Cybersecurity has traditionally been a reactive process.
Something suspicious happens. A security system detects it. An alert is generated. Then a person or another security tool tries to stop the threat before serious damage occurs.
This approach is extremely important. Modern security tools can detect malware, unusual login attempts, suspicious network activity, and many other signs that something may be wrong.
But what if cybersecurity could become more proactive?
Instead of waiting for an attacker to discover a weakness, what if artificial intelligence (AI) could search for vulnerabilities first?
That is an area Microsoft has been exploring with a system called MDASH. It uses a large collection of specialized AI agents to search for security weaknesses within Windows.
The idea is an interesting one because it changes where AI fits into the cybersecurity process.
Rather than only using AI to identify an attack that may already be happening, AI could help software developers discover and correct weaknesses before criminals have an opportunity to exploit them.
For businesses, this does not mean traditional cybersecurity practices are becoming outdated. In fact, strong security fundamentals remain just as important as ever.
But developments such as MDASH give us an idea of what the next generation of cybersecurity could look like.
MDASH is a security research system developed by Microsoft that uses more than 100 specialized AI agents.
Rather than relying on one AI model to perform every task, the system uses different agents to examine different areas and approach security problems in different ways.
Think of it somewhat like having a large security team.
One person might specialize in network security. Another might understand operating systems. Someone else might focus on applications, while another person investigates unusual behaviour.
Each specialist approaches a problem from a different perspective.
AI agents can work in a similar way. Different agents can be assigned different tasks, allowing them to work together on a much larger security problem.
Microsoft is using this approach to examine Windows for vulnerabilities that may otherwise be difficult to discover.
These vulnerabilities matter because software is extremely complicated.
An operating system such as Windows contains millions of lines of code and must interact with an enormous range of hardware, applications, networks, drivers, and services.
Even with careful development and testing, vulnerabilities can exist.
Finding those vulnerabilities before criminals do is one of the biggest challenges in cybersecurity.
Many cybersecurity systems are designed to identify signs of an attack.
For example, a security product might notice that an unknown program is suddenly changing hundreds of files. That could indicate ransomware.
Another system might notice repeated failed login attempts from an unusual location.
A network security tool might detect suspicious communication between a computer and a known malicious server.
In each situation, something has already happened that caused the security system to react.
Vulnerability research is different.
The goal is to identify a weakness before anyone uses it in a real attack.
That could mean finding a mistake in software code, identifying an unexpected way two components interact, or discovering that a system accepts information it should reject.
This is where AI agents could become particularly useful.
Computers are very good at performing repetitive tasks at a scale that would be difficult for people to match. If AI can also reason about what it discovers, test different possibilities, and identify unusual behaviour, it may help security researchers examine far more possibilities than they could manually.
The human security researchers are still important. But AI may give them a much larger set of tools to work with.
According to Microsoft, testing of MDASH has already resulted in the discovery of previously unknown vulnerabilities in important parts of Windows.
Some of the reported weaknesses were potentially serious.
This included vulnerabilities that could potentially have been exploited remotely. Remote vulnerabilities are especially concerning because an attacker may not need physical access to the computer to attempt an attack.
Depending on the vulnerability, successful exploitation could allow an attacker to run malicious code, interfere with a system, gain additional access, or perform other unauthorized actions.
Of course, finding a vulnerability does not automatically mean criminals were actively exploiting it.
That distinction is important.
Security researchers routinely discover vulnerabilities before there is evidence that attackers have used them. Once a vulnerability is found, developers can investigate it, create a correction, test the fix, and distribute an update.
Ideally, the weakness is removed before criminals ever get a chance to use it.
AI could potentially help accelerate that process by discovering more vulnerabilities earlier.
Finding possible security problems is only part of the challenge.
A useful security system also needs to be reasonably accurate.
Security professionals regularly deal with something known as a "false positive." This happens when a security system identifies something as potentially dangerous when it is actually harmless.
A few false positives may not seem like a major problem.
At a large scale, however, they can become a serious issue.
Imagine a security team receiving 1,000 alerts every day. If almost all of them are harmless, employees have to spend an enormous amount of time investigating things that are not real threats.
Eventually, important alerts may become harder to spot among all the noise.
This can contribute to what is sometimes called alert fatigue.
Microsoft has indicated that MDASH has performed well at avoiding unnecessary false alarms while still finding genuine vulnerabilities.
If AI-powered vulnerability research is going to become practical on a large scale, that kind of accuracy will be extremely important.
Finding thousands of theoretical problems is not particularly useful if engineers have to spend weeks discovering that nearly all of them are meaningless.
The value comes from helping security professionals identify vulnerabilities that genuinely deserve investigation.
The number of AI agents involved in MDASH may sound excessive at first.
Why would Microsoft need more than 100 of them?
One reason is the enormous complexity of modern software.
Windows is not a single application performing a single task. It is an operating system responsible for managing files, applications, memory, networking, user accounts, security permissions, hardware, and many other components.
Each of these areas can present different security challenges.
Using specialized AI agents allows the system to divide the work.
One agent might investigate a particular type of vulnerability. Another could examine a different component. Other agents might attempt to verify whether a suspected weakness can actually be reproduced.
This approach is part of a broader development in AI known as agentic AI.
Traditional AI tools usually wait for a person to ask a question or provide an instruction.
AI agents can potentially take a goal, perform a series of tasks, examine the results, and decide what step should come next.
That makes the technology particularly interesting for cybersecurity research, where discovering a vulnerability may require many separate steps.
Not anytime soon.
AI can process large amounts of information quickly, but cybersecurity involves much more than identifying unusual computer behaviour.
Security professionals need to understand business operations, risk, regulations, user behaviour, technology infrastructure, and the possible consequences of making changes.
They also need to make judgement calls.
For example, a vulnerability might be technically serious but exist in a system that is completely isolated from the internet. Another vulnerability may appear less severe but affect a critical business system that is exposed to many users.
Understanding the real-world risk requires context.
AI can assist with that work, but people remain responsible for deciding what risks matter, what should be fixed first, and how security changes should be introduced without creating other problems.
The more realistic future is probably one where cybersecurity professionals work alongside increasingly capable AI systems.
AI handles more of the repetitive searching, analysis, and initial investigation, while people provide oversight, context, verification, and decision-making.
There is another side to this development.
The same general capabilities that make AI useful to security researchers can also make it useful to criminals.
Attackers may use AI to automate parts of their work, analyze software, improve phishing messages, research targets, or look for possible weaknesses.
This creates something of a technology race.
Security teams gain better tools, but attackers gain new capabilities as well.
That is one reason businesses should not assume that AI will somehow make cybersecurity problems disappear.
The opposite may happen in some areas.
As attacks become easier to automate, organizations may need stronger security controls to keep up.
AI could help defenders identify threats more quickly, prioritize alerts, analyze unusual behaviour, and discover vulnerabilities. But those tools still need to sit on top of a strong security foundation.
The development of sophisticated AI security systems can make cybersecurity sound extremely complicated.
For most small and medium-sized businesses, however, some of the most important security risks are much more familiar.
Weak passwords remain a problem.
Missing security updates remain a problem.
Phishing emails remain a problem.
Poor access controls remain a problem.
Missing or unreliable backups remain a problem.
These issues are not as exciting as a network of more than 100 AI agents hunting for previously unknown Windows vulnerabilities, but they are often far more relevant to the day-to-day security of a business.
A company could invest in extremely advanced security technology and still be vulnerable if an employee account uses a weak password without multi-factor authentication.
Similarly, advanced threat detection cannot undo the damage caused by ransomware if an organization discovers that its backups have not been working for six months.
Cybersecurity works best in layers.
New technology can add another layer, but it should not replace the ones underneath it.
The vulnerabilities being investigated by systems such as MDASH also highlight why software updates are so important.
When a software company discovers a security vulnerability, it will often develop a patch to correct the problem.
That patch only protects a computer once it has been installed.
Businesses that delay security updates may continue operating systems with known weaknesses long after a correction has become available.
There can be legitimate reasons to test updates before installing them across an organization. Businesses need to make sure updates do not interfere with important applications or equipment.
But leaving systems unpatched indefinitely creates unnecessary risk.
A good patch management process provides a balance between testing updates and deploying important security corrections promptly.
Strong passwords are useful, but passwords alone are no longer enough protection for important business accounts.
Multi-factor authentication, commonly called MFA, adds another verification step.
That could involve an authentication application, a security key, biometric verification, or another method.
The advantage is simple.
If an attacker steals or guesses a password, the password alone may not be enough to access the account.
This becomes increasingly important as criminals use automated tools to target large numbers of accounts.
AI-powered security research does not change this basic principle.
Preventing unauthorized access remains one of the most effective ways to reduce cyber risk.
Backups are another fundamental security measure that can easily be overlooked.
It is not enough to simply have a backup system.
Businesses need to know that their backups are actually working and that important information can be restored when needed.
A backup that has never been tested is difficult to trust.
This is especially important when considering ransomware.
If an attacker encrypts business information, reliable backups can significantly improve the organization's ability to recover.
Backups should also be protected so that an attacker who gains access to the main network cannot simply delete or encrypt every backup at the same time.
Again, none of this involves futuristic AI.
It is basic cybersecurity, but basic does not mean unimportant.
Technology can only solve part of the security problem.
Employees also need to understand the risks they face.
Phishing remains one of the most common ways attackers try to gain access to accounts and systems.
These messages may attempt to create urgency, imitate a trusted organization, or convince someone to open a malicious attachment.
AI may make some fraudulent messages more convincing because attackers can generate professional-looking text quickly.
That makes user awareness increasingly important.
Employees do not need to become cybersecurity experts.
They do need to understand basic warning signs, know how to report something suspicious, and feel comfortable asking for help when they are unsure.
A business with knowledgeable employees creates another useful security layer.
MDASH is particularly interesting because it provides a glimpse of how AI could be used behind the scenes in cybersecurity.
Today, many people interact with AI through chatbots and assistants.
The next stage may involve far more AI systems that users never directly see.
An AI security agent could continuously analyze software for vulnerabilities.
Another could review security alerts and decide which ones deserve immediate attention.
Others could examine unusual network activity, compare new threats with previous attacks, or help security teams understand how serious a vulnerability might be.
For large organizations with thousands of computers, applications, users, and network connections, this kind of automation could be extremely valuable.
There is simply too much information for people to examine manually.
Small and medium-sized businesses may also benefit as these capabilities gradually become part of the security products and managed services they already use.
Businesses may not need their own team of 100 AI agents. Instead, AI capabilities may increasingly be built into the security platforms protecting their computers, cloud services, email, and networks.
It is easy to get distracted by new technology.
AI is developing quickly, and some of its potential cybersecurity applications are impressive.
But a business should not build its security strategy around whichever technology happens to be attracting the most attention.
Security is about managing risk.
That means understanding what systems and information the business depends on, who has access to them, what threats are most likely, and what controls can reduce those risks.
AI may help organizations do some of that work more efficiently.
It may help discover vulnerabilities that people would otherwise miss.
It may help security teams investigate alerts faster.
It may help prioritize problems so that the most serious issues are addressed first.
Those are meaningful improvements.
But they do not eliminate the need for patch management, multi-factor authentication, reliable backups, appropriate access controls, security monitoring, and employee awareness.
The most interesting part of Microsoft's work may not be the number of AI agents involved.
It is the shift in thinking.
Cybersecurity has always included preventative measures, but many security technologies focus heavily on identifying and responding to threats.
AI could allow more security work to happen earlier.
Instead of asking, "How do we stop this attack?" security teams may increasingly be able to ask, "Where could an attack happen, and can we fix that weakness first?"
That is an important difference.
No system will discover every vulnerability. No security technology can guarantee that an organization will never experience a cyberattack.
But finding more weaknesses before criminals do would give defenders an important advantage.
That is why technologies such as MDASH are worth watching.
They show how AI may become an increasingly important part of vulnerability research and cybersecurity operations.
At the same time, they are also a useful reminder that technology alone is never the whole answer.
The future of cybersecurity may involve AI agents working continuously in the background, searching for vulnerabilities and helping security teams respond faster.
But strong cybersecurity will still depend on getting the fundamentals right.
For most businesses, that means keeping systems patched, using strong authentication, controlling access carefully, maintaining reliable backups, monitoring for suspicious activity, and making sure employees know how to recognize potential threats.
AI may change the tools we use to stay secure.
The basic goal remains the same: reduce risk, give attackers fewer opportunities, and make it harder for a single mistake or vulnerability to become a serious business problem.
Robertson Technology Group helps small and medium-sized businesses across Canada manage their technology and cybersecurity without requiring a dedicated on-site IT team.
Based in Victoria, BC, we provide managed technology security and support solutions designed around each client's actual business requirements. That includes helping organizations maintain secure and reliable systems, manage updates, strengthen account security, protect important information, and understand where technology risks may exist.
As technologies such as AI become a larger part of cybersecurity, businesses still need a strong foundation underneath them. Robertson Technology Group combines appropriate technology with personalized support, taking the time to understand each client's environment rather than forcing every business into the same solution. If you would like to review your current technology or cybersecurity approach, get in touch with our team.