Microsoft Deploys AI Vulnerability Scanners and a New Rollback Tool for Windows, Two Years After the CrowdStrike Disaster

The Problem Microsoft Is Trying to Solve

Windows runs on more than 1.5 billion PCs and servers worldwide. That scale makes it the biggest target on the internet, and AI is making the threat worse. Attackers can now scan for vulnerabilities and build exploits faster than human security teams can patch them.

Microsoft's answer, as laid out in a blog post by Pavan Davuluri, Executive Vice President of Microsoft's Windows and Devices division, is to fight automation with automation.

MDASH: The AI Agent Hunting for Bugs

The centerpiece of Microsoft's new strategy is MDASH — its Multi-Model Agentic Scanning Harness. According to ZDNet's coverage of Davuluri's post, MDASH "orchestrates more than 100 specialized AI agents across an ensemble of frontier and distilled models to discover, debate, and prove exploitable bugs end-to-end."

Microsoft introduced MDASH in May 2026. In its first operational cycle, the system found 16 vulnerabilities, four of them rated Critical. All 16 were patched in that month's security update before any known attacker exploited them.

Microsoft's Autonomous Code Security team built the scanning framework and has now stood up dedicated cloud-based pipelines to run MDASH at scale, filtering out false positives and surfacing high-confidence bugs to engineers faster than manual review allows.

The stated goal: shrink the gap between vulnerability discovery and the patch hitting customers, which is the window attackers call a zero-day.

Baked In, Not Bolted On

The bigger structural shift is where in the development process this scanning happens. Davuluri wrote that Microsoft is evolving its internal systems so that "vulnerability discovery is not treated as a separate activity, but as part of how we build, review and improve Windows before new features or updates are released."

That's a meaningful change from the traditional model, where security reviews often happened late in a release cycle. Catching bugs before code ships is cheaper and faster than patching after the fact.

The CrowdStrike Shadow

The second major announcement, Point-in-Time Restore, is harder to separate from one specific date: July 19, 2024.

At 12:09 AM Eastern that morning, a faulty CrowdStrike software update sent 8.5 million Windows machines — including systems at half the Fortune 500 and the top U.S. cybersecurity agency — into Blue Screen of Death reboot loops. The only fix at launch was a manual one: an administrator physically visiting each machine, booting into the Windows Recovery Environment, and deleting the defective file. CrowdStrike released an automated remediation tool three days later, on July 22, 2024.

Microsoft publicly committed to making Windows more resilient in the aftermath. The first product of that commitment, Quick Machine Recovery, arrived roughly one year after the incident. Point-in-Time Restore is the follow-on, released to all public Windows 11 builds at the end of June 2026.

What Point-in-Time Restore Actually Does

The name is accurate. The feature takes one daily snapshot of the entire system — operating system, applications, settings, and files — using the Windows Volume Shadow Copy Service, and retains the three most recent snapshots.

If a bad update, a corrupted driver, or a security incident destabilizes a machine, a user can boot into the Windows Recovery Environment and roll the system back to a prior snapshot. After three consecutive failed starts, Windows boots to the recovery environment automatically.

Storage overhead is modest. ZDNet tested two machines: a 128 GB system drive where two restore points consumed 2.2 GB, and a 700 GB drive where three restore points used about 9 GB. By default the feature caps itself at 2% of the system drive, and it shares space with Windows' existing system reserved storage.

The feature does require users to confirm it is enabled. It is not guaranteed to be active out of the box on every configuration.

The Fair Counterargument

The strongest skeptical case against Microsoft's AI security push is not that the tools are useless. An AI system scanning Microsoft's own code, developed by Microsoft's own teams, may have blind spots baked in by the same assumptions that produced the vulnerabilities in the first place. External researchers and independent security firms have historically found bugs that internal teams missed. Critics argue that centralizing vulnerability discovery inside one company's AI pipeline could create a single point of failure in the security review process itself, and that Microsoft has an obvious financial incentive to downplay how many bugs the system misses.

That concern is legitimate and not yet answerable. Microsoft has published the number of bugs MDASH found. It has NOT published a methodology for measuring what MDASH failed to catch, and no independent audit of MDASH's miss rate has been released.

What Remains Open

Point-in-Time Restore addresses a real gap: system-level rollback that works even when the OS can't fully boot. The storage footprint is small enough that most users won't notice it.

The MDASH program is harder to evaluate. Sixteen vulnerabilities found in one month is a real result, but the question Davuluri's post doesn't answer is how that compares to the number of vulnerabilities that exist in the Windows codebase and went undetected. Until Microsoft or an independent party publishes a systematic audit of MDASH's coverage, "16 bugs caught" is a data point, not a benchmark.

Microsoft has not announced a timeline for expanding MDASH findings to third-party software that runs on Windows, which is where the CrowdStrike failure originated.