Microsoft MDASH: Multi-Model Agentic Vulnerability Scanner Moves from Benchmark to Active Production Use Across Windows, Azure, and Identity

Microsoft disclosed June 17 that MDASH (Microsoft Security's multi-model agentic scanning harness) has moved from benchmark validation into active use across Windows, Azure, and identity engineering workflows. The system achieved 96.5% on the CyberGym 1,507-task benchmark ('any crash' metric), with projected >98% under newer models. New findings span Hyper-V, Windows kernel, Active Directory, Remote Desktop, HTTP.sys, DNS, and DHCP. MDASH integrates findings into GitHub Advanced Security, Azure DevOps, and Microsoft Defender with full ownership context. The remaining failure mode is proof-of-concept generation in complex environments, not initial bug discovery.

MDASH represents the shift from episodic security review to continuous AI-assisted engineering loops for one of the world's largest software platforms. Its integration into Windows and Azure developer workflows means vulnerability discovery tempo now potentially matches build frequency — a structural change in how Microsoft-ecosystem software is secured.

Enterprise security and platform engineering teams on Windows/Azure should monitor Microsoft's rollout; Windows admins should watch for faster patch cadence and more granular advisory detail as MDASH-discovered bugs reach disclosure.