Cisco released a family of small security models that actually run locally

Cisco dropped Antares, a set of small language models built for security work. The models range from 1 billion to 8 billion parameters. They are trained on security-specific tasks like log analysis, threat detection, and incident triage. Apache 2.0 license, weights available on Hugging Face. The interesting bit is the size. Most security vendors selling AI are either wrapping GPT-4 or running 70B models that need a GPU cluster. Antares-8B fits on a laptop. You can run it on a CPU without waiting three minutes for a response. That changes what you can do with it. Cisco claims these models beat GPT-3.5 on security benchmarks while using a fraction of the compute. I have not tested it, but the claim is plausible. Security tasks are narrow. You do not need a model that writes poetry and explains thermodynamics. You need a model that can parse a Suricata alert and tell you if it is a false positive. Smaller context windows, smaller vocabularies, faster inference. The real test is whether the model hallucinates MITRE ATT&CK techniques or invents CVEs. Security automation fails when the model makes up facts. If Antares can stay factual on 8B parameters, it is useful. If it confidently invents exploit chains, it is worse than grep. I will run it against my detection pipeline logs this week. If it can summarise twenty Zeek connection logs into one sentence without lying, that is already better than most SIEM vendor dashboards.

---

Source: Cisco Antares: A New Family of Cheap, Open-Source, Compact Security AI Models