Open-weight security models
A survey of every open-weight cybersecurity model shows the market pays for classifiers, not chatbots.
No open-weight "cyber brain" model has published a result against a frontier flagship and won. The two vendor programs worth taking seriously (Cisco, Trend Micro) benchmark against same-size open baselines or the cheapest frontier tier, and even then Cisco's own reasoning model loses to GPT-5-Nano on the one benchmark that looks like real reasoning. Meanwhile the most-used artifacts in the entire category aren't chat models at all — they're small classifiers. That fact alone should reshape what "build a defensive cyber model" means for a new lab in 2026.
#The master table
Every actively-maintained open-weight security model found in this survey, base model, and what it actually claims.
| Model | Base | Params | Trainer | Released | License | Downloads/mo* | Real adoption signal |
|---|---|---|---|---|---|---|---|
| Foundation-Sec-8B | Llama-3.1-8B | 8B | Cisco Foundation AI | 2025-04 | Apache 2.0 | 7,689 | base checkpoint, mostly superseded |
| Foundation-Sec-8B-Instruct | Llama-3.1-8B | 8B | Cisco Foundation AI | 2025-08 | "Other" (NOTICE.md) | 24,545 | shipped in Cisco XDR |
| Foundation-Sec-1.1-8B-Instruct | Llama-3.1-8B | 8B | Cisco Foundation AI | 2025-11 | "Other" | 44,915 | most-downloaded Cisco checkpoint |
| Foundation-Sec-8B-Reasoning | Llama-3.1-8B | 8B | Cisco Foundation AI | 2026-01 | "Other" | 7,798 | loses to GPT-5-Nano on CTI-Reasoning (confirmed) |
| Llama-Primus-Base/Merged/Reasoning | Llama-3.1-8B-Instruct | 8B | Trend Micro | 2025-02 | MIT + Llama 3.1 license | n/a | +15.9% aggregate vs base |
| Llama-Primus-Nemotron-70B | Llama-3.1-70B/Nemotron | 71B | Trend Micro + NVIDIA | 2025-02 | MIT + Llama license | 692 | +18% lift, flat general capability |
| WhiteRabbitNeo-33B-v1.5 | DeepSeek-Coder-33B | 33B | WhiteRabbitNeo | 2024-02 | DeepSeek + WRN Extended (non-OSI) | 282 | no new base model in 22 months |
| WhiteRabbitNeo-2.5-Qwen-7B | Qwen2.5-Coder-7B | 8B | WhiteRabbitNeo | 2024-10 (last release) | Qwen + WRN Extended | low | stalled |
| DeepHat-V1-7B | Qwen2.5-Coder-7B | 7.6B | DeepHat / Kindo.ai | 2025 (undated) | Apache-2.0 + Extended | 14,701 | out-downloads all of WhiteRabbitNeo combined, zero published benchmarks |
| ZySec-AI/SecurityLLM | Mistral/Zephyr-7B | 7B | ZySec AI | undated | Apache 2.0 | 508 | embedded in 26 HF Spaces |
| Lily-Cybersecurity-7B-v0.2 | Mistral-7B-Instruct | 7B | Sego Lily Labs | undated | Apache 2.0 | 865 | community "-Uncensored" GGUF exists |
| SecureBERT | RoBERTa-base | 125M | Aghaei et al. (academic) | 2022 | bigscience-openrail-m | 6,376 | most-cited academic cyber encoder |
| SecBERT | BERT, custom vocab | 84.1M | jackaduma (independent) | undated | Apache 2.0 | 82,137 | biggest generative-adjacent artifact in the category |
| ATTACK-BERT | MPNet | ~110M | "basel" (independent) | undated | Apache 2.0 | 26,072 | maps text to MITRE ATT&CK |
| CySecBERT | bert-base-uncased | 110M | TU Darmstadt | 2022/2024 | Apache 2.0 | 1,508 | ACM-documented |
| Llama Guard 4-12B | Llama 4 | 12B | Meta | 2025-04 | Llama 4 Community (700M MAU gate) | 141,228 | dwarfs the entire category |
| Llama-Prompt-Guard-2 | custom classifier | 86M/22M | Meta | 2025-04 | Llama license | high | jailbreak/injection detection |
*Downloads/month is the Hugging Face counter as of 2026-08-29 — a directional adoption signal, not a precise usage count. Several numbers in this category look mirror-inflated (see caveat below), so treat relative gaps between rows as more meaningful than absolute values.
Models searched for but not found as distinct, adopted artifacts: "SecGPT" (the name is more associated with an unrelated plugin-isolation architecture paper), a standalone "CyberBase." Treat any reference to these as unsourced. [unsourced]
#The honest capability picture
Cisco Foundation-Sec is the only program in this survey with real distribution: Foundation-Sec-8B-Instruct is wired into Cisco XDR, per Cisco's own writeup — the clearest evidence anywhere in the space of an open cyber model running inside a shipping commercial product rather than sitting as a research artifact. Cisco has also shipped four checkpoints in nine months (Apr 2025 → Jan 2026), unusually disciplined for this category. But look at what it benchmarks against. Foundation-Sec-8B's own technical report claims it "matches Llama-3.1-70B and GPT-4o-mini in certain cybersecurity-specific tasks" — GPT-4o-mini, not GPT-4o, not Claude, not Gemini. Foundation-Sec-8B-Reasoning (Jan 2026), marketed as "the first open-weight security reasoning model," compares only against Llama-3.1-8B and GPT-5-Nano — again the cheapest frontier tier. And on CTI-Reasoning, the one benchmark that looks most like genuine multi-step reasoning rather than recall, Foundation-Sec-8B-Reasoning loses to GPT-5-Nano, 0.411 vs 0.431 — confirmed directly off the model card. No comparison to a flagship model exists anywhere in the family.
Trend Micro Primus/Cybertron (arXiv:2502.11191) is the more technically ambitious program. Its 70B Nemotron-based model, built with NVIDIA compute, delivers +18% aggregate cybersecurity lift over base Llama-3.1-70B while holding Arena-Hard flat (85.8 vs 85.1) — genuine evidence that specialization doesn't have to cost general capability once you're at scale. Licensing is the cleanest in the generative category: MIT on top of Meta's Llama 3.1 terms. But Trend Micro, like Cisco, has never published a Cybench-style agentic comparison against a flagship model.
WhiteRabbitNeo was the original hyped "uncensored cyber LLM," shipping from Feb 2024 through Oct 2024 (WhiteRabbitNeo-2.5-Qwen-2.5-Coder-7B). It has not shipped a new base model in the 22 months since, as of this research date — its GitHub org shows zero public repos and 11 followers. The license (DeepSeek Coder + "WhiteRabbitNeo Extended," non-OSI, use-restricted) adds compliance overhead most enterprise legal teams will flag. Its download volume (282/mo for the 33B flagship) is low relative to its historical media attention — the earliest mover is now the clearest example of a cooling bet.
DeepHat-V1-7B, from the same Kindo.ai-adjacent team, is likely WhiteRabbitNeo's real successor — built on Qwen2.5-Coder-7B instead of Llama/DeepSeek-Coder, and out-downloading the entire WhiteRabbitNeo catalog combined (14,701/mo vs 282/mo). It ships zero published benchmarks. The signal here is about where engineering effort actually goes, not about demonstrated capability.
The hobbyist 7B fine-tunes (ZySec, Lily) are Apache-2.0 Mistral/Zephyr derivatives with small but real communities — ZySec sits inside 26 Hugging Face Spaces — and no published benchmarks at all. Lily has a community-stripped "-Uncensored" variant, a genuine dual-use flag for anyone evaluating downstream risk.
Every generative security model profiled here compares itself against a same-size open baseline or a discount frontier tier. None compares against a flagship. That is not an oversight — it is the most informative data point in the category.
#The most important finding: the market already voted
Llama Guard 4-12B, a 14-category safety classifier with no cyber-knowledge training at all, pulls 141,228 downloads/month — more than the combined monthly downloads of every dedicated cybersecurity-knowledge chat model in this survey put together. SecBERT, an 84M-parameter BERT trained from scratch on a custom cyber vocabulary by an independent developer, pulls 82,137/month, more than any generative security model and second only to Llama Guard in the whole category. ATTACK-BERT (26,072/mo) maps free text to MITRE ATT&CK technique IDs. SecureBERT (6,376/mo) and CySecBERT (1,508/mo) round out a set of small, purpose-built encoders that quietly dwarf the chat-model category by 5-50x in adoption.
None of these are monolithic "cyber brains." They're narrow classification and embedding backbones, dropped into somebody else's detection or IR pipeline as a component. That is the pattern: the market has voted decisively for classifiers bolted onto any base model over standalone generative "cyber brain" chatbots. Practitioners want a cheap, fast, accurate component they can wire into an existing SOC stack, not a general-purpose conversational security expert. This maps directly onto the harness/scaffold-over-monolith pattern the rest of this research keeps surfacing (see How these systems are actually built and Where the gaps actually are) — the value concentrates in the pipeline and the orchestration layer, not in a single fine-tuned weight file claiming domain mastery.
If the founder's instinct is "train a model that knows cybersecurity," the market data says: don't. Build (or fine-tune) a narrow classifier/verifier component and wire it into an agent scaffold on top of a frontier model. That is where the download numbers — and, more importantly, the production deployments — actually are.
#Dataset inventory and the fragmentation problem
| Dataset | Domain | Scale | License | Notes |
|---|---|---|---|---|
| Primus-Instruct | Instruction-tuning | ~835 samples | ODC-By | GPT-4o-generated responses to expert prompts |
| Primus-Reasoning | CoT/reasoning | 1K-10K | ODC-By | o1-preview reasoning traces, reject-sampled |
| AI4Sec/cti-bench | Eval | — | — | most-liked cyber dataset on HF (1,660 likes), arXiv:2406.07599 |
| BigVul (+20 forks) | Vuln detection | ~3,754 CVEs | mixed/unspecified | known label noise |
| DiverseVul (+26 forks) | Vuln detection | 18,945 vuln functions | mixed/unspecified | models trained on BigVul generalize poorly here |
| PrimeVul (+29 forks) | Vuln detection, relabeled | — | mixed/unspecified | detector F1 collapses from ~60-70% to single digits once relabeled |
| CVEFixes (15+ repos) | CVE-fix mining | — | mixed | one fork shows 964K dl/mo — almost certainly pipeline-inflated |
| ARVO / "arvo-cybergym" forks | Reproducible vuln builds, RL environment | ~2,000/fork subsets | unspecified | the substrate for agentic post-training, see Post-training playbook |
| HackerOne disclosed reports (+8 mirrors) | Bug bounty corpus | — | unspecified | 8 near-identical mirrors each showing ~12,600 dl/mo against a 621 original — bot traffic |
| MITRE ATT&CK structured data | TTP taxonomy | — | — | no canonical HF dataset; consumed via MITRE's own GitHub STIX repo |
The dataset side of this ecosystem runs on a small number of academic vulnerability corpora — BigVul, DiverseVul, PrimeVul, CVEFixes — reprocessed into dozens of near-duplicate Hugging Face forks with inconsistent, often blank license fields. PrimeVul exists specifically because BigVul and DiverseVul's labels are noisy enough that detector performance collapses once you relabel properly. Vendor-curated instruction data is tiny by comparison: Trend Micro's entire Primus-Instruct set is ~835 examples, 5 KB. See Data, and whether a moat is possible for the fuller treatment of licensing risk in this corpus — the short version is that most of these forks are derived from GitHub commit histories across projects with heterogeneous underlying licenses, and redistribution rights are rarely addressed on the dataset card at all.
#Base model selection for 2026
Licensing, not raw capability, now decides this call:
- Qwen3 (Apache 2.0) — fully permissive, wide size ladder, already the base of the most-downloaded standalone cyber fine-tune in this survey (DeepHat, on the Qwen2.5-Coder predecessor). Safest default for a lab that wants an unencumbered commercial product.
- gpt-oss-120b/20b (Apache 2.0, openai/gpt-oss-120b) — cleanly licensed and carries Western/enterprise-trust provenance, which plausibly matters specifically for a defensive-security product.
- Llama 4 (custom Meta Community License) — 700M-MAU commercial trigger, mandatory attribution, EU-specific multimodal restrictions. Notably, every actively-maintained model in this survey that uses a Llama base is still on Llama 3.1, almost two years after Llama 4 shipped — nobody in this niche has moved to it.
- DeepSeek-V3.2 / GLM-4.6 (MIT) — the cleanest licenses checked in this entire survey, no attribution or MAU gate. But a Western enterprise security vendor selling a defensive cyber product into European enterprises and governments faces a real procurement and geopolitical-trust headwind adopting a Chinese-lab base for that specific use case — a headwind that has nothing to do with license terms. See EU regulation as a demand engine for how live that concern is on the buyer side right now.
Recommendation: Qwen3, for the size ladder, the clean license, and the proven niche fine-tuning track record; gpt-oss as the fallback if a customer or a specific regulatory environment makes Western provenance a hard requirement. Ruling out Llama 4 (friction, no one else has moved to it) and DeepSeek/GLM (geopolitical trust, not capability) is the more defensible part of this call — the founder should not spend cycles agonizing over the DeepSeek/GLM option on capability grounds, because the objection is commercial, not technical.
#The verdict question: credible product, or eval/agent layer on frontier models?
The case for a credible product: Two real enterprises are investing multi-generation engineering effort, and one (Cisco) has it running inside a shipping product. The efficiency case is real: an 8B specialist matching a 70B general model on CTI tasks is a genuine cost/latency/on-prem win, and on-prem/air-gapped deployment is a hard requirement — not a preference — for a meaningful slice of the actual buyer base (see Who buys, and what they pay and Is frontier-lab gating a real wedge?). Trend Micro's 70B result (+18% lift, flat general capability) shows specialization doesn't have to cost capability once you're at scale. And the encoder segment is a quietly real, sustained, high-volume product category that works today.
The case against: Cybench's own headline finding is that only frontier closed models solved any nontrivial CTF task at all; the open-weight models tested (Llama-3.1-405B, Mixtral 8x22B) lagged well behind on the exact benchmark built to measure this. Not one specialist fine-tune outside Cisco and Trend Micro publishes any agentic benchmark result — only closed-book QA scores, the easier number to look good on and the one least correlated with real offensive/defensive skill. Llama Guard 4 alone out-downloads the entire generative-cyber-model category, which is the market voting for "scaffold on top of any base model" over "monolithic specialized brain." WhiteRabbitNeo, the earliest and most publicized bet on a standalone cyber LLM, has gone 22 months without a new release. The most credible frontier-adjacent work in the space — the ARVO/cybergym RL environments — is explicitly infrastructure for training agents inside frontier-model-style loops, not evidence of a shipped model beating anyone.
Position: the split runs along task type, and it is a clean split. For narrow, well-defined, closed-book knowledge and classification tasks — CTI lookup, alert-triage text classification, ATT&CK technique mapping, first-pass code-vuln flagging — small open specialists and encoders are already a credible, cost-effective, shipping product; Cisco and Trend Micro are proving this in production today. For open-ended, multi-step, agentic offensive/defensive work — the tasks that actually determine whether AI shifts the attacker/defender balance — no open-weight model has closed the gap to frontier closed models, and the field's more sophisticated recent effort (RL environments, agent scaffolding, evaluation harnesses like Cybench and CyberSecEval, see Cyber benchmarks and evals) is explicitly built to sit on top of frontier models, not to replace them with an open-weight alternative. A defensive cyber lab in 2026 should plan to build the narrow classifier/verifier layer as a real product, and treat "our own agentic monolith beats Claude/GPT/Gemini at security" as an unproven, expensive, multi-year bet rather than a starting assumption. See Post-training playbook for what that bet actually costs.
#What this means for us
- Do not chase a monolithic "cyber brain" chatbot as the flagship product — the download data says the market pays for classifiers and safety layers bolted onto any base model, not standalone specialist chatbots.
- Cisco's Foundation-Sec is the only proof point of an open cyber model in a shipping product; study its four-checkpoints-in-nine-months cadence and its narrow, defensible use case (CTI/XDR copilot) as the template, not its benchmark claims.
- Start from Qwen3 (Apache 2.0) unless a specific buyer forces Western-provenance gpt-oss; avoid DeepSeek/GLM bases for anything sold into EU enterprise/government despite their cleaner licenses — this is a sales-cycle risk, not a technical one.
- Treat "beats frontier models on agentic security tasks" as not yet achieved by anyone publicly, on any base — plan the roadmap around narrow verified sub-tasks first (see Post-training playbook for the Minerva precedent), not full-agent parity.
- The dataset layer is genuinely thin and fragmented (BigVul/DiverseVul/PrimeVul noise, 5 KB instruction sets) — budget real engineering time for data quality before believing any published benchmark number, see Data, and whether a moat is possible.
- WhiteRabbitNeo's 22-month stall is a cautionary tale for a small team without vendor-scale resourcing: a standalone open cyber-LLM program needs sustained multi-checkpoint investment or it reads as abandoned within two years.