Edit

Codename MDASH - Agentic code scanner initiative (private preview)

Codename MDASH - Agentic code scanner is a dedicated page in the Microsoft Defender portal that surfaces code-level weaknesses detected by agentic code scanning across your connected repositories. It's purpose-built for findings generated by AI scanners and doesn't show findings from non-AI scanners.

Note

Scans reach this page from two origins — the Defender CLI and remote (portal-initiated) scans triggered through your connector. Remote results are labeled throughout the page so you can tell them apart from CLI results.

Use the page to:

  • View your agentic code security score at a glance and track how it trends over time.
  • Triage findings efficiently with AI classification that identifies immediate fixes, items to investigate, and items to defer.
  • Identify risk hotspots across repositories, files, and weakness types.
  • Review individual scans to see when they ran, what they found, and how the AI classified findings.
  • Filter, review, and export individual recommendations.

The page reflects activity from the last 90 days. Older scans and their findings aren't surfaced.

Understand triage: how AI groups findings

Before walking through each tab, it helps to know the three triage buckets the AI scanner uses to classify every finding. You see these counts on the Overview tab, on the Recommendations tab, and inside each scan.

Bucket What it means What you should do
Validated by AI scanner The AI is confident the finding is real, and its severity is high enough to matter. Act on this now - fix it, or triage it to a developer.
Flagged for review A high-severity finding the AI couldn't fully validate on its own. Pause - a human should investigate before acting.
Low priority Low- or medium-severity finding, regardless of how confident the AI is. Safe to defer or mute - background noise.

Each finding has a severity (Critical, High, Medium, Low) and a confidence level (Likely, Suspect, Unlikely). The combination determines the bucket - so you can jump straight to action.

Where scans come from: CLI vs remote

Every scan and finding carries signals so you can distinguish remote runs from CLI runs:

  • Source — Remote scan (with its SCM icon) or CLI.
  • Status — Succeeded, Running, Canceled, or Failed.
  • Tokens consumed — Tokens used by the run; shown as "—" while a run is still in progress.

Page layout

The Initiative page has three tabs:

Tab What it shows Branch scope
Overview Visual dashboard: score, 14-day score trend, triage funnel, latest scans, most common CWEs, and repos with the most recommendations Default branches (score, trend, triage funnel); all branches (latest scans); both default and all branches side by side (most common CWEs, repos with the most recommendations)
Security recommendations One row per finding, drawn from the latest scan of each (repository, branch) combination All branches — filter to default if you want
Scans Every scan that ran in the last 90 days, with drill-down into each run All branches

Note

The Overview score and triage funnel answer the question "What does my shipped code look like right now?" by convention, shipped code lives on each repo's default branch. The Recommendations tab is broader, so you can pivot freely across any branch.

Overview tab

A visual summary of your agentic code security posture. Six panels:

Score

A donut chart showing your agentic code score as a percentage of 0–100% (higher is better).

  • What it measures: Overall health of your code based on detected weaknesses, severity-weighted - more serious findings drag the score down more than minor ones.
  • Scope: Default branches only.
  • Clickable stats: Total recommendations and critical-severity recommendations.

Select Understand score calculation to see a detailed breakdown of how the score is computed.

Note

MDASH findings currently don't affect secure score or risk score. The only score currently impacted by MDASH recommendations is the Codename MDASH risk score in the MDASH initiative.

14-day score trend

A 14-day line chart shows how your score changes. Use it to confirm your remediation work is making a difference.

  • Scope: Default branches only.

Latest AI code scans

A chronological feed of the three most recent scans across all your repos and branches. Each row shows:

  • Repository and branch scanned
  • Total recommendation count
  • A colored bar breaking those recommendations into the three triage buckets:
    • Validated by AI scanner — with an Export action that downloads the findings to CSV in one click, ready for your organization's remediation workflow
    • Flagged for review
    • Low priority - count only
  • A View scan link that opens the full scan details drawer
  • Source and SCM — Remote scan or CLI
  • Run type — On demand
  • Status — Succeeded, Running, or Failed

Select View all scans to jump to the full Scans tab.

Note

This panel shows all branches because it's a chronological activity feed. It shows every recent scan so you can verify that your scans are running as expected, including on feature branches.

Repositories with the most recommendations

A table of repositories ranked by recommendation volume. Both default branch and all-branches counts appear side by side so you can compare scoped and full-coverage counts in one place. Use the following columns to review repository recommendation details:

  • Repository name
  • Default branch — number of recommendations found on the default branch
  • All branches — count of recommendations across all branches, including the default
  • View repository — jumps to the Recommendations tab filtered to that repo

Recommendation triage funnel

A visual breakdown of how your findings flow through severity and into the triage buckets.

Total findings (default branches)
   ├── Critical + High severity
   │       ├── Validated by AI scanner  → Export
   │       └── Flagged for review
   └── Low + Medium severity → Low priority

This panel is the only panel that visualizes the bucket logic explicitly. Use it to understand why findings are routed where they are, and to drill into any stage:

  • Selecting a stage opens the Security recommendations tab pre-filtered to that stage (always scoped to default branches - you can clear that filter to widen the view).
  • The Low priority endpoint is a side branch that collects your low- and medium-severity findings, regardless of confidence.
  • View critical recommendations is a one-click shortcut to your critical findings.

Scope: Default branches only.

Weaknesses with the most recommendations

A table of the most common weakness types (CWEs) found in your code. Both default branch and all-branches counts appear side by side so you can compare scoped and full-coverage counts in one place. Use the following columns to review weakness details:

  • Weakness ID (for example, CWE-89)
  • Name (for example, Improper Output Neutralization for Logs)
  • Default branch — number of recommendations found on the default branch
  • All branches — count of recommendations across all branches, including the default
  • Affected repositories
  • View recommendations — jumps to the Recommendations tab filtered to that CWE

Security recommendations tab

Your primary workspace for reviewing and acting on individual recommendations, drawn from the latest scan of each (repository, branch) combination. The view is scoped to default branches by default — switch to all branches when you want wider coverage.

Triage view (KPI cluster)

Four counts at the top of the tab show your overall triage breakdown:

  • Total – every current recommendation
  • Validated by AI scanner
  • Flagged for review
  • Low priority

Recommendations table

A filterable, sortable table where each row is one recommendation. Use the following columns to review recommendation details:

Column Description
Severity Critical, High, Medium, or Low
Confidence How sure the AI is the finding is real: Likely, Suspect, or Unlikely
Recommendation Title and description of the finding
Weakness ID CWE identifier, such as CWE-89
Repository The repository the finding belongs to
Branch The branch where the recommendation was detected
Trigger Combined column: Source (Remote scan with SCM icon · CLI) + Run type
File File path
Scan start time When the scan that produced this finding started

Filters

Default filters: Status, Risk (severity), Recommendation title, Time filter (default 90 days), Triage (bucket). Use +3 more or Add filter to bring in additional dimensions, such as Repository and Branch. Reset all clears them.

Default sort

  • Triage bucket: Validated by AI scanner → Flagged for review → Low priority
  • Severity within bucket: Critical → High → Medium → Low
  • Confidence within severity: Likely → Suspect → Unlikely

Take action

Action How to use it
Export Download the current (filtered) recommendation list for offline analysis or reporting.
Search by keyword Free-text search across recommendations.

How recommendations stay current

  • Latest scan only: Each row reflects the most recent scan for that (repository, branch). Once a newer scan runs and re-discovers – or no longer detects – a finding, the list updates automatically.
  • Persistent across scans: A finding stays on the list until the latest scan no longer detects it.
  • No findings from older, superseded scans: If you need to see what a historical scan found, drill into that scan from the Scans tab.
  • Spans CLI and remote sources: Latest-scan-wins applies across both the Defender CLI and remote scans for each (repository, branch).

Scans tab

Every successful scan that ran in the last 90 days – across every repository and branch.

KPIs at the top

  • Number of scans – total scans in the 90-day window
  • Repos scanned – distinct repositories represented
  • Succeeded – successful runs in the window
  • Running – runs in progress
  • Failed – runs that failed

Scans table

Each row represents one scan run:

Column Description
Status Status of the scan (currently, only successful runs appear)
Repository The repository that the scan process checked
Branch The branch that the scan process checked
Trigger Combined column: Source (Remote scan with SCM icon · CLI) + Run type
Tokens Tokens consumed by the run; "—" while Running or if canceled
Started When the scan started
Duration How long the scan took
Severity A stacked bar that shows the count for each severity level (Critical, High, Medium, Low)
Triage A stacked bar that shows the count for each triage bucket (Validated by AI scanner, Flagged for review, Low priority)
Run ID The scan's unique identifier (for example, run_d73220eb)

Filters

Status, Risk (severity), Recommendation title, Scan time, Time filter (default 90 days), plus +3 more / Add filter for additional dimensions (Repository, Branch, and more).

Drill into a scan

Select any row to open the scan details drawer, which has two subtabs:

Overview subtab

Section What it shows
Summary Started, Finished, Duration, Run ID and SCM Tool name.
Scan identity Trigger, Tokens consumed, Commit hash, Repository, Branch and Tool used
High-volume recommendations Most exposed file — file with the most findings, Most common CWE — the CWE with the most findings
Triage Count per bucket for this scan
Recommendations by severity A stacked bar of recommendations by severity, with a legend
Scan artifacts Ability to download the Scan Report, and SARIF generated by the Scanner

Recommendations subtab

The findings for this one scan run, scoped to that scan's branch. Includes:

  • Triage view — same three KPIs (Flagged for review, Validated by AI scanner, and Low priority), but scoped to this single scan
  • A table of findings with these columns: Severity, Validation (the triage bucket), Recommendation, Weakness ID, File
  • Same filtering, search, and export experience as the main Recommendations tab

Note

The main Security recommendations tab always shows the latest scan per branch. The drawer is the only place where you can see exactly what a specific past scan found at the moment it ran. This detail is useful for audits, incident review, or comparing two consecutive runs on the same branch.

Quick reference: which view to use when

If you want to… Go to
Get a one-glance read of your agentic code security posture Overview → Score + 14-day trend
Understand how the AI categorized your findings Overview → Recommendation triage funnel
See the most recent scan activity at a glance Overview → Latest AI code scans
Work through individual findings to fix them Security recommendations tab
Filter to a specific branch, repo, file, or CWE Security recommendations tab → Filters
See every scan that has run and how each performed Scans tab
See what a specific past scan found (point-in-time) Scans tab → select a row to open the drawer
Tell remote scans apart from CLI runs Any tab → Source / Run-type labels and filters
See a run's token cost and origin Scans tab → open a run → Summary

Data scope and freshness

  • 90-day visibility window: Only scans completed within the last 90 days appear anywhere on the page. Older scans and their findings drop off automatically.
  • Successful scans only: Running, failed, partial, or canceled scans aren't shown.
  • Aged-out scan links: Direct links to scans older than 90 days return a "Scan not found" response.

Next steps

  • Last updated on