Agentic AI Security with Microsoft MDASH and Project Perception
Published by O'Reilly Media, Inc.
Vulnerability discovery, AppSec, and AI-driven security operations
What you’ll learn and how you can apply it
- Evaluate MDASH findings using confidence, taint paths, type context, model adjudication, and independent verification
- Explain how MDASH covers agentic AppSec and how Project Perception covers coordinated security operations
- Map Project Perception’s context, agents, playbooks, identities, approval gates, actuators, and session records to a governed workflow
- Design a bounded agentic AppSec or SOC pilot with evidence thresholds, permissions, human approval, metrics, audit, failure handling, and rollback
Course description
Microsoft Codename MDASH and Project Perception represent two emerging frontiers in agentic cybersecurity. MDASH applies specialized AI agents to application security and source-code vulnerability discovery, helping teams prioritize risky code, identify and validate findings, assess confidence, reduce duplicate results, and support reviewable remediation. Project Perception applies coordinated Red, Blue, and Green agents to security operations, bringing together threat intelligence, reconnaissance, investigation, alert triage, detection authoring, and posture prioritization through shared context, governed playbooks, identities, approval gates, and audit records.
Designed for beginners, this course provides a foundational, high-level understanding of how these Microsoft technologies address complementary areas across AppSec, vulnerability management, SOC operations, threat hunting, detection engineering, incident investigation, exposure management, and agent governance. Guided hands-on walkthroughs introduce a MDASH-inspired find-and-validate workflow, SARIF results, proposed fixes, and independent rescanning without requiring deep implementation knowledge. Case-study group discussions help you interpret an MDASH finding and explore how Project Perception coordinates Red, Blue, and Green agents while preserving human oversight. You’ll leave with the core concepts and vocabulary needed to understand, evaluate, and discuss agentic AI security capabilities. No prior experience with MDASH, Project Perception, or machine learning is required.
This live event is for you because...
- You're an AppSec, product-security, SOC, detection, threat-hunting, incident-response, cloud-security, or AI-security practitioner.
- You work with source-code findings, vulnerability management, alerts, threat intelligence, security posture, or tool-using AI agents.
- You want to evaluate, pilot, and govern cutting-edge agentic security systems without confusing fluent output with verified evidence.
Prerequisites
- Working knowledge of common vulnerability classes, software-development workflows, and basic security alert or incident triage
- Proficiency in reading short Python examples and following command-line instructions
- Basic understanding of Microsoft security ecosystem like XDR, EDR, MDM, Sentinel, and Security Copilot
Recommended preparation:
- Download or clone the course repository (link to come)
Recommended follow-up:
- Take Zero Trust for AI Systems (live online course with Razi Rais)
Schedule
The time frames are only estimates and may vary according to how the class is progressing.
Agentic security foundations for AppSec and SOC (40 minutes)
- Presentation: Distinguishing scripts, scanners, copilots, single agents, and multi-agent systems using the perceive-reason-act-observe loop; Red, Blue, and Green roles, shared context, tools, identity, policy, evidence, and audit
- Group discussion: Classifying security examples by autonomy and action boundary
- Hands-on exercise: Place evidence and human gates based on blast radius
- Q&A
MDASH for agentic vulnerability discovery and remediation (40 minutes)
- Presentation: Prepare, specialist scan, taint and type validation, multi-model debate, deduplication, confidence, SARIF, remediation, and rescan
- Hands-on exercise: Find seven issues across six CWE classes, inspect evidence, change confidence thresholds, and export SARIF
- Group discussion: Triage a high-confidence MDASH finding, identify missing proof, assess developer impact, and decide whether to remediate, investigate, or defer
- Q&A
- Break
Project perception for coordinated Red, Blue, and Green operations (35 minutes)
- Presentation: Examine signals, context, models, harness, agents, actuators, identities, playbooks, approvals, and immutable sessions
- Hands-on exercise: Compare recon, threat intelligence, investigation, detection authoring, triage, and posture agents
- Group discussion: Respond to a threat-intelligence report by routing evidence across recon, threat intelligence, investigation, detection, and posture agents with explicit handoffs, authority, verification, and rollback
- Q&A
Wrap-up (5 minutes)
- Presentation: Resources for continued learning in agentic AI security; reflecting on the course’s key concepts and lessons; identify opportunities to apply this knowledge in your work.
Your Instructor
Razi Rais
Razi Rais is a cybersecurity and AI leader at Microsoft, with over 20 years of experience building secure, resilient systems for Fortune 500 companies worldwide. He brings a globally informed perspective to enterprise-scale security, shaped by hands-on experience living and working in Singapore, UAE, France, and the United States. His background spans engineering, architecture, and product management, giving him a unique lens on the evolving intersection of AI and cybersecurity. He drives enterprise efforts to secure AI at scale and address emerging threats using frameworks like the NIST AI Risk Management Framework, OWASP Top 10 for LLMs, and MITRE ATLAS. Razi has coauthored several books, including Zero Trust Networks, second edition, and Azure Confidential Computing and Zero Trust and is a frequent speaker at conferences such as RSA and Identiverse. He serves on the GIAC advisory board, is a Microsoft Certified Trainer and delivers AI and cybersecurity training worldwide. Connect with him on LinkedIn to follow his latest work.