In May 2026, Microsoft unveiled Project Perception in preview. It is an agentic security system in which three specialized AI agents — Red (attack simulation), Blue (threat detection and triage), and Green (vulnerability remediation) — operate as a single team, automating the entire security workflow without human intervention. Under the vision that "humans set the strategy; agents carry the load," Microsoft is shifting the paradigm of security operations from AI that assists to AI that acts.
Google, Palo Alto Networks, CrowdStrike, SentinelOne, and other competitors are also aggressively introducing similar agentic approaches. Will legacy security vendors adapt to this tide or be left behind? This column analyzes why LLMs have now become the center of security and the ripple effects that follow.
| # | Implication | One-line Summary |
|---|---|---|
| 1 | Paradigm shift: from assist to act | The era of AI only analyzing is over. AI now acts directly |
| 2 | Multi-agent orchestration | The Red-Blue-Green team structure is the ultimate form of layered automation |
| 3 | Crisis for legacy vendors | Existing SIEM/SOAR becomes functionally replaceable by a single model's reasoning capability |
| 4 | Redefining execution authority boundaries | In the age of AI acting, building "approval boundaries" in code is the core challenge |
1. What Is Project Perception?
1.1 Structure: Three Agents, One Team Play
The core of Project Perception is a multi-agent architecture in which Red, Blue, and Green agents collaborate organically.
| Agent | Role | Difference from Traditional Approach |
|---|---|---|
| Red Agent | Probes the environment like an attacker and discovers vulnerabilities | Annual/bi-annual external red team exercises → continuous automated vulnerability discovery |
| Blue Agent | Detects threats and classifies/investigates incidents | Human analyst collects logs and performs correlation → AI performs automatic triage with full context |
| Green Agent | Automatically remediates identified vulnerabilities and hardens systems | Manual response by patch managers → detection-to-remediation as a single continuous workflow |
The agents share intelligence with each other. A vulnerability discovered by Red is combined with Blue's threat intelligence, and Green remediates it — all without human handoff. Microsoft describes this as "a finding becomes a fix."
The three agents engage in loop engineering to improve security vulnerabilities and build defensive strategies.
1.2 Components
Project Perception is not merely an AI chatbot but an integrated system composed of six components.
| Component | Description |
|---|---|
| Agents | Red, Blue, Green agents covering the entire attack lifecycle |
| Models | Cybersecurity-specialized foundation models such as MAI-Cyber-1-Flash. A multi-model approach purpose-built for security, not a general-purpose LLM |
| Harness | A framework responsible for agent orchestration, testing, and control |
| Context | Real-time integrated context combining past incidents, policy decisions, identity relationships, and signals across endpoints, cloud, and applications |
| Signals & Sensors | End-to-end signals spanning endpoints, identities, cloud, and applications |
| Actuators | The execution mechanism that translates agent decisions into real-world actions. Performs actual changes, not mere recommendations |
1.3 Difference from Security Copilot
Microsoft clearly distinguishes the relationship between Security Copilot (a generative AI-based security assistant) and Project Perception.
Security Copilot = AI that assists Project Perception = AI that acts
Security Copilot is a helper that provides information to analysts, summarizes threats, and suggests response measures. Project Perception is an entity where agents directly scan the environment, attempt exploit verification, and apply patches. Both systems work together, but their center of gravity fundamentally differs.
1.4 Pricing Model
Project Perception uses a consumption-based, pay-as-you-go subscription model based on Security Compute Units (SCUs). The heavier the work an agent performs, the more SCUs it consumes, and costs scale proportionally with actual workload. This design allows security operations teams to adopt the system with a predictable cost structure.
AWS, Azure, and GCP are now introducing Agentic Security as paid models, and this trend will continue.
2. Why Agentic Security Systems Are Emerging
2.1 Growing Use of AI in Attacks
In July 2026, the autonomous AI agent that breached Hugging Face carried out 17,600 attack actions over 4.5 days without any human intervention. Within 13 hours of securing code execution on a single worker Pod, it had gained cluster-admin privileges across multiple internal clusters. The agent designed its own C2 protocol, obfuscated communications with chunk+XOR+compression encoding, and operated over 100 disposable dead-drop endpoints.
What this incident demonstrated is clear: attacks are already operating at machine speed. While a human analyst reads logs, correlates threats, and selects response playbooks, the attack completes thousands of attempts. If the defense side cannot operate at the same speed, the asymmetry becomes irreversible.
North Korea is also augmenting its limited cyberattack capabilities through LLMs, migrating older Go-based malware to Rust to evade antivirus detection.
2.2 Workforce Shortage and SOC Fatigue
The global cybersecurity workforce gap has surpassed 4 million (per the ISC2 2025 report). SOC analyst turnover averages less than two years. Filtering out false positives and identifying real threats amid an endless flood of alerts is becoming an increasingly overwhelming task for humans.
Agentic security systems address both problems simultaneously. The only defense that can match attack speed is a defense agent armed with the same technology stack, and the only way to compensate for the workforce shortage is a structure where a single human supervises multiple agents.
2.3 Explosion of Context
The modern enterprise environment is a vast signal space composed of endpoints, cloud, identities, SaaS applications, networks, OT/IoT devices, and more. Even a single threat leaves traces across dozens of heterogeneous log sources. It is physically impossible for a human to correlate all these signals in real time.
Project Perception's approach is to start from context, not data collection. Agents begin their work already having loaded the organization's entire context — past incidents, identity relationships, policies, real-time signals. This is "evidence-grade reasoning," not mere pattern matching.
3. A New LLM Approach to Protecting Cloud and Infrastructure
3.1 Why Existing ML Falls Short
Over the past decade, the security industry has evolved from signature-based detection → behavior-based analysis → machine learning (ML)-based anomaly detection. However, existing ML approaches have fundamental limitations.
Supervised learning models only detect known patterns. Zero-day vulnerabilities and novel attack chains cannot be detected because they do not exist in the training data.
Frequency-based anomaly detection lacks context. It cannot distinguish between "more login attempts than usual" being a legitimate new service launch or an attack.
The chain of reasoning cannot be explained. Even when an ML model outputs "87% threat probability," analysts cannot know the basis for that judgment.
LLMs learn from old vulnerabilities and reuse variants in open-source code that use similar patterns. They excel at leveraging long-context chains where individually low-severity vulnerabilities, when combined, become zero-day exploits.
3.2 What LLMs Provide
LLMs (Large Language Models) offer a fundamental bypass to these limitations.
| Traditional ML | LLM-Based Approach |
|---|---|
| Known pattern matching | Reasoning over unknown patterns |
| Single-signal judgment | Context integration of multiple signals |
| Black-box probability output | Natural language chain-of-thought |
| Static model, retraining needed | In-context learning adapting to new threats in real time |
Project Perception specifically uses the MAI-Cyber-1-Flash security-specialized foundation model. This is not a general-purpose LLM with a security context layer; it is a domain-specific model purpose-built for security. It features tokenizers and pre-training corpora optimized for CVE analysis, exploit chain reconstruction, attack graph generation, log forensics, and more.
3.3 The Technical Meaning of "AI That Acts"
Project Perception's Actuator is the component that converts an agent's reasoning results into actual system changes. This is not a recommendation (e.g., "apply this patch") but execution (applying the patch, changing firewall rules, disabling accounts).
At this point, Microsoft emphasizes the Human-in-the-loop principle. All high-impact actions require human approval, and every decision is auditable and reproducible. However, how this principle will be sustained at operational speed remains an unproven challenge.
4. Competitive Landscape — The Full Table of Agentic Security
Project Perception did not emerge alone. Major security and cloud vendors are simultaneously deploying similar strategies, signaling that this technology is not a passing fad but a structural industry transformation.
4.1 Competitive Platform Comparison
| Vendor | Product/Initiative | Approach | Differentiator |
|---|---|---|---|
| Project Naptime → Big Sleep | LLMs analyze binaries and source code to automatically discover zero-day vulnerabilities | Focused on vulnerability research (VR). Already discovered numerous real CVEs including SecureFlag, SQLite3 | |
| Palo Alto Networks | XSIAM + AIOps | SOC automation integrating 5,000+ ML models. Announced introduction of agentic security operators | Integrates SIEM, SOAR, and XDR into a single AI platform. Data advantage from vast installed base |
| CrowdStrike | Charlotte AI | Natural language-based threat hunting, incident analysis, and response automation assistant. Expanding agentic capabilities in 2026 | #1 in endpoint telemetry data scale. Tight integration with the Falcon platform |
| SentinelOne | Purple AI | Natural language-based security analysis. AI agents on the Singularity platform provide threat investigation and response guidance | Open architecture. Supports third-party LLM integration beyond in-house agents |
| Cisco | AI Defense + Hypershield | AI-based autonomous defense at the network and application layer. Distributed AI engines protect AI applications themselves | Network-layer approach. Focused on AI-to-AI attack defense |
| OpenAI | (Unofficial) Internal Red Team Evaluation Harness | Infrastructure for evaluating agent cyber capabilities, such as ExploitGym | Not a security product but an evaluation framework. However, as demonstrated by the isolation failure incident, it shows the dual-use nature of the same technology |
4.2 Core Competitive Dimensions
The security agent market sees competition unfolding along three dimensions.
| Dimension | Strategy | Representative Companies |
|---|---|---|
| Platform Bundling | Integrate AI agents into existing security portfolios. Maximize switching costs through bundled sales | Microsoft, Palo Alto, CrowdStrike |
| Data Advantage | Train agents on vast telemetry data. Achieve model performance that competitors cannot replicate | Microsoft (Office, Azure, Endpoint), CrowdStrike (Endpoint) |
| Open Ecosystem | Provide a platform not tied to any specific vendor, interoperable with various LLMs and tools | SentinelOne, Google |
Microsoft's greatest weapon is the depth and breadth of its data. Office 365 identity logs, Azure cloud telemetry, Windows Defender endpoint signals, LinkedIn and GitHub supply chain data — all integrated into a single context. This data integration capability is a moat that competitors will struggle to cross in the short term.
4.3 Open-Source Movement
Parallel to commercial vendor competition, open-source agentic security tools are also emerging.
- Burp Suite + AI Extensions: Combining LLM automation with web vulnerability scanning
- Semgrep + AI: Adding LLM-based context-aware vulnerability detection to static code analysis
- LangChain/LlamaIndex-Based Security Agents: Custom security agents built by the developer community
This trend signifies the democratization of agentic security. Where only large enterprises could deploy SIEM and SOAR in the past, even SMBs can now build basic agent-based security frameworks using open-source LLMs and frameworks.
5. Why LLMs as Agentic Security Systems Now?
5.1 Technological Convergence
The answer to "why now" lies in the simultaneous maturation of four technologies.
| Mature Technology | State | Security Implication |
|---|---|---|
| LLM Reasoning Capability | Multi-step reasoning at GPT-5/Claude Opus level. Code generation at production grade | Vulnerability analysis and exploit chain reconstruction become automatable |
| Agent Frameworks | Standardized tool-calling and chaining infrastructure — MCP (Model Context Protocol), LangChain, etc. | LLMs can call APIs, compose tools, and execute multi-step tasks |
| Context Windows | Processing 1–2 million tokens of long-form context | Massive logs, incident records, and codebases can be loaded at once for inference |
| Compute Costs | SCU-based consumption billing + declining inference hardware costs | Economic viability even for large-scale SOC operations |
In 2023, GPT-4 could respond to "read this code and explain the vulnerability." By 2026, LLMs can execute the sequential command: "scan this environment, find vulnerabilities, verify exploits, and apply patches."
5.2 Structural Change in Attack Surface
Another critical driver is that the attack surface itself has become LLM-friendly.
- Everything in cloud-native environments is defined as code (IaC) → LLMs can read and analyze it as text
- API security has become the largest attack surface → API specs, logs, and traffic are all text-based
- Software supply chains have become complex → SBOMs and dependency graphs are graph data that LLMs naturally process
- Identity has become the new perimeter → Millions of identity relationships reduce to inference problems
While traditional security tools struggle with these text, graph, and API-centric attack surfaces, LLMs have inherent strengths in this domain.
5.3 The Warning from the Hugging Face Incident
The July 2026 Hugging Face breach provided decisive empirical evidence for this entire discussion.
- Offensive side: OpenAI's GPT-5.6 plus a pre-release model, with guardrails disabled during ExploitGym evaluation, independently discovered a zero-day vulnerability and chained it to penetrate Hugging Face's production environment.
- Defensive side: Hugging Face attempted to use Claude Opus and Fable for breach log analysis but was blocked by guardrails. They ultimately ran NVIDIA-quantized GLM-5.2 on their own infrastructure to complete the forensic analysis.
The lesson: AI on offense, AI on defense. Introducing AI on only one side is no longer an option. The question has shifted from "should we use AI?" to "which AI, under what controls?"
6. The Future of Existing Security Solution Vendors
6.1 The Essence of the Crisis
The question that agentic systems like Project Perception pose to existing security vendors is simple:
If a single AI agent can do what your product does, how will your product prove its value?
This question applies step by step.
| Existing Market | Threat | Impact |
|---|---|---|
| SIEM (Security Information Event Management) | AI directly correlates and triages logs. Dashboards become unnecessary | 🔴 Very High |
| SOAR (Security Orchestration, Automation and Response) | AI dynamically generates and executes playbooks instead of human-defined ones | 🔴 High |
| Vulnerability Scanners | Red Agent provides continuous automated vulnerability discovery | 🟡 Medium |
| Intrusion Detection Systems (IDS/IPS) | Blue Agent performs behavior-based anomaly detection; signatures become unnecessary | 🟡 Medium |
| Patch Management Tools | Green Agent integrates detection-to-remediation into a single continuous automation | 🟡 Medium |
| Red Team Services | Internalized via Red Agent. Consulting demand decreases | 🟡 Medium |
6.2 Survival Strategies: Three Paths
Security vendors can pursue broadly three strategies.
Path A: Platform Integration (Microsoft Strategy)
Recompose the entire security product portfolio into a single AI platform and integrate all telemetry into one context. Compete on data network effects rather than individual products. Microsoft, Palo Alto, and CrowdStrike have chosen this path.
Prerequisites: (1) Vast telemetry from diverse product lines, (2) AI model training and operations infrastructure, (3) Years of engineering investment for cross-product data integration.
Path B: Specialized Domain Focus (Best-of-Breed Strategy)
As AI becomes more general-purpose, ultra-precise domain expertise gains value. Examples include OT/IoT security, medical device security, and automotive cybersecurity — areas with stringent regulations and critical domain knowledge.
Prerequisites: (1) Domain-specific training data not easily obtainable by general AI, (2) Regulatory certification barriers, (3) Workflows deeply embedded in customer environments.
Path C: Riding on AI (Ecosystem Strategy)
Instead of developing in-house AI, provide specialized tools that integrate with Microsoft's or Google's agent platforms. SentinelOne's open architecture approach is close to this.
Prerequisites: (1) Rapid adaptability to platform standards (MCP, APIs, etc.), (2) Legitimate differentiation points that platform vendors won't absorb.
6.3 M&A Outlook
The agentic security transition is expected to trigger significant M&A activity.
- SIEM/SOAR Startups: High probability of acquisition by large platform vendors. A segment where independent survival is difficult.
- AI-Native Security Startups: Startups with security-specialized foundation models are expected to command premium valuations.
- Legacy Vendor Acquisitive Defense: Large SIEM and firewall vendors are likely to aggressively acquire AI startups for survival.
6.4 Speed of Change
The pace of transition depends on three variables.
- AI Reliability: If agents cause large-scale disruption through false positives or malfunctions, trust recovery will take years.
- Regulation: How quickly certification for systems where "AI acts directly" is established in regulated industries like finance, healthcare, and defense.
- Workforce Reskilling: The speed at which existing security personnel transition to AI agent supervision roles. Technology alone does not bring the organization along.
As a realistic estimate, 2026–2028 is a transitional period. SIEM and SOAR will still exist but their value will decline sharply. After 2029, AI-agent-centric security operations are expected to become mainstream.
7. Investment Perspective — Who Wins and Who Loses?
7.1 Beneficiary Groups
| Group | Rationale |
|---|---|
| Microsoft | Integration of Project Perception + Azure data + M365 ecosystem. Most advantageous position in agentic security |
| Palo Alto Networks | Early start transitioning with XSIAM's vast data + platform strategy. Central to SIEM/SOAR market restructuring |
| CrowdStrike | Data advantage in endpoint telemetry. Charlotte AI strengthens Falcon ecosystem retention |
| Security-Specialized Foundation Model Startups | Scarcity of domain-specific security models like MAI-Cyber-1-Flash. Premium M&A targets |
| Cloud Infrastructure | Increased demand for GPU and inference infrastructure to operate agents. AWS, Azure, GCP beneficiaries |
7.2 At-Risk Groups
| Group | Rationale |
|---|---|
| Small/Mid-Sized SIEM Vendors | AI rapidly replaces dashboard and rule-based detection. Differentiation evaporates |
| Legacy SOAR | Playbook automation is rigid compared to AI's dynamic response. Functional replacement |
| Low-End Security Consulting | Basic penetration testing and vulnerability assessment being internalized by AI |
| Low-End MSSP | Simple 24/7 monitoring services face AI substitution pressure |
7.3 Key Metrics to Watch
- SCU Consumption vs. SIEM License Revenue: The moment Project Perception's SCU consumption trend surpasses SIEM license revenue marks the inflection point.
- MSSP AI Agent Adoption Rate: The speed at which MSSPs integrate AI agents into customer services. Faster adoption correlates with greater erosion of the traditional SOC outsourcing market.
- Security Job Posting Trends: Declining "SIEM analyst" postings and rising "AI security agent operator" postings as quantitative indicators.
8. Remaining Challenges and Open Questions
8.1 Execution Authority Boundaries — Who Watches the AI's Black Box?
Human-in-the-loop is a powerful principle, but it raises thorny questions in practice.
- How do you triage which of the thousands of alerts require human approval?
- Attacks continue to spread during approval wait times. Where is the balance between speed and control?
- Is "human judgment" consistently superior to AI judgment?
As the Hugging Face report noted, the only solution is to establish trust boundaries at the execution layer, not the model's judgment layer. The question is how to technically implement this boundary.
8.2 Unpredictability of Inter-Agent Interactions
When Red Agent discovers a zero-day, Blue Agent classifies it as a false positive, and Green Agent applies the wrong patch — debugging multi-agent interaction errors is extremely difficult. With just three agents, possible interaction paths increase exponentially.
8.3 The Shadow of Regulation
- EU AI Act: If classified as "high-risk AI," security agents must pass rigorous conformity assessments.
- South Korean AI Basic Act: Obligations for high-impact AI operators. The legal interpretation of "AI autonomously operating security infrastructure" is not yet established.
- United States: No federal guidance on adopting AI security tools. FedRAMP certification criteria do not contemplate agentic systems.
8.4 Security of Security AI — Quis Custodiet Ipsos Custodes?
What happens when the agentic security system itself becomes a target? Agent prompt injection, man-in-the-middle attacks on MCP connectors, context data poisoning — the problem of "guarding the guards" is no longer just a Latin aphorism but a real architectural design challenge.
9. Closing — From Spreadsheet to Oracle to Combatant
I have previously written that "LLMs are spreadsheets for computation, not oracles for finding the right answer." That thesis unfolds another layer with the emergence of Project Perception.
LLMs have now become combatants on the cyber battlefield.
AI that attacks, AI that defends, AI that recovers — all derived from the same technology stack. The difference lies in the objective function and execution authority. The attack agent races toward its target with guardrails off, while the defense agent must match that speed with guardrails on. This asymmetry exists.
However, this asymmetry is less a technology problem than a design problem. Attackers can turn off safety measures. Defenders cannot. This is precisely the convergence point where policy, regulation, and governance must catch up with technology.
From an investor's perspective, agentic security is not a single market but a meta-trend that restructures the entire existing security market. SIEM, SOAR, vulnerability management, penetration testing — each a multi-billion-dollar market — will be reshaped one by one by AI agents. Those who read the direction of this restructuring will read the security market of the next five years.
In the age where AI takes charge of security, the true winner is not AI, but those who precisely design the execution boundaries of AI.
References
| Source | Content |
|---|---|
| Microsoft, "Project Perception — Agentic System" (2026-05) | Primary source. Product overview, components, FAQ |
| Microsoft, "Announcing Project Perception" Blog (2026-05) | Launch background and strategic vision |
| Hugging Face, "Anatomy of a Frontier Lab Agent Intrusion" (2026-07-27) | Empirical case of agentic attack. 17,600-action forensic analysis |
| OpenAI, "Hugging Face model evaluation security incident" (2026-07-21) | Offensive perspective. Acknowledgment of ExploitGym evaluation control failure |
| Google, "Project Naptime: Evaluating Offensive Security Capabilities of LLMs" | Google's agentic vulnerability research approach |
| Palo Alto Networks, "XSIAM: The AI-Driven SOC Platform" | Competitive platform analysis reference |
| CrowdStrike, "Charlotte AI" product documentation | AI-native security assistant |
| SentinelOne, "Purple AI" product documentation | Open AI security platform |
| ISC2, "Cybersecurity Workforce Study 2025" | Global cybersecurity workforce gap statistics |
| South Korea Ministry of Science and ICT, AI Basic Act and Enforcement Decree (effective 2026-01-22) | Domestic regulatory framework |
TLP:CLEAR — No distribution restrictions. Technical details in this column are based on publicly disclosed primary sources and official statements.
This article is for informational purposes only and is not investment advice.