Microsoft's First Security Model Is Built to Handle 90% of Tasks

Microsoft released MAI-Cyber-1-Flash, its first cybersecurity model: a sparse mixture-of-experts transformer with 137 billion total parameters, 5 billion active per token, and a 256,000-token context window. It powers MDASH, Microsoft’s vulnerability identification and remediation harness, and reportedly pushes it to roughly 96% on the CyberGym benchmark at about half the cost of the previous configuration. The architecture is the story rather than the score. Microsoft states explicitly that the model was designed to absorb up to 90% of tasks so that larger, costlier models are reserved for the hardest 10% — a classifier cascade published as product strategy, with the cost reduction as the headline claim. Expect imitation. The model stays closed and product-gated, which is the defensible choice for a system fine-tuned to find exploitable flaws in unfamiliar code.