Security models help analyze logs and incidents, find vulnerabilities in code and explain detected threats. In this field it is especially important that the model runs inside your perimeter and data stays in-house. Look at the model's specialization, hardware requirements and license terms.
Cisco models for information security based on Llama 3.1 8B: analysis of vulnerabilities, threats and incidents. Can be deployed inside your own perimeter.
A guard model that catches both harmful content and attacks on AI (prompt injection, jailbreaks), including when agents use tools.
A classifier from an IEEE S&P study: it separates ordinary requests to a language model from requests that order text and a page meant to deceive people. A human makes the decision on a disputed operation; automatic blocking without review is not acceptable.
An open NVIDIA bundle: a card-transaction graph plus a classifier, a profile of normal user behaviour, log parsing and root-cause search. A human makes the decision on a disputed operation; automatic blocking without review is not acceptable.
A Chinese open family for cybersecurity: reviewing vulnerabilities, analysing logs and traffic, explaining commands and scripts.
Security models from a large Turkish marketplace, published in GGUF format: reviewing alerts and incidents, English and Turkish.
One of the best-known open families for security and DevSecOps work: reviewing code for weaknesses, test scenarios, explaining attacks.
Trend Micro cybersecurity models based on Llama 3.1 8B, fine-tuned on a corpus of security texts. A reasoning version is available.
A very light classifier for emails and links showing signs of phishing. It errs in both directions, so borderline emails are still reviewed by a person.
A model pretrained on a large volume of logs from different systems: it turns a log line into a vector on top of which failure and outlier detection is fine-tuned. A human makes the decision on a disputed operation; automatic blocking without review is not acceptable.
A pair of models from an Italian university: they read a recorded command session and mark which parts belong to reconnaissance, persistence and other attacker steps. A human makes the decision on a disputed operation; automatic blocking without review is not acceptable.
A small open assistant for security professionals: questions about standards, reviewing threats and vulnerabilities, drafting internal documents.
A compact language encoder trained on cybersecurity texts: tagging threat reports, finding entities and classification.
An open model can run on your own server: data stays in-house, there is no per-request fee, and the model can be fine-tuned on your documents.
