Project Perception — Autonomous SOC Agents Break Budget Forecasts

Microsoft unveiled Project Perception on July 27, 2026 — an agentic security platform entering public preview on August 3 that coordinates three autonomous agent classes to simulate attacks, triage threats, and write patches against your live environment. It bills via Security Compute Units, the same metered consumption model that already blindsides teams on Security Copilot. The difference: these agents run continuous loops, not discrete analyst queries. The billing clock turns whether you are watching or not, and Microsoft has not published numeric SCU rates for any of the three agent classes.

TL;DR

• What: Project Perception ships three autonomous agent types (red/blue/green) coordinated through a security graph, with MAI-Cyber-1-Flash as the backbone model
• Billing: SCU-based pricing ($4/hr provisioned, $6/hr overage) with no published per-agent consumption rates — continuous agent loops make cost forecasting impossible before preview
• Benchmark caveat: The 95.95% CyberGym score belongs to the full MDASH harness (MAI-Cyber-1-Flash + GPT-5.4), not the model alone
• Action: Do not let agents run uncapped during preview. Treat Perception as a separate consumption pool from existing Security Copilot allocation

What Happened

Project Perception introduces three classes of autonomous agents into Microsoft’s security stack. Red team agents simulate attacks against your environment. Blue team agents detect and investigate the threats those simulations surface. Green team agents write and deploy patches to harden what was found. The three classes coordinate through a “security graph” and connect to Microsoft Defender via “actuators” — an abstraction layer Microsoft says keeps defenders in control.

The backbone model is MAI-Cyber-1-Flash, a 137-billion-parameter model with 5 billion active parameters and a 256k context length, purpose-built for vulnerability detection and repair. Inside the MDASH vulnerability management harness, MAI-Cyber-1-Flash handles roughly 90% of the workload and routes the hardest 10% to GPT-5.4. That split is where the cost claim originates: Microsoft says this configuration costs 50% less than the prior MDASH combination of GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex.

One correction matters here. Microsoft’s headline benchmark number — often rounded to 96% on CyberGym — is actually 95.95%, and it belongs to the full MDASH harness running both MAI-Cyber-1-Flash and GPT-5.4 together. It is not the standalone model score. That composite result outperforms Mythos by 12 points on the same benchmark. Impressive, but every number in this launch is self-reported. No independent third-party validation exists before the August 3 preview opens.

Why This Matters

The pricing structure is the story, not the model benchmarks. Project Perception bills via Security Compute Units — $4 per SCU per hour provisioned, $6 per SCU per hour overage for standalone customers. E5 tenants get 400 SCUs per month for every 1,000 paid E5 licenses, capped at 10,000 SCUs per month at no additional cost. These are the same SCU rates as Security Copilot, but the consumption profile is fundamentally different.

Security Copilot handles discrete analyst queries. A human asks a question, the system processes it, SCUs get consumed in a bounded interaction. You can look at your monthly query volume and roughly forecast spend. Project Perception’s agents run continuous attack-detect-remediate loops against a live environment. Microsoft confirmed that different agents consume SCUs at different rates depending on task intensity but declined to publish numeric per-agent SCU rates for any of the three agent classes. Teams running red/blue/green loops 24/7 have no pre-deployment cost model. You cannot forecast what you cannot measure, and you cannot measure what the vendor will not quantify.

Microsoft explicitly frames Perception as “AI that acts” vs. Security Copilot’s “AI that assists.” These are not the same billing surface. Do not assume your existing Security Copilot SCU allocation covers Perception — budget owners should treat it as a separate consumption pool from day one.

This matters because the pattern is now complete across Microsoft’s entire stack. In 90 days, Microsoft has shipped metered agent billing layers for development (MAI-Code + ACS), productivity (Work IQ), infrastructure (MXC), and now security (Perception). Each product creates a separate Azure consumption surface. Each uses a differently branded pricing unit while the underlying mechanism stays identical: you pay for compute consumed by agents you do not directly control. Teams running the full Microsoft stack now need a unified FinOps view across four distinct agent billing meters, none of which share a unit or a dashboard. If you thought Work IQ’s billing model was hard to forecast for productivity agents, imagine the same opacity applied to your SOC running continuous threat simulation.

The governance gap compounds the billing risk. Microsoft states that high-impact actions require human sign-off and that agents operate via actuators that keep defenders in control. But the launch documentation does not specify which actions count as “high-impact,” what the approval workflow looks like, or what green team agents can do autonomously versus what requires a gate. For a team scoping blast radius before enabling autonomous remediation agents in production, “humans remain in control” is a principle statement, not an implementation specification.

Before enabling green team (remediation) agents during preview, demand written documentation on which actuator actions execute autonomously and which trigger approval gates. If Microsoft cannot provide this, restrict green agents to read-only mode until the approval surface is documented.

The 50% cost savings headline deserves scrutiny too. That figure compares the new MAI-Cyber-1-Flash + GPT-5.4 configuration against a baseline Microsoft itself defined — the prior MDASH combination of GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex. It is a real comparison of real configurations, but it tells you nothing about your total Perception bill. Cutting model inference cost by half while running agents in continuous loops could easily net out to higher total spend than the discrete-query model it replaces. The per-operation cost went down. The number of operations became unbounded.

The Take

I have now watched Microsoft ship four distinct agent platform layers in four months, each with its own branded pricing unit, each consuming compute from agents you do not directly control, and each lacking a published per-operation rate card. Project Perception is the most consequential of the four because security teams operate under compliance constraints that make cost overruns harder to absorb politically than a bloated productivity tools bill.

The MXC sandbox gives agents a place to run. Work IQ meters what they do in Office. MAI-Code + ACS meters what they do in development. Perception meters what they do in your SOC. The architecture is consistent. The billing opacity is also consistent.

My recommendation: join the August 3 preview with hard SCU caps from day one. Do not enable green team agents until Microsoft publishes specific actuator approval gates. Run red and blue agents in a scoped environment — not your production tenant — and measure actual SCU consumption for 30 days before making any budget commitments. The technology behind Perception looks genuinely capable. The billing model looks genuinely unforecastable. Those two facts can coexist, and treating the preview invite as permission to let agents run uncapped is the most expensive mistake you can make this quarter.