---
type: "post"
id: "microsoft-details-mdash-multi-model-ai-scanner-for-bb563a"
slug: "microsoft-details-mdash-multi-model-ai-scanner-for-bb563a"
title: "Microsoft details MDASH multi-model AI scanner for Windows vulnerability discovery"
description: "Microsoft says it is using AI across Windows vulnerability discovery, remediation, validation, and deployment."
retrieval_nugget: "Microsoft says it is using AI across Windows vulnerability discovery, remediation, validation, and deployment. Its MDASH scanner combines multiple models and specialized agents, with engineers reviewing findings; the company says Windows’s October 2026 security update addressed more than 1,100 CVEs. The account illustrates how automated discovery depends on human review and patch deployment."
published_at: "2026-11-06"
updated_at: "2026-11-06"
record_date: "2026-11-06"
date_kind: "published_at"
topics: ["agent-security"]
entities: ["Microsoft","MDASH","Windows","Microsoft Security Response Center","Security Update Guide","Common Security Advisory Framework","Vulnerability Exploitability eXchange"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "Microsoft’s new update details broader AI-enabled vulnerability management across discovery, remediation, validation and deployment, extending its earlier MDASH model release."
prior_refs: ["https://newruntime.com/posts/mai-cyber-1-1-flash-sharper-findings-and-01681c/"]
source_url: "https://blogs.windows.com/windowsexperience/2026/11/05/a-new-standard-for-vulnerability-management-in-the-ai-era"
source_urls: ["https://blogs.windows.com/windowsexperience/2026/11/05/a-new-standard-for-vulnerability-management-in-the-ai-era"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:microsoft-details-mdash-multi-model-ai-scanner-for-bb563a"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/microsoft-details-mdash-multi-model-ai-scanner-for-bb563a/","markdown":"https://newruntime.com/posts/microsoft-details-mdash-multi-model-ai-scanner-for-bb563a.md","json":"https://newruntime.com/posts/microsoft-details-mdash-multi-model-ai-scanner-for-bb563a.json"}
markdown_url: "https://newruntime.com/posts/microsoft-details-mdash-multi-model-ai-scanner-for-bb563a.md"
---

# Microsoft details MDASH multi-model AI scanner for Windows vulnerability discovery

## Retrieval answer

Microsoft says it is using AI across Windows vulnerability discovery, remediation, validation, and deployment. Its MDASH scanner combines multiple models and specialized agents, with engineers reviewing findings; the company says Windows’s October 2026 security update addressed more than 1,100 CVEs. The account illustrates how automated discovery depends on human review and patch deployment.

## Summary
Microsoft says it is using AI across Windows vulnerability discovery, remediation, validation, and deployment. Its MDASH scanner combines multiple models and specialized agents, with engineers reviewing findings; the company says Windows’s October 2026 security update addressed more than 1,100 CVEs. The account illustrates how automated discovery depends on human review and patch deployment.

## What happened
In a November 5, 2026 post, Nuno Costa, Microsoft’s Partner Director for Windows Servicing and Delivery, describes the company’s approach to vulnerability management as AI makes it possible to discover and analyze vulnerabilities faster. Microsoft says the acceleration cuts both ways: defenders can find and fix issues earlier, while attackers can search for vulnerabilities before fixes are available and analyze public fixes after release.

The post’s example for discovery is MDASH, described as an agentic code scanner using multiple AI models and specialized agents to find and validate potential vulnerabilities. Microsoft says security and engineering teams review the findings and decide how to respond. Its stated objective is not simply to find more issues, but to identify meaningful vulnerabilities earlier and make results more actionable, including by distinguishing relevant findings from false positives. The post does not identify the models, quantify MDASH’s detection performance, or report a comparison against other scanners.

Microsoft says it is applying AI assistance to remediation work as well: assessing impact, identifying affected Windows versions and related code variants, considering remediation options, planning backports across versions, and building security and regression tests. Engineers remain responsible for reviewing this work, making engineering decisions, and owning the output. For validation, Microsoft lists internal flighting, functional and security proof-of-concept testing, application compatibility testing, and input from OEMs, security vendors, ISVs, and customers through its Security Update Validation Program. AI-assisted capabilities support test selection and creation, triage, analysis, and reporting.

The company says the October 2026 monthly security update addressed more than 1,100 Windows CVEs. It cautions that the number alone does not describe the security state: Microsoft attributes higher counts to examining more code and finding and closing more vulnerabilities. Its Security Update Guide provides severity, impact, exploitability, and guidance for addressed CVEs. Microsoft also says it publishes machine-readable CSAF advisories, VEX documents, and an API. Windows security updates are cumulative; the post recommends deciding which devices update first based on exposure, rather than choosing which fixes to deploy.

## What the archive adds
This is a new Microsoft-specific account in a continuing vulnerability-scanning story, not a restatement of the earlier scanner launches. [Anthropic’s OSS Scanner](https://newruntime.com/posts/anthropic-launched-oss-scanner-a-free-opt-in-d84c9b/) focused on opt-in scanning for critical open-source projects; [its first public scorecard](https://newruntime.com/posts/oss-scanner-s-first-public-scorecard-114-projects-332e2c/) added adoption and findings. [Cloudflare’s OpenAI case](https://newruntime.com/posts/cloudflare-links-vulnerability-discovery-to-defense-with-openai-10fe99/) reported operational results. Microsoft adds a description of integrating AI across a vendor’s own discovery, remediation, validation, and update process.

## Trend signal
This supports the pattern that security for agents and AI-assisted systems depends on operational controls, not merely model behavior: [Agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/). Microsoft’s account places review, testing, coordinated response, and deployment around automated discovery. The source does not detail MDASH’s runtime safeguards, so it is evidence for the broader importance of system boundaries, not proof that this particular scanner implements them.

## Why now
Microsoft frames the timing around faster vulnerability discovery and the possibility that attackers can analyze fixes once they become public. The company says it is prioritizing fixes as vulnerabilities are identified and encourages organizations to measure protection in days from release. It also points to optional non-security preview updates as a way for organizations to validate upcoming content on selected devices before it enters the following month’s security update.

## Why it matters
For security teams, the case is a reminder that AI discovery changes more than the scanning step. More findings can create a larger review and remediation queue, so teams need a process that links evidence to ownership, testing, and deployment priorities. Microsoft’s own description keeps engineers accountable for decisions and pairs discovery with compatibility checks, proof-of-concept testing, and validation from external participants.

The reported figure of more than 1,100 CVEs is not a measure of MDASH’s effectiveness: Microsoft does not say how many the scanner found, how many were AI-assisted, or how many would otherwise have remained undiscovered. Still, the operational framing is useful. Teams evaluating AI-assisted security tooling should ask not only whether it finds issues, but how findings are validated, routed to responsible engineers, translated into safe fixes, and tracked to deployed protection. Cumulative updates make prioritization a question of which devices receive protection first.

## Limits and uncertainty
The post is a first-party description from Microsoft, not an independent evaluation of MDASH. It gives no scanner benchmark, model names, false-positive rate, confirmed vulnerability count attributable to the tool, or comparison with human-led discovery. The more-than-1,100 figure covers Windows CVEs addressed in the October 2026 monthly security update; the source does not say these were all found by AI or by MDASH. It also does not quantify changes in time to remediation, patch adoption, or attacker capability. The described process and machine-readable data formats are Microsoft’s account of its own practices, not evidence that every organization can reproduce them.

## Reader takeaway
MDASH is one part of Microsoft’s broader effort to apply AI across vulnerability management, but the source presents human review, testing, and deployment as essential parts of the system. The practical measure is not how many findings a scanner produces; it is whether teams can validate meaningful issues and get appropriate protection onto exposed systems quickly.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Agent Security](https://newruntime.com/topics/agent-security.md): Explore the agent-security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)