Jane Edwards 
- Microsoft has introduced an agentic AI scanning tool for federal cybersecurity
- The tool relies on multiple AI models working together to flag and confirm security flaws
- Codename MDASH is now available to agencies through Azure Government
Microsoft has deployed codename MDASH, an agentic artificial intelligence-powered scanning system built to identify and validate software vulnerabilities, to Microsoft Azure Government, giving preview access to select U.S. government agencies and authorized partners.
Federal agencies face mounting pressure to secure their systems as AI reshapes both offensive and defensive cybersecurity tactics. The 2026 FedCiv Summit on Oct. 29 will bring together government and industry leaders to discuss AI adoption, trusted information sharing, digital labor, federal shared services, IT modernization and more. Sign up now to gain firsthand insights from leaders shaping federal civilian modernization priorities.
In a blog post published Tuesday, Douglas Phillips, president and chief technology officer of Microsoft Specialized Clouds, said the tool is designed to help defenders identify software weaknesses across complex supply chains before adversaries can exploit them, as threat actors increasingly turn to AI to search for gaps in mission-critical systems.
How Does Codename MDASH Support Government Cybersecurity?
Codename MDASH functions as an agentic code scanner that reads and analyzes software the way a human security researcher would, tracing how information moves through a program to determine whether a flaw is genuinely exploitable. Key elements of the system include:
- Multi-agent detection: More than 100 specialized AI agents, spanning multiple models, each trained to identify a distinct category of vulnerability.
- Adversarial review: A second set of agents evaluates those findings, weighing evidence for and against whether each suspected flaw is reachable and poses a genuine risk.
- Result refinement: The system merges and deduplicates findings and, where possible, demonstrates a vulnerability rather than simply flagging it, producing a prioritized list for security teams to act on.
- Benchmark performance: Microsoft said this multi-model, multi-agent design allows codename MDASH to score 96.55 on the CyberGym benchmark for real-world vulnerabilities.
According to Phillips, the system’s harness design lets it incorporate new AI models as they become available without requiring agencies to rebuild existing workflows. He added that Microsoft’s MAI model family is intended to keep the tool cost-effective, noting that the company’s newest model is expected to roughly halve the cost of an individual scan.
How Does Azure Government Support Codename MDASH?
Azure Government is an isolated cloud environment, staffed by screened U.S. persons, built to meet compliance requirements for federal, national security and state and local government customers, including FedRAMP High authorization and Department of War accreditation. Codename MDASH runs within Azure Government as a feature of Microsoft Defender, drawing on models available through the FedRAMP High-authorized Microsoft Foundry service, keeping an agency’s source code and related analysis inside an already-approved boundary.
According to Phillips, Microsoft has used codename MDASH on its own software for several months, with government customers across national security and civilian agencies now evaluating the tool. He described the defenders’ advantage as the time between when a vulnerability is found and patched and when it might otherwise be discovered and exploited.
How Has Microsoft Expanded AI Capabilities on Azure Government?
Codename MDASH marks Microsoft’s latest step in bringing AI-driven capabilities to federal agencies. In April 2025, Candice Ling, senior vice president of Microsoft’s federal business and a two-time Wash100 awardee, said AI would increasingly help defenders repel threats before they happen, rather than simply responding after an attack occurs.
Microsoft has since expanded the AI capabilities available to agencies on Azure Government, as Knox Systems partnered with the company to give commercial software companies a faster, more secure path onto the platform and SAS Viya’s AI and analytics platform went live on Azure Government for federal customers.
