An illustrative view of AI-assisted software vulnerability discovery.
Microsoft is developing an artificial intelligence system designed to discover, validate and help remediate software vulnerabilities. Known as codename MDASH, the system combines multiple AI models with security-testing tools and more than 100 specialised agents.
Unlike a standard code assistant that suggests improvements while a developer types, MDASH is designed to investigate whether weaknesses in software could create genuine security risks. It can examine code, develop theories about possible vulnerabilities, run tests, analyse results and collect evidence for human security researchers.
Microsoft reported in May 2026 that MDASH contributed to the discovery of 16 previously unknown vulnerabilities in Windows networking and authentication components. Four were described as critical remote-code-execution flaws, and Microsoft said the identified issues were addressed through its May 2026 security update process.
For UK businesses, this development matters for more than technology news. It shows how quickly vulnerability discovery is changing and why organisations need effective software inventories, patching procedures, access controls and incident-response plans.
What Is Microsoft MDASH?
MDASH is Microsoft Security’s multi-model agentic code-scanning system.
The term multi-model means it does not rely on only one artificial intelligence model. Different models or specialised agents can handle different parts of an investigation.
The term agentic means the system can complete a sequence of connected actions. Rather than simply answering a question about a section of code, it may form a hypothesis, select a testing approach, run the test, examine the outcome and decide what to investigate next.
Microsoft’s July 2026 documentation describes MDASH as a capability within Microsoft Defender that extends the Defender command-line interface with agentic scanning beyond traditional static analysis. At the time of that documentation, it was described as being in private preview.
This makes MDASH different from a conventional vulnerability scanner that checks software against a fixed list of known issues. Its intended role is to reason about complex software behaviour and help identify weaknesses that may not already have a published signature.
How Does Microsoft AI Find Software Vulnerabilities?
1. It examines the codebase
The first stage is understanding the software being tested.
Modern applications can include source code, third-party packages, authentication systems, network protocols, APIs, cloud resources and deployment configurations. A weakness may occur inside one component or in the way several components interact.
An AI-assisted system can examine a larger amount of technical information than a person could review manually in the same period. However, recognising unusual code is only the beginning. The system still needs evidence that the suspected weakness is meaningful.
2. It creates vulnerability hypotheses
MDASH can form theories about how the software might fail.
For example, it may investigate whether:
Unexpected network data causes unsafe behaviour Input validation can be bypassed Memory is accessed incorrectly An authentication check behaves differently under unusual conditions An attacker can influence a sensitive software operation Several smaller weaknesses can be combined A service exposes functionality that was not intended to be public
Each hypothesis gives the system a specific problem to test.
3. Specialised agents investigate different tasks
Microsoft states that MDASH uses a pipeline of more than 100 specialised AI agents and an ensemble of models. These agents can contribute to discovery, validation and proving whether a vulnerability may be exploitable.
One agent might study code structure, while another creates test inputs. Other agents may examine crashes, compare results, challenge a conclusion or collect technical evidence.
This division of work is important because vulnerability research is rarely a single-step process. A suspicious line of code does not automatically represent a security vulnerability.
4. The system runs practical tests
AI-generated explanations alone are not enough to prove a security problem.
A useful vulnerability-discovery system must be able to interact with testing environments and observe software behaviour. This can include sending selected inputs, reproducing crashes, monitoring memory behaviour and examining how the application responds.
Microsoft says MDASH was designed to discover, validate and prove exploitability across codebases rather than only reporting theoretically suspicious patterns.
5. Findings are validated
Validation helps distinguish a genuine vulnerability from a false alarm.
Researchers need to determine:
Whether the behaviour can be reproduced Which software versions are affected What access an attacker would require Whether the issue can affect confidentiality, integrity or availability Whether protective controls reduce the risk Whether the vulnerability is already known How the software can be fixed safely
Human security specialists remain essential during this process. They assess the context, severity and impact before a finding becomes an official security issue.
What Has Microsoft Reported About MDASH?
Microsoft reported two notable results during 2026.
In a controlled private test, Microsoft said MDASH identified all 21 planted vulnerabilities and produced no false positives in that particular test. Microsoft and its technical materials also make clear that performance in controlled tests does not guarantee identical performance in wider production environments.
Microsoft also reported that the system contributed to discovering 16 previously unknown vulnerabilities across Windows networking and authentication components. Four were classified as critical remote-code-execution flaws.
These figures are evidence of potential, but they should not be interpreted as proof that MDASH finds every vulnerability or always produces perfect results.
A security benchmark tests defined conditions. Real software environments can contain undocumented behaviour, old dependencies, unusual configurations and interactions that were not present in the benchmark.
Why Does Microsoft AI Vulnerability Detection Matter to UK Businesses?
AI adoption is increasing
Nearly three in ten UK businesses reported using at least one type of AI technology in June 2026, according to the Office for National Statistics. Large language models were the most widely used type among businesses with at least ten employees.
As businesses add AI tools, cloud services and connected applications, their software environments can become more complex. Every new integration may introduce credentials, data transfers, permissions and dependencies that need to be managed.
Vulnerability discovery may become faster
AI-assisted testing can help security teams investigate code and possible attack paths more quickly.
This benefits defenders, but similar technical capabilities may eventually help attackers search for weaknesses more efficiently. Businesses therefore need shorter delays between:
Learning about a vulnerability Identifying affected systems Testing the security update Deploying the update Confirming that the risk has been reduced Small businesses rely on third-party software
Most UK small businesses do not develop every system themselves. They use accounting software, content-management platforms, cloud storage, email services, e-commerce applications and customer-management systems.
A business may not be able to repair a vendor’s code, but it can still:
Maintain a list of important systems Subscribe to supplier security notices Install security updates Remove unused software Restrict administrator access Require multi-factor authentication Back up essential data Review third-party access Data protection requires appropriate security
The Information Commissioner’s Office explains that organisations processing personal data must use appropriate technical and organisational measures to protect it. What is appropriate depends on factors such as risk, available technology and implementation costs.
Using an AI security product does not automatically demonstrate compliance. A business still needs documented policies, access controls, staff responsibilities and a proportionate risk-management process.
MDASH vs Microsoft Defender Vulnerability Management
MDASH and Microsoft Defender Vulnerability Management are related to security but serve different purposes.
Area MDASH Defender Vulnerability Management Main purpose Discover and validate software vulnerabilities Identify and prioritise weaknesses across organisational assets Typical user Security researchers and eligible preview organisations IT and security teams Primary focus Code and exploitability investigation Devices, software exposure and remediation priorities Availability Preview or restricted availability Commercial Microsoft security capability Output Technical vulnerability evidence Organisational vulnerability insights and recommendations
A UK small business is more likely to consider Microsoft Defender products than to use MDASH directly. MDASH is relevant because technologies developed through this work may influence future Microsoft security capabilities.
MDASH vs Microsoft Security Copilot
Microsoft Security Copilot is a generative-AI security solution intended to assist security and IT professionals.
It can help analysts investigate incidents, summarise security information and work across supported Microsoft security products. MDASH is more specifically focused on discovering and validating vulnerabilities in code. Microsoft described an expanded MDASH preview and integration with Microsoft Defender during Build 2026.
A simple distinction is:
MDASH: Finds and investigates possible software vulnerabilities. Security Copilot: Helps security teams understand and respond to security information. Defender Vulnerability Management: Helps organisations identify and prioritise exposed assets and software weaknesses.
Benefits of AI-Assisted Vulnerability Discovery
Greater testing coverage
AI agents can examine large codebases and generate numerous test approaches.
This may reveal combinations that would be difficult to identify through a narrow manual review.
Faster evidence collection
A system can organise technical outputs, reproduce a failure and prepare information for specialist assessment.
Better prioritisation
When connected to organisational security data, a finding can be evaluated against factors such as internet exposure, affected systems and business importance.
Earlier security testing
Vulnerabilities are generally easier and less disruptive to fix when identified before software reaches production.
Support for developers
AI-assisted tools may help developers understand why a weakness matters and suggest possible remediation. However, proposed changes still need review and testing.
Limitations of AI Vulnerability Scanning
It can miss security problems
No tool can guarantee that an application contains no vulnerabilities.
Controlled results may not represent every environment
A strong benchmark score does not prove equal performance across all programming languages, architectures and deployment conditions.
False positives remain possible
A suspected issue may not create a realistic attack path.
Fixes can introduce new problems
An automatically suggested change may affect performance or functionality. Security fixes need code review and regression testing.
Skilled people are still required
Businesses need people who can interpret findings, assess business impact and make responsible decisions.
Advanced tools can create false confidence
Purchasing security software does not replace patching, backups, access control, monitoring and employee awareness.
Practical Cybersecurity Checklist for UK Small Businesses
You cannot patch or protect a system that nobody knows exists.
Prioritise critical updates
Create a documented process for assessing and installing security updates.
High-risk internet-facing systems should normally receive attention before low-impact internal tools.
Reduce administrator access
Employees should not use administrator permissions for routine work.
Review accounts when staff members, developers or contractors change roles or leave.
Enable multi-factor authentication
Use multi-factor authentication on email, cloud, hosting, administration and financial accounts where supported.
Back up essential data
Maintain backups that are separate from the main production environment.
Test whether important information can actually be restored.
Review third-party suppliers
Ask providers about:
Security updates Data processing Access controls Backups Incident notification Data locations Account termination Subprocessors Monitor and document incidents
Create a clear process for reporting suspicious activity, lost devices, exposed credentials and unusual account behaviour.
Frequently Asked Questions
What is Microsoft MDASH?
Microsoft MDASH is a multi-model agentic security system developed to discover, validate and help remediate software vulnerabilities.
Is MDASH available to UK small businesses?
Microsoft documentation described MDASH as a preview capability for eligible organisations rather than a standard self-service tool for every small business.
Did Microsoft AI find real Windows vulnerabilities?
Microsoft reported that MDASH contributed to discovering 16 previously unknown Windows vulnerabilities, including four critical remote-code-execution flaws.
Does AI replace penetration testing?
No. AI can support vulnerability discovery, but experienced professionals are still needed to validate findings, understand context and test business-specific risks.
Is Microsoft Security Copilot the same as MDASH?
No. Security Copilot assists security operations, while MDASH focuses more directly on discovering and validating code vulnerabilities.
Can AI guarantee that software is secure?
No. Security requires layered controls, ongoing testing, updates, monitoring and human oversight.
Should small businesses use vulnerability-management software?
It may be beneficial when a business operates several devices, services or cloud systems. The appropriate solution depends on risk, budget and technical complexity.
What should a business do after discovering a vulnerability?
It should confirm the affected systems, assess the risk, follow supplier guidance, test the remediation, deploy it safely and verify that the issue has been addressed.
Conclusion
Microsoft AI software vulnerability detection shows how cybersecurity research is moving from simple scanning towards coordinated, agent-based investigation.
MDASH can examine code, test theories and collect evidence for human researchers. Microsoft’s reported findings demonstrate real potential, but they do not eliminate the need for skilled review or traditional security controls.
For UK businesses, the practical lesson is straightforward: maintain visibility over your software, reduce unnecessary access, install security updates and prepare for vulnerability discovery to become faster on both sides of the security landscape.
Useful next steps
Explore AI tools, practical automation guides, or contact SaimServices if you need help applying this guidance to a specific business workflow.
How we evaluated this
This guide was researched using official product documentation and was not presented as a hands-on performance test.
Limitations: MDASH is a private-preview capability and Microsoft’s reported results came from specific tests and research contexts. It does not replace patching, asset management, human security review or a business-specific risk assessment.
