You’ve probably seen “AI-powered security platform” as a headline often enough to skim past it by now. This one’s worth a second look. It’s also not something you can buy yet, and that gap matters as much as the technology itself.
What Microsoft actually built
Microsoft calls it MDASH, short for Multi-Model Agentic Scanning Harness. It’s a platform that coordinates more than 100 specialized AI agents to hunt for security flaws inside Windows itself, before attackers find them. Instead of waiting for something bad to happen and reacting, the agents dig through the code looking for weaknesses that haven’t been discovered yet.
It’s already turned up real results. MDASH found 16 previously unknown vulnerabilities spread across core pieces of Windows: the TCP/IP stack, the IPsec service, DNS resolution, and a few others most people never think about until something breaks. Four were rated critical, including two remote code execution flaws that could theoretically have let an attacker take over a system over the internet without needing a password. Both were already patched in a regular May update, through the same Windows Update most businesses already have running.
The accuracy is the more interesting part. In testing, researchers planted 21 known vulnerabilities and MDASH found every one of them with zero false alarms, which has historically been the weak point of AI-driven security tools. Flag too many false positives and a security team stops trusting the tool. Microsoft says MDASH avoided that trap.
Why this doesn’t change what you need to do this year
Here’s the catch. MDASH is running inside Microsoft right now, used by its own engineers, with a small number of outside customers testing it in private preview. There’s no version of this a small or midsized business can buy today, and no announced timeline for when that changes.
Even once tools like this reach the market, they’re built to catch a specific kind of problem, flaws hidden in code before anyone else finds them. That’s valuable, but it’s not the reason most businesses get breached. Almost every real-world attack still comes in through the same door it always has: a password that was too easy to guess, a system that missed a patch, someone clicking a link they shouldn’t have, an account with more access than it needed, or backups that didn’t actually work when someone went to use them.
The smartest bug hunter in the world doesn’t help you if the front door’s unlocked. MDASH finding 16 hidden flaws inside Windows is a genuinely good sign for where security is headed. It’s not a reason to deprioritize the boring stuff that’s protecting your business right now.
What actually protects you today
Keep systems patched, and don’t let updates sit for weeks before they get applied. Use multi-factor authentication everywhere it’s available, not just where it’s convenient. Keep backups that you’ve actually tested, not just backups that exist. Review who has access to what, and take it away from people who don’t need it anymore. None of that is new advice, and that’s the point, it still works better than waiting for AI to catch everything for you.
If you want a second set of eyes on whether your basics are actually covered, that’s exactly the kind of security audit we do.