Suleyman: Microsoft’s Cyber Model Doubled to 50% of Scans

Microsoft AI chief executive Mustafa Suleyman said on X on 27 October 2026 that the company’s MAI Cyber model “in our security harness has doubled user adoption to 50% in the last 30 days.” He added: “We also made it 20% more token efficient without sacrificing any quality.”

The chart attached to his post, titled “MAI share of all MDASH scans, trailing 7 days”, shows that share at 25% on 14 September and 49% on 5 October. MDASH is Microsoft’s multi-agent vulnerability identification and remediation harness. A Microsoft AI post the same day says MAI Cyber now “accounts for almost 50% of all MDASH scans.”

Short explainer · Microsoft’s cyber model

A vertical news Short narrated from the published text of this piece and related FourWeekMBA pieces.

Business Pill · the model and the harness

An evergreen Business Engineer explainer on the model and the harness around it. It explains the general idea and does not discuss Microsoft, MAI Cyber or MDASH.

What Microsoft Reported

The Microsoft AI post introduces MAI Cyber 1.1 Flash. It says the new model delivers “comparable performance” to MAI Cyber 1 Flash while “costing 18% less per scan on an internal MDASH vulnerability-scanning evaluation suite.”

Suleyman’s post puts the gain at 20% in token efficiency; Microsoft’s post puts it at 18% lower cost per scan. The two documents use different measures, and we report each as stated.

Microsoft’s post also gives a retention figure. After running their first scan with the MAI Cyber 1 Flash profile, it says, “nearly 9 in 10 subsequent scans use the MAI profile rather than the OpenAI-only model profile.” It says the usage comes “from hundreds of customers”, and that MAI Cyber 1.1 Flash is available through MDASH to verified customers.

What Was Posted on X

Mustafa Suleyman, chief executive of Microsoft AI, posted this on 27 October 2026. He says the MAI Cyber model in Microsoft’s security harness has doubled user adoption to 50% in the last 30 days and is 20% more token efficient without sacrificing quality, and attaches a chart of MAI’s share of all MDASH scans. The piece uses the post as its primary source for both claims.

How MDASH Splits the Work

Microsoft’s launch post for the first version, MAI-Cyber-1-Flash, says the model “was designed to efficiently handle up to 90% of all tasks, enabling MDASH to use the larger and most costly models in our fleet (in this case GPT-5.4) for the 10% of exceptionally hard tasks that truly need them.”

That post says the combination delivers a “50% cost saving” compared with Microsoft’s best offering in MDASH at the time, which it lists as GPT 5.4 + 5.4 mini + 5.3 codex. It also says “token cost is now the real constraint for defenders.”

The launch post describes MAI-Cyber-1-Flash as “a compact, code-heavy security model derived from the MAI-Thinking-1 lineage”, and reports a 96% score on the CyberGym benchmark for MDASH with MAI-Cyber-1-Flash, which it notes is an any-crash score.

Connecting the Coverage

In July we reported that Microsoft Project Perception builds agentic security on a multi-model routing junction, the agentic security system Microsoft launched alongside MAI-Cyber-1-Flash. In June we reported that Microsoft’s MAI-Thinking-1 matches GPT-5.4 at 10x lower cost, the model family the cyber model is derived from.

Rival labs have shipped their own cyber models: we covered how OpenAI launches GPT-5.5-Cyber and Codex Security in June, how Gemini 4 Argon removes cyber guardrails for select defenders in September, and how Anthropic opens Mythos 5.1 to defenders in 3 cyber tiers on 7 October.

The Structural Read

As we read it, the design is a split by difficulty: Microsoft says the first MAI cyber model was built to handle up to 90% of tasks and leave the hardest 10% to GPT-5.4.

As we read it, the efficiency claims are about cost per unit of work: Suleyman says 20% more token efficient, and Microsoft’s post says 18% less per scan on its internal evaluation suite.

As we read it, the retention figure is the adoption signal Microsoft chose to publish: it says nearly 9 in 10 later scans by customers who try MAI use the MAI profile rather than the OpenAI-only one.

Three Implications

FOR SECURITY TEAMS Microsoft says MAI Cyber 1.1 Flash is available through MDASH to verified customers, selected as a profile when starting a new scan.

FOR MICROSOFT’S MODEL BILL Microsoft’s launch post says pairing its model with GPT-5.4 cut cost 50% against its best previous MDASH offering, which it lists as GPT 5.4 + 5.4 mini + 5.3 codex.

FOR RIVAL CYBER MODELS Microsoft’s posts give share and cost figures but no prices, revenue or precise scan counts, so outside comparison rests on benchmarks.

The Business Engineer Lens

This story maps onto the Business Engineer framework The Agentic Harness War.

The framework puts it this way: “The agentic surface — the harness — is becoming where value pools in the entire AI stack.”

As we read it, MDASH is Microsoft’s harness, and Microsoft is choosing which model runs inside it: by its account, its own model now takes nearly half of the scans. The framework was written in July 2026 about OpenAI and Anthropic and does not discuss Microsoft, MAI Cyber or MDASH.

What Is Not Established

Neither Suleyman’s post nor Microsoft’s posts give a precise number of scans beyond “over thousands”, the number of customers beyond “hundreds”, prices or revenue for MAI Cyber. Suleyman’s post does not define “user adoption” beyond the attached chart of scan share.

The attached chart runs to 5 October, while the post refers to the last 30 days; the documents we read do not show the share after 5 October. Microsoft’s posts do not say which models ran the scans that did not use the MAI profile, beyond the comparison with the OpenAI-only model profile.

The Bottom Line

Suleyman says Microsoft’s own cyber model doubled its adoption inside Microsoft’s security harness to 50% in 30 days and became 20% more token efficient. Microsoft’s chart shows its share of MDASH scans rising from 25% to 49% between 14 September and 5 October, and Microsoft says nearly 9 in 10 follow-up scans by customers who try it use the MAI profile rather than the OpenAI-only one.