Cisco Launches Low-Cost AI Models for Source Code Security

Summary

Cisco has launched Antares, a family of small language models (SLMs) designed to efficiently identify known vulnerabilities in source code. These open-weight models aim to provide a cost-effective solution for organizations, particularly those with budget constraints, offering lower false positives than general open-weight models and reduced cost compared to large closed-source LLMs, while also supporting data sovereignty requirements.

Full text

Cisco Foundation AI has announced Antares, a small language model (SLM) named after the brightest star in the Scorpius constellation. Just as the Antares star is bright because it is a binary star, so Cisco’s Antares family currently comprises two models: Antares-350M and Antares-1B. Both are SLM open-weight models available on Hugging Face. Cisco describes Antares as “purpose-built for one of the hardest, most time-consuming and expensive problems in security: pinpointing where known vulnerabilities exist within a codebase.” When a vulnerability is discovered, security teams must investigate whether their company code includes that vulnerability, and if so, where it is. This is not easy and is currently best assisted by AI. But the two primary AI options have their own problems. One option is to subscribe to and use a major closed large language (LLM) AI frontier model. But this can rapidly become very expensive given the sheer volume of new vulnerabilities being found by the same LLMs, and the cost of using them – and may not be an option if the codebase is subject to data sovereignty regulations. The often-chosen alternative is to download smaller ‘open-weight’ general language models (GLM)s. Open weight is not quite open source, but the ‘weights’ (effectively the brain of the model that defines how it ‘thinks’) can be controlled by the user. This approach is particularly useful where data sovereignty is important or regulated: the repository being analyzed by an open weight GLM is not required to leave the company’s possession.Advertisement. Scroll to continue reading. The problem with this latter approach, however, is that it usually generates a far higher level of false positives. Companies are forced to choose between high cost with lower false positives and low cost with higher false positives. Antares is designed to be open-weight, but SLM-designed, specifically to find known vulnerabilities in a codebase – in other words, low cost with low false positives while maintaining data sovereignty; improving on both GLM open weight models and large scale closed LLM frontier models. Its processing follows a search pattern resembling the way a human investigator works through a repository. “Each model starts from a vulnerability description, searches for relevant code patterns, reads candidate files, incorporates new evidence, changes direction when a path is unhelpful, and narrows toward the files most likely to matter.” The goal, says Cisco, is not to replace expert judgment, but rather to assist in the first stages of source-code vulnerability triage. Antares is primarily targeted at those organizations with budget-restrained security resources: “Universities, research institutions, nonprofits, and public-sector teams that still maintain important software.” Promises, however, are cheap. Proof is meaningful but more difficult. To solve this last problem, Cisco is also releasing a new benchmark, the Vulnerability Localization Benchmark. It is described as “a 500-entry benchmark requiring models to simultaneously navigate unfamiliar codebases efficiently and recognize vulnerability patterns associated with specific CWE categories.” Using this benchmark, Cisco tested Antares against a top performing closed LLM frontier model (OpenAI’s GPT-5.5) and a top performing open weight model (Z.ai’s GLM-5.2) and found that it completes faster at lower cost than its rivals (172x cheaper than the LLM and 15.2x cheaper than the GLM). The output is a ranked list of source files likely to contain a relevant vulnerability. Security teams can use this list to start their triage process. Cisco Antares benchmark “Security can’t be a luxury good, yet advanced AI-based detection has largely belonged to organizations with frontier-scale budgets,” comments Amin Saberi, professor of management science and engineering at Stanford University. “Antares’ results change that equation: near-frontier accuracy on secure code reasoning at a fraction of the cost, fast enough to run on every commit. At a moment when attackers are already using AI, that kind of efficiency isn’t a nice-to-have; it’s what makes always-on security scanning possible for every team.” Cisco defines its forays into AI as designed to “help the community build a more durable foundation for AI-assisted defense: open specifications, reusable security knowledge, compact deployable models, and benchmarks that make progress measurable. The goal is to build toward a system where all security practitioners, regardless of on-prem or resource constraints, can effectively incorporate AI in everyday security operations.” Related: Cisco Releases Open Source Tool for AI Model Provenance Related: House Passes Bill Requiring Federal Contractors to Implement Vulnerability Disclosure Policies Related: Microsoft DRM Hacking Raises Questions on Vulnerability Disclosures Related: Bipartisan Bill to Tighten Vulnerability Disclosure Rules for Federal Contractors Written By Kevin Townsend Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Kevin Townsend AI Data Centers Are Being Built Faster Than They Can Be SecuredWindows Bind Link Attacks Can Hide Malware From EDR ToolsHacker Conversations: Jesse McGraw (GhostExodus), From Blackhat Hacker to RedemptionUK Government Rolls Out Agentic AI Defense Plan Alongside Industry PledgeCISO Conversations: Tarah Wheeler, Cybersecurity Leader, Thought Leader and Original ThinkerDecades-Old Bash Tricks Expose AI Coding Agents to Supply Chain AttacksHacker Conversations: Chris Thompson, Former Head of IBM X-Force Red, Co-Founder of RemoteThreatNew Enterprise-Ready MCP Specification Brings New Security Challenges Latest News Empirical Security Raises $25 Million in Series A FundingSecurityWeek Launches Critical Impact Awards to Recognize Excellence in Industrial CybersecurityNew HollowGraph Malware Abuses Microsoft 365 Calendar for C&C CommunicationCISO Conversations: Andreas Gaetje – From Economics to CISO at Körber AGEstée Lauder Discloses Impact From Oracle EBS Zero-Day HackMeta Paid $78,000 Bounty for Vulnerability Exposing Customer Support DataClover Health Investments Discloses Data BreachExploitation of ServiceNow Vulnerability Seen Days After Disclosure Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Closing the Exploitation Gap July 22, 2026 Join this live webinar as we explore why exploitation is outpacing remediation, where risk is growing fastest, and what security leaders can do to close the gap before attackers take advantage. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveJazz has named Sean Robinson, Rickie Goyal, Danielle Guetta, Shani Nago, and Lior Magram as VPs and Michael Calev as COO.AJ Shipley has been appointed Chief Product Officer at CrowdStrike.Brinqa has named Ron Dovich as Chief AI and Automation Officer, David Allen as CTO, Steve Biagioni as CFO, and James Walta as VP of Product.More People On The MoveExpert Insights Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most cha

Entities