for IT
— Subscribe https://www.youtube.com/c/MicrosoftMechanicsSeries
— Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
— Podcast: https://microsoftmechanics.libsyn.com/podcast
►Join us on social:
— https://twitter.com/MSFTMechanics
— https://www.linkedin.com/company/microsoft-mechanics/
— https://www.instagram.com/msftmechanics/
— https://www.tiktok.com/@msftmechanics
#Cybersecurity #MicrosoftDefender #AIAgents #SecOps