Cisco bets its small open cybersecurity models can outperform GPT-5.5 at vulnerability detection for a fraction of the cost

2026-07-22 · Source: The Decoder · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Fundamental Awareness, quick

Summary

Cisco has released Antares-350M and Antares-1B, two small, open AI models designed for detecting vulnerabilities in software code. These models offer significant cost-efficiency, with the smallest Antares model reportedly catching approximately 150 times more vulnerabilities per dollar than large AI agents such as Cognition's Devin Security Swarm. In internal tests, Antares scanned 500 code repositories in about 15 minutes for less than a dollar, a task that took GPT-5.5 five hours and cost over \$100. The Antares models operate locally, ensuring sensitive code remains within the company. They were trained using roughly 72 percent security-concept data and 15 percent code search histories. Cisco also maintains a larger, proprietary three-billion-parameter version for its products, which performs comparably to GPT-5.5. The company is exploring an industry consortium for open AI security tools.

Key takeaway

For AI Security Engineers evaluating vulnerability detection solutions, Cisco's Antares models demonstrate that smaller, specialized open-source AI can deliver superior cost-performance. You should consider integrating these local-first models to scan sensitive code repositories efficiently and affordably. This approach significantly reduces operational costs compared to large, general-purpose AI agents while maintaining data privacy. Explore the Antares models on Hugging Face to assess their fit for your specific environment.

Key insights

Small, specialized open AI models can significantly outperform larger, general-purpose models in specific cybersecurity tasks like vulnerability detection.

Principles

• Cost-efficiency in AI security is achievable with specialized models.
• Local model execution enhances code security.
• Training on domain-specific data improves performance.

Method

Models were trained on approximately 72 percent security-concept data and 15 percent code search histories to specialize in vulnerability detection.

In practice

• Deploy small, open AI models for local code scanning.
• Prioritize domain-specific training data for specialized tasks.

Topics

• Cybersecurity AI
• Vulnerability Detection
• Open-Source Models
• Antares Models
• Code Security
• Cost Efficiency

Best for: CTO, VP of Engineering/Data, Machine Learning Engineer, AI Security Engineer, AI Engineer, Director of AI/ML

Related on AIssential

• Cybersecurity Looks Like Proof of Work Now — Cybersecurity is becoming a "proof of work" problem, where spending more tokens directly improves vulnerability detection.
• Microsoft launches its own cybersecurity model MAI-Cyber-1-Flash but still depends on OpenAI for the toughest tasks — Microsoft's MAI-Cyber-1-Flash significantly enhances cybersecurity task automation while reducing costs through a hybrid AI model approach.
• Our evaluation of OpenAI's GPT-5.5 cyber capabilities — GPT-5.5 demonstrates cyber vulnerability detection capabilities comparable to Claude Mythos.
• Open-weight models now match frontier cyber performance from just four months ago at a fraction of the cost — Open-weight AI models now nearly match frontier cyber capabilities from months ago at a fraction of the cost, but with easily bypassed safeguards.
• Partnering with Mozilla to improve Firefox’s security — AI models like Claude Opus 4.6 can autonomously find and help fix high-severity software vulnerabilities at accelerated speeds.
• AI Just Solved the Wrong Half of Cybersecurity — AI models now possess emergent, autonomous vulnerability discovery capabilities, outpacing human remediation efforts.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by The Decoder.