The best LLM for cybersecurity depends on the job. Picks for alert triage, detection engineering, threat intel and vulnerability research, with who measured each score.
By TaskUpdated 2026-10-306 picks
Introduction
The best LLM for cybersecurity in October 2026 depends on the job. A model that leads a vulnerability benchmark can be the wrong choice for triaging a SOC's alert queue, and the public leaderboards mix vendor self-reports with independent runs on different task subsets. This edition sorts the numbers by task and says who measured each one. Every score was checked at its source on 30 October 2026.
The headline for defenders: open-weight models have caught up on several security tasks. On CyberGym, an independent same-harness run put Kimi K3 and GLM-5.3 ahead of the closed models it tested. On alert triage, a 9B open model matched GPT-4.1 on the same alerts. The models that lead offensive benchmarks are very large, while the strongest small-model results sit in narrow defensive tasks run inside a well-built harness. This page reports offensive benchmark scores as third-party measurements of capability, for defenders choosing a model.
Two releases landed too late for this edition's numbers. Moonshot published Kimi K3.1 Pro and wrote that, for its open-weight release, it deliberately held the model's offensive cyber capability below what its pipeline can produce. Mistral released open weights for Mistral Large 4 on 29 October 2026, citing defensive cybersecurity gains. We found no independent cyber result for either yet.
Our Picks
#1
Qwen3.5 9B
Alert-Bench F1, authors' run (Oct 2026): 0.952
For alert triage, the strongest small-model result published so far belongs to Qwen3.5 9B, an open-weight model a security team can run inside its own environment. In the Alert-Bench paper (arXiv 2610.10608, October 2026), the authors replayed enterprise telemetry through a live SIEM and ran each model under their AIDA triage protocol. On the same 300-alert subset, Qwen3.5 9B and the GPT-4.1 reference scored the same F1 of 0.952, with precision 0.980 and recall 0.926. The other open models in that test ranged from 0.098 to 0.777, so the harness and the choice of model both matter. The authors measured it; the model was used as released, with no training on triage data.
Strengths
Same F1 as GPT-4.1 on the same alerts, measured by the benchmark's authors
Small enough to run in your own environment, so alert data stays private
Open weights, so a team can train it further on its own dispositions
Trade-offs
One paper, one attack scenario, and a structured protocol around the model
The full protocol is token-heavy: about 37,000 tokens per alert in the authors' ablation
#2
Claude Opus 4.6
CTI-REALM reward, Microsoft's run (Mar 2026): 0.637
Detection engineering turns a threat report into working detection rules, and CTI-REALM is the benchmark built for it. Microsoft's paper (arXiv 2603.13517, March 2026) tested 16 model configurations, all from Anthropic and OpenAI, and Claude Opus 4.6 at high reasoning effort scored the top reward of 0.637, ahead of Opus 4.5 at 0.624 and Sonnet 4.5 at 0.587. The best OpenAI result was GPT-5 at medium effort, 0.572. Microsoft measured all of them in the same environment. As of October 2026 no open model has a published CTI-REALM score, so this pick is the best measured result, with no open model to compare it against yet.
Strengths
Highest reward among the 16 configurations Microsoft tested
Same harness for every model, run by the benchmark's authors
Strong tool use across long query-and-test loops
Trade-offs
Hosted only, so detection telemetry is sent to a provider
The Anthropic models used about 442,000 to 524,000 tokens per task, against about 120,000 for GPT-4.1
#3
GLM-5.3
CyberGym, Proximal's corrected run (Sep 2026): 93.5%
GLM-5.3 from Z.ai has independent cyber testing from both a government lab and a security company behind it. The US Center for AI Standards and Innovation (CAISI) called it the most cyber-capable open-weight model released to date and estimated that it lags the US frontier by about four months across its own cyber evaluations (NIST, 17 September 2026). On CyberGym, Proximal ran it in one harness next to closed models and scored it 93.5% on a corrected version of the benchmark (30 September 2026). Its predecessor GLM-5.2 is the model Hugging Face ran on its own infrastructure for forensic analysis during its July 2026 incident, after hosted APIs blocked the work.
Strengths
Independent results from CAISI and Proximal, beyond the vendor's own
Open weights: forensic work on real attack data can stay in your environment
A predecessor already proven in a real incident response
Trade-offs
A very large model that needs a multi-GPU cluster to serve
CAISI places it behind current US frontier models on its aggregate measure
#4
Kimi K3
CyberGym, Proximal's corrected run (Sep 2026): 95.6%
On reproducing known vulnerabilities, Kimi K3 posted the highest score in Proximal's same-harness CyberGym run (30 September 2026). Proximal found tasks the original grader scored wrongly, removed 227 of the 1,507, and rescored four models: Kimi K3 rose 13.7 points, from 81.9% to 95.6%, against 93.5% for GLM-5.3, 91.1% for GPT-5.6 Sol and 87.8% for Claude Fable 5.1 (with Opus 5 fallback). Proximal ran the closed models with their standard cyber guardrails switched off through cyber access programs, so the comparison measures capability with refusals out of the picture. Proximal also concluded that CyberGym is largely saturated, so read the result as open weights catching up on this task, and give the exact order less weight.
Strengths
Top score in an independent run that tested open and closed models together
Open weights for teams doing vulnerability research on their own code
Proximal's corrected grader removes the benchmark's known scoring errors
Trade-offs
2.8 trillion parameters per Moonshot, so serving it takes a cluster
Moonshot's newer Kimi K3.1 Pro deliberately holds offensive capability lower
#5
Claude Opus 4.7
Cybench, Anthropic's system card (35 tasks): 96%
For capture-the-flag style security work, the official Cybench leaderboard lists Claude Opus 4.7 at 96%, taken from Anthropic's own system card on 35 of the benchmark's 40 tasks. Claude Mythos Preview tops the board at 100% on the same 35 tasks, as a preview model; Opus 4.7 is the pick here as the released model. The leaderboard's newest open-model rows date from 2024, so this is a strong closed result with no same-harness open comparison. Open-model Cybench scores circulate only as launch-post figures, which we leave off this list.
Strengths
Near the top of the official Cybench leaderboard
Available through Anthropic's API
Strong general reasoning for the investigation work around a finding
Trade-offs
Self-reported, on a 35-task subset of the 40
Hosted guardrails can refuse forensic work on real attack data
#6
Foundation-Sec-8B-Reasoning
CTI-MCQA, Cisco's model card (Jan 2026): 0.691
For threat-intelligence questions on modest hardware, Cisco's Foundation-Sec-8B-Reasoning is a security specialist built on an 8B base. On Cisco's own model card (released 28 January 2026) it scores 0.691 on CTIBench's CTI-MCQA against 0.688 for GPT-5-Nano, and 0.753 on CVE-to-CWE mapping against 0.672. That puts it level with a small closed model on knowledge benchmarks. It is a good fit for structured, high-volume questions where data must stay in house, and a weaker fit for open-ended investigation.
Strengths
Runs on a single workstation-class GPU
Level with GPT-5-Nano on CTI knowledge benchmarks
Trained on security text, so the vocabulary is right out of the box
Trade-offs
Self-reported by Cisco, and compared with a small closed model, below the frontier
Its base model's training data stops in April 2025, so recent vulnerabilities are missing
How We Chose
We grouped picks by the security job: alert triage, detection engineering, vulnerability research and threat-intelligence knowledge. Each pick carries one score, labelled with the benchmark, who ran it and when. We preferred results where the benchmark's authors or an independent lab ran every model in the same harness (Alert-Bench, CTI-REALM, Proximal's CyberGym run, CAISI). Vendor self-reports are labelled as such, and aggregator figures compiled from launch posts are left out.
We also weighed whether a security team can run the model where its data lives. The Australian Signals Directorate's guidance for cyber defenders (8 September 2026) asks organisations to keep model capability "commensurate with the requirements and value of the intended use case", and names token consumption and ongoing operating cost among the factors. Hugging Face's July 2026 incident disclosure adds the operational case for open weights: hosted APIs blocked its forensic analysis of real attack commands, so it ran an open-weight GLM model on its own infrastructure, and no attacker data or credentials left its environment.
Bottom Line
For a SOC's alert queue, start with a small open model inside a structured triage protocol: Qwen3.5 9B matched GPT-4.1 on Alert-Bench. For detection engineering, Claude Opus 4.6 holds the best measured CTI-REALM result, and no open model has been published on that benchmark yet. For vulnerability research where data must stay in house, GLM-5.3 and Kimi K3 are the open choices, with the largest serving footprint. For threat-intelligence questions on modest hardware, Foundation-Sec-8B-Reasoning is the specialist.
Cost comes down on two fronts. The price per token of an open model can sit well below a frontier API, and the tokens per task vary widely: Alert-Bench's full protocol spent about 37,000 tokens per alert in the authors' ablation, and on CTI-REALM the Anthropic models used roughly four times the tokens of GPT-4.1 per task. A model trained on a team's own alerts and dispositions can carry the repeated protocol in the model itself, so fewer tokens are sent with every alert. That is the work of the Ertas endpoint, which trains new model versions on an agent's traffic, scores each against the customer's own evaluations, and puts it live only with their sign-off; if a new version falls short, the current model stays in service. The endpoint is currently invitation only, and we are developing a more streamlined version for wider access.
This is the October 2026 edition. When the rankings move, we publish a new edition and link it from the top of this page.
We deploy GLM, Kimi and Qwen models for security teams on infrastructure we manage, in your own cloud tenancy, or on-premise. Your data stays private, usage costs become more predictable, and the model is ready before the next incident.
