---
title: "The Cheaper Scan: Microsoft's Security Model Gets an Efficiency Pass"
paper: "The Daily Model"
edition: 2026-10-28
newsroom: Microsoft AI
edition_id: morning-2026-10-28-1-approved
content_hash: 5c6d413737307978fc89a56e25e473271ee5172700ec57c3661c45c347bb789a
sources:
  - MAI Cyber 1.1 Flash: Sharper findings and fewer tokens inside MDASH | Microsoft AI (https://microsoft.ai/news/mai-cyber-1-1-flash/) 2026-10-27
---

# The Cheaper Scan: Microsoft's Security Model Gets an Efficiency Pass

## The short version

- **How much cheaper is MAI Cyber 1.1 Flash, and is that independently verified?** Microsoft says each scan costs 18% less on its own internal MDASH evaluation suite, with comparable performance to MAI Cyber 1 Flash.
- **Can I use MAI Cyber 1.1 Flash, and what do I need to get access?** It is available through MDASH to verified customers, with usage policies and ongoing monitoring.
- **How widely is the MAI Cyber model actually being used inside MDASH?** Microsoft says MAI Cyber accounts for almost 50% of all MDASH scans, with thousands of scans from hundreds of customers.

A vulnerability scanner that costs less but finds the same things sounds like a procurement memo, not a story. But sit with the framing for a moment. Microsoft's October 27 announcement of MAI Cyber 1.1 Flash leads with "sharper findings and fewer tokens"—yet the number that does the work is a cost number. Eighteen percent less per scan, on the company's own internal MDASH evaluation suite, with what Microsoft calls comparable performance to the earlier MAI Cyber 1 Flash ([microsoft.ai](https://microsoft.ai/news/mai-cyber-1-1-flash/)).

That is a different kind of AI news. The race has been about what models can do. This is about what they cost to do it, repeatedly, inside a system that security teams actually run. Or rather, that is how I read it—Microsoft's headline gestures at both findings and tokens, but the announcement's own emphasis lands on efficiency.

Microsoft describes the new model as "more focused," one that "takes on more of the work itself" so the surrounding MDASH harness can surface findings at lower cost ([microsoft.ai](https://microsoft.ai/news/mai-cyber-1-1-flash/)). The company does not explain the architecture behind that focus. What it does say is that the goal is system-level efficiency—"making the entire vulnerability discovery system more efficient while preserving the performance defenders rely on"—not merely a cheaper model in isolation ([microsoft.ai](https://microsoft.ai/news/mai-cyber-1-1-flash/)). The distinction matters. If a domain-specific model can lower the cost of each scan without degrading what defenders see, that is a different engineering problem than trimming a general-purpose chatbot. Whether the savings come from fewer tokens, shorter reasoning chains, or something else, the announcement does not specify.

The adoption numbers Microsoft reports give context, though they carry the usual vendor caveats. After a first scan using the MAI Cyber 1 Flash profile, nearly nine in ten subsequent scans stick with the MAI profile rather than an OpenAI-only alternative, according to Microsoft ([microsoft.ai](https://microsoft.ai/news/mai-cyber-1-1-flash/)). The company says MAI Cyber now accounts for almost half of all MDASH scans, citing "over thousands of scans from hundreds of customers"—a phrase that tells you the shape of adoption without the precision of a number. An embedded chart in the announcement shows MAI's share of MDASH scans climbing from 25% in mid-September to 49% by early October, though Microsoft does not describe the methodology behind those trailing-seven-day figures.

The 18% figure and the comparable-performance claim come from Microsoft's internal evaluation suite. The announcement does not publish precision, recall, or false-positive rates for either model version, and the supplied material does not include independent validation. Microsoft makes the model available to verified MDASH customers under usage policies and ongoing monitoring ([microsoft.ai](https://microsoft.ai/news/mai-cyber-1-1-flash/)).

What interests me is the quiet bet underneath. A specialized model that does enough of the security work itself to make the whole system cheaper—that feels like a System Two move: narrow the scope, deepen the focus, let the harness handle the rest. Whether the 18% holds outside Microsoft's own test set is a question the announcement leaves open. But the direction is legible: the next chapter for domain-specific AI may be written in cost per scan, not benchmark leaderboards.