ith Anthropic and OpenAI both throwing their weight behind powerful (and expensive) cybersecurity capabilities, Cisco may have an affordable alternative.
On Tuesday, Cisco unveiled Antares, a series of small language models that were built specifically for one time-consuming, expensive security task: Finding and rooting out known vulnerabilities in codebases. Because Antares is purpose-built, the models are specifically meant to take over the early stages of source code vulnerability triage, rather than replace expert judgment.
The open-weight Antares series comes in two sizes, 350 million parameters and 1 billion parameters, and is currently available on Hugging Face. There's a heavier 3 billion parameter version coming soon.
- According to Cisco, benchmark testing shows that these models outperform both closed- and open-weight models on security tasks, including Google Gemini and Gemma, GPT-OSS and Alibaba's Qwen, and perform on par with OpenAI's GPT-5.5.
- Additionally, Antares can do this work at a fraction of the cost, sitting at 172 times cheaper than GPT-5.5 at the same tasks, and can run locally on-device and on your on-premise servers.
"This is a great win for SLMs," Rob May, CEO of Neurometric, told The Deep View. "We've seen this time and time again across our customer base, that fine tuning a small model to a specific task will usually beat a frontier model on accuracy at 10% of the cost, and also run faster. But you have to choose the right workloads to make the fine tuning worthwhile, and it appears Cisco did a great job of that."
There are multiple reasons that Cisco decided to go small with Antares, Supriti Vijay, AI researcher at Cisco, told The Deep View. Along with dramatically undercutting large, general-purpose models on cost, these compact models can run locally and learn specific behavior needed to hunt down code vulnerabilities, she said, giving the user more control and limiting privacy concerns. Additionally, because these models are so lightweight, she said, inference can take "seconds rather than hours."
"The opportunity with SLMs is that they can handle the large volume of focused, repeatable work that makes frontier models too expensive to use everywhere," said Vijay. "That shows why specialized SLMs are likely to become an important part of everyday cybersecurity workflows."
Cisco's models come at a time when defenders need to work faster than ever to find and fix weaknesses. And as AI labs continue to leapfrog one another by releasing increasingly powerful models, this job is only going to get harder, as we've seen with the recent releases of Mythos and GPT-5.6 that were so powerful the US government put on the brakes. Plus, while these massive models offer defense capabilities, the age-old adage in cybersecurity is that for every ten-foot wall there's a twelve-foot ladder. In other words, everything we create to defend ourselves can also be used against us.
With limited resources, small models allow defenders to do more with less, changing the "economics of defense," said Vijay.
"The biggest challenge in cybersecurity is often not a lack of knowledge, but a lack of time and resources to work through a growing backlog of code and vulnerabilities," said Vijay. "If organizations can cover common weaknesses faster and more consistently, attackers have to spend more effort finding the gaps that remain."
Our Deeper View #
Cisco's small, purpose-built and inexpensive language models help cover a massive gap in the industry, and they point to an uncomfortable truth. AI has created a world in which cybersecurity defenders need all of the help they can get. And though AI can, and should, be used as a tool in the cyberdefenders' arsenal, new models from Anthropic and OpenAI are often sprawling in size, expensive, and simply not realistic to run every task within an organization. Cisco's models are just one example of the cost-saving power of small models, especially as enterprises finally start to bring down the hammer on tokenmaxxing. To put it simply: You don't need Thor's hammer to kill a fly.