Microsoft’s MDASH AI code-scanning system is moving into pilot deployments across participating UAE government entities, alongside an expansion of the country’s National AI Test and Validation Lab. The aim is to help government teams find and assess software vulnerabilities before systems go live, bringing AI security tooling into public-sector testing and deployment.
Microsoft AI Watch analysis
What happened
Intelligent CISO reports that Microsoft, the UAE Cyber Security Council, Core42 and Open Innovation AI are advancing the rollout. The next phase includes pilots, technical workshops and onboarding, with Core42 providing sovereign-enabled cloud infrastructure and Open Innovation AI integrating MDASH into the national lab.
The report describes MDASH as using more than 100 specialised AI agents to examine code, identify weaknesses and assess whether vulnerabilities could be exploited. The expanded lab is intended to let participating government organisations assess software risks, including those in AI systems, before deployment. The partners have not disclosed how many entities will take part or a timetable for wider adoption.
Why it matters
This is a concrete move from making an AI security tool available to testing it in government workflows. If it works as intended, code scanning and vulnerability assessment could become part of how participating agencies check software before it supports public services. The rollout also pairs that tooling with locally controlled infrastructure, a significant feature for government systems handling sensitive information.
The report describes planned pilots and intended benefits, not measured outcomes. It does not establish how accurately MDASH identifies exploitable flaws or how quickly agencies will remediate them. Those are the numbers that will matter more than the impressive-sounding agent count.
Our read
The useful development is the deployment pathway: pilots, integration into a national testing lab and support for government teams. That makes this more than a product announcement, while leaving the important question of effectiveness open. Security teams should look for published results on vulnerabilities found, false alarms and fixes completed, rather than treating AI involvement as a security guarantee.
What to watch
- How many government entities take part in the initial pilots, and when wider deployment is expected.
- Whether the partners publish results on vulnerabilities identified and remediated.
- How MDASH performs against existing security review processes, including its false-positive rate.
Discussion spark: Should government agencies make AI-assisted code scanning a standard part of software checks, or require public evidence of its accuracy before relying on it?
Sources and evidence
not affiliated with or endorsed by Microsoft