Best Local LLM for Cybersecurity (October 2026)

The best local LLM for cybersecurity depends on the task and the hardware you have. As of October 2026, Qwen3.5 9B is the strongest small model for alert triage, Foundation-Sec-8B-Reasoning leads at its size on threat-intelligence knowledge, and Qwen 3.6 35B A3B is the most capable agentic security model small enough to run locally. GLM-5.3 and Kimi K3 lead overall but need a cluster.

This is the October 2026 edition. Every score below was read at its source on 30 October 2026 and names who measured it. A local LLM here means an open-weight model you run on hardware you control: your own servers, your own cloud tenancy, or a network with no internet connection at all.

What is the best local LLM for cybersecurity?

The table lists one pick per job, with the score that earns the pick and who measured it.

The three small models cover most day-to-day defensive work. The two large ones are the open frontier, and they ask for frontier-class hardware.

Qwen3.5 9B for alert triage. On Alert-Bench (arXiv, 7 October 2026), Qwen3.5 9B scored an F1 of 0.952 on 300 alerts replayed through a live SIEM, the same score GPT-4.1 reached on those alerts under the same investigation protocol. The model was used as released, with no training. The protocol mattered as much as the model: four other open models in the same test scored between 0.098 and 0.777. Our AI for SOC analysts post covers the test and its cost per alert.

Foundation-Sec-8B-Reasoning for threat intelligence. Cisco's Foundation AI team built it on Llama 3.1 8B and released it on 28 January 2026. On its model card it scores 0.691 on CTI-MCQA, a 2,500-question cyber threat intelligence test, against 0.688 for GPT-5-Nano, and 0.753 on CTI-RCM, which maps vulnerability descriptions to CWE weakness classes, against 0.672. Its training data stops at 10 April 2025, so it knows nothing about newer vulnerabilities unless you give it the context.

Qwen 3.6 35B A3B for agentic security work. In a private benchmark of ten real, unpublished web vulnerabilities (Dual Use, 17 April 2026), the author found this model "within reach for running locally" and "surprisingly performant": it completed one scenario that neither GLM 5.1 nor Claude Opus 4.6 completed. It activates about 3 billion of its 35 billion parameters per token, which keeps it fast for its size. The benchmark is one researcher's, with ten scenarios run once each, so read it as a strong signal and test it on your own systems.

GLM-5.3 and Kimi K3 for the hardest work. These two lead the open models on CyberGym and sit level with the best closed models there. They are mixture-of-experts models with roughly 750 billion and 2.8 trillion total parameters, so "local" means a multi-GPU cluster in your own data centre or cloud tenancy. Our GLM-5.3 and Kimi K3 benchmark breakdown covers who measured what.

Why run a cybersecurity LLM locally?

Security data is the most sensitive data most organisations hold, and a local model keeps it inside your environment. Three reasons stand out.

Attack data and credentials stay in your environment. When Hugging Face investigated its July 2026 intrusion, its first attempt used frontier models behind commercial APIs. The requests "were blocked by the providers' safety guardrails, which cannot distinguish an incident responder from an attacker." The team ran the forensic analysis on the open-weight GLM-5.2 on its own infrastructure, and "no attacker data, and none of the credentials it referenced, left our environment."

The model is ready before the incident. Hugging Face's lesson for defenders was to "have a capable model you can run on your own infrastructure vetted and ready before an incident, both to avoid guardrail lockout and to keep attacker data and credentials from leaving your environment."

You can answer the questions regulators and auditors ask. Australia's ASD, in Opportunities for AI in cyber defence (8 September 2026), tells organisations to ask every AI vendor: "What data is retained, reused, or used to retrain models and under what conditions?" A model on your own hardware gives you the answer directly. The same guidance asks for model capability "commensurate with the requirements and value of the intended use case", which is the case for a right-sized model on a defined task.

Can you run an LLM for cybersecurity in an air-gapped network?

Yes. An open-weight model is a set of files, so once the weights are copied in, it runs with no network connection: no API calls leave the network and no licence server needs to answer. All five models in the table above can run air-gapped. The work moves to the operations side: copying in weight updates through your normal transfer controls, recording where the weights came from, and serving them on hardware inside the boundary. ASD's guidance also asks defenders to "map AI training and fine-tuning data sources to assess provenance, retention and poisoning exposure", which applies to any model you train further on your own data.

Is a local model good enough for SOC work?

For defined tasks inside a good harness, yes, and the evidence is strongest for alert triage. Alert-Bench shows a 9B model at GPT-4.1's level, and the authors note that "model size alone does not explain the ordering": the 9B Qwen model beat 70B and 120B models under the same protocol. Choosing the model and the harness together is the work.

The frontier still leads on two kinds of work:

For those tasks, a local model can draft and a frontier model or an analyst can verify. The CTI-REALM paper from Microsoft Security AI evaluated 16 models, all from Anthropic and OpenAI, so no open-model result exists yet; see our CTI-REALM explainer.

How do you choose a local LLM for your security team?

Start from the task and work back to the model:

1. Name the task and its measure. Alert triage is judged on recall of attack alerts and the escalation rate; CVE to CWE mapping on accuracy against a labelled set.
2. Pick the smallest model that holds your bar. Start with the 8B to 9B picks above, and move up to the 35B model for agentic work.
3. Test it on your own data. Score it on a few hundred of your own labelled alerts or reports before you trust any public number.
4. Keep an escalation path. Send the hard tail to an analyst or a frontier model, and log what gets escalated.
5. Train it when the task is stable. A model trained on your own dispositions learns your alert mix and your team's calls; see domain-specific LLMs for how that differs from a general model.

For the wider comparison of open and frontier models, see open-weight vs frontier models. For deployment trade-offs, see on-premise vs self-hosted vs air-gapped AI.

Run these models on your own security data

Run Qwen3.5 9B, Qwen 3.6 35B A3B, GLM-5.3 or Kimi K3 for your security team in your own infrastructure, in your cloud tenancy or on-premise, or Ertas-managed on infrastructure we run. Your data stays private, usage costs become more predictable than a frontier API bill that grows with alert volume, and the model is in place before an incident, ready for forensic work on real attack data. We host models for defensive work: triage, threat intelligence, malware analysis and detection.

A model trained on your own alerts and analyst dispositions goes further than an untrained one, and that is what our endpoint does. The endpoint is currently invitation only, and we are developing a more streamlined version for wider access.

Book a call and we will work out the right model, size and deployment for your team.

Frequently Asked Questions

Can I run an LLM for cybersecurity offline?

Yes. Open-weight models such as Qwen3.5 9B and Foundation-Sec-8B-Reasoning run with no internet connection once the weights are on your hardware. That suits air-gapped networks and keeps alert data inside your environment.

What is the best open-source LLM for cybersecurity?

It depends on the task. As of October 2026, Kimi K3 and GLM-5.3 lead overall on CyberGym but need a cluster, while Qwen3.5 9B leads small models on alert triage. Our best LLM for cybersecurity list ranks open and closed models by task.

Is Foundation-Sec-8B still worth using?

For threat-intelligence knowledge tasks at small size, yes: its reasoning version beats GPT-5-Nano on CVE to CWE mapping on Cisco's card. Its training data ends in April 2025, so pair it with retrieval of current advisories.

Does a local model need training for SOC work?

It can work untrained: Qwen3.5 9B matched GPT-4.1 on Alert-Bench with no training. Training on your own labelled alerts adapts it to your alert mix and your analysts' decisions, and lets the instructions you repeat in every prompt live in the model itself.

---

Sources, read 30 October 2026: Tsegai et al., "From Investigation Failures to Reliable SOC Agents" (Alert-Bench, 7 October 2026); Cisco Foundation AI, Foundation-Sec-8B-Reasoning model card; Dual Use, "Benchmarking open-weight models for security research" (17 April 2026); Proximal, "Robustly Evaluating Cyber Capabilities" (30 September 2026); Z.ai, GLM-5.3 model card; Moonshot AI, Kimi K3 model card; Hugging Face, "Security incident, July 2026" (16 July 2026); Australian Signals Directorate, "Opportunities for AI in cyber defence" (8 September 2026); Microsoft, "CTI-REALM" (March 2026).