Cisco Launches New AI Security Models, Meet Cisco Antares
Cisco’s compact open-weight models bring vulnerability localization closer to the code, giving enterprises a new option for private, on-premises AI security.
AI is producing more code. Security teams are not getting more review time.
That gap is becoming one of the least comfortable parts of enterprise AI adoption. Developers can generate features, tests, and infrastructure code faster than AppSec teams can inspect the output. The backlog grows. Many organizations want AI to help, but cannot send proprietary repositories to a public AI service.
Cisco’s new Antares models target that problem.
Antares is a family of compact security models trained to navigate a repository and identify the files most likely to contain a known vulnerability. Cisco released 350-million-parameter and 1-billion-parameter variants as open-weight models. The benchmarked 3-billion-parameter version is not publicly released.
The released models are small enough for local deployment. Antares-1B targets laptops and workstations, while Antares-350M targets smaller environments.
If your source code cannot leave the environment, Antares-1B is worth evaluating in a bounded on-premises pilot. The promise is not that a small model replaces AppSec. It is that a specialized model may reduce the time experts spend searching for the right files.
Why This Matters
Cisco introduced Antares as a family of small language models built specifically for vulnerability localization.
Antares is not a general coding assistant. Given a CWE category description, it searches an unfamiliar repository, inspects candidate files, follows evidence, changes direction when a path is unproductive, and submits a ranked list of files for a human analyst to review.
It also preserves the terminal exploration trace behind the ranking.
That trace matters. Security teams do not need another black box that says, “Trust me, look here.” They need to see what the model searched, which evidence influenced it, and where human judgment should take over.
What Cisco released
Two models are available through the Antares collection on Hugging Face:
- Antares-350M, with a 32K context window and an intended mobile or IoT deployment tier
- Antares-1B, with a 128K context window and an intended laptop or workstation deployment tier
Both are based on IBM Granite 4.0 checkpoints. Cisco labels Antares-1B as Apache 2.0 on Hugging Face, but access to the files is gated. Users must share contact information, accept conditions, and pass a manual review. Cisco separately specifies defensive-use conditions in its technical report.
The Antares CLI is bundled with the 1B model. It supports targeted CWE investigations and repository-wide sweeps, and can return human-readable, JSON, or SARIF results.
Cisco also built containment controls into the CLI. It analyzes a temporary read-only repository snapshot, discards symlinks that escape the repository, blocks network access, limits the agent to inspection commands, and scans returned content for prompt-injection patterns.
Those controls help. They do not eliminate the need for hardened inference infrastructure, identity controls, repository authorization, trace retention, observability, and human review. The model is only one component of a controlled private-AI security system.
The benchmark results deserve attention, not blind acceptance
Cisco created the Vulnerability Localization Benchmark because general coding evaluations do not measure this task well.
VLoc Bench contains 500 tasks drawn from 290 real-world vulnerable repositories. Each model receives a CWE category description and must identify the vulnerable implementation files. It gets 15 terminal commands, limited retries, no network access, and no advisory text or file hints.
Cisco reports macro-averaged file-level F1 across all 500 tasks. Each model was run three times under the same harness, and the results were averaged.
Selected Cisco-reported scores include:
| Model | Cisco-reported File F1 |
|---|---|
| GPT-5.5 with high reasoning | 0.229 |
| Antares-3B | 0.223 |
| GPT-5.5 default | 0.221 |
| Antares-1B | 0.209 |
| GLM-5.2 | 0.186 |
| Gemini 3 Pro | 0.152 |
| Antares-350M | 0.135 |
| Gemini 2.5 Flash | 0.102 |
| GPT-5 Mini | 0.098 |
| Semgrep | 0.086 |
| CodeQL | 0.023 |
The publicly released Antares-1B did not beat the strongest GPT-5.5 configuration. It did outperform many much larger open- and closed-weight models in Cisco’s test, and it recorded the highest recall among the compared systems.
Cisco estimates that a full 500-task sweep cost $0.71 with Antares-1B, compared with $12.50 for GLM-5.2 through OpenRouter and $141 for GPT-5.5 through the OpenAI API. These estimates come from Cisco’s evaluation configuration: 16 parallel workers, Antares on one H100, and public H100 rental pricing. The Antares-1B model card reports a runtime of roughly 13 minutes. Actual cost and runtime will vary by hardware, provider, configuration, pricing, and rate limits.
Cisco designed the benchmark, trained the models, and published the evaluation. The test also focuses on localization tasks where every repository contains a known vulnerability. A second phase for recognizing patched or clean code is specified but was not evaluated in the report.
Do not buy the benchmark result. It’s important to reproduce it against your repositories, languages, weakness classes, existing tools, and false-positive tolerance. Or work with a partner like us at Netsync who can help guide the evaluation.
Why local deployment matters
Source code exposes business logic, integration patterns, internal APIs, architectural assumptions, and sometimes secrets that should never have been committed.
With a genuinely local inference endpoint, source content can remain inside the customer’s environment. The organization controls the hardware, network boundary, access policies, logging, and retention. That makes AI-assisted review more realistic for regulated businesses, public-sector agencies, research institutions, and companies with valuable intellectual property.
The word “local” still requires scrutiny. Antares can connect to a user-configured OpenAI-compatible endpoint. If that endpoint is remote, selected source content and repository context may leave the environment. Local traces can also retain prompts, source excerpts, commands, paths, and Git metadata.
If code privacy is the priority, begin with a private-AI and security architecture review that verifies the complete data path, not merely the location of the model weights.
Antares is a triage tool, not an AppSec replacement
Cisco is explicit about this point.
Antares does not replace software composition analysis, secret scanning, static or dynamic testing, container and infrastructure checks, threat modeling, remediation workflows, or experienced security engineers.
Its job is narrower: reduce the search space.
When an advisory lands or a security tool creates a large queue, analysts spend time deciding where to look. A ranked file list and reviewable trace can move the team from “search the repository” to “inspect these candidates first.”
A sensible workflow keeps the human decision boundary intact:
- Existing AppSec tools generate findings and context.
- Antares localizes likely vulnerable files inside a controlled environment.
- Human reviewers validate the evidence and risk.
- Remediation follows established development and change-control processes.
- Continuous assurance measures whether AI-generated and human-written code meet the same security bar.
What a useful pilot should test
A useful Antares pilot should answer four practical questions.
Does the data stay private?
Verify where inference runs, restrict network egress, control repository access, encrypt traces, and define retention and deletion.
Does it improve your AppSec workflow?
Use approved representative repositories. Measure localization quality, false positives, analyst time saved, and how often the exploration trace helps reviewers make a decision.
Does it fit your delivery pipeline?
Test JSON or SARIF output beside existing scanners. Do not turn model output into an automatic production gate before its behavior is understood.
Can the organization govern it?
Log every repository-access action, separate developer and security identities, test prompt injection inside source files, and preserve human approval before remediation or release decisions.
This is a better starting point than a broad AI rollout. It tests the model, the infrastructure, and the control system together.
AI Pathfinder Action Plan
Security and technology leaders should take six steps:
- Choose one localization workflow where analysts already spend measurable time searching repositories.
- Test the released Antares-1B model, not the unreleased 3B benchmark leader.
- Reproduce Cisco’s results on approved internal code with precision, recall, and analyst-time metrics.
- Keep the inference endpoint, repository snapshot, and traces inside the required trust boundary.
- Run Antares beside existing AppSec controls rather than replacing them.
- Define the human decision point before model findings can affect remediation, build gates, or production releases.
The Bottom Line
Antares is interesting because it is narrow.
Cisco trained a small model to search repositories, recognize vulnerability patterns, and point humans toward the files that deserve attention. That specialization may make local AI security useful at a cost and footprint more organizations can support.
For teams worried about AI-generated code, proprietary source exposure, growing AppSec backlogs, or secure AI adoption in software development, Antares is a credible model to evaluate. The evaluation must include the surrounding controls, infrastructure, and workflow, not just the weights.
If your team is evaluating whether Antares fits a private-AI or DevSecOps environment, Netsync can help design a bounded AI pilot around your repositories, controls, and existing AppSec workflow.
The question is not whether a small model can replace your security program. It is whether it can remove enough repetitive search work to let your security team focus on judgment, remediation, and risk.
Sources and further reading
- Cisco's Antares announcement
- Antares technical report
- Antares models on Hugging Face
- Antares-1B model card
- Vulnerability Localization Benchmark
About Jason Fleagle
Jason J. Fleagle helps business and public-sector leaders turn AI uncertainty into practical strategy, governance, architecture, and measurable operating outcomes. He is the head of AI at Netsync Network Solutions and writes AI Pathfinder for leaders trying to adopt AI without losing control of risk, cost, or execution.
Learn more at thejasonfleagle.com and Netsync.
Related AI Pathfinder reading
- Prompt Injection Risk for Business Leaders
- Human-in-the-Loop AI Governance
- AI Model Evaluation for Business
- AI Governance Checklist
Originally published on LinkedIn.
About AI Pathfinder
AI Pathfinder is Jason Fleagle’s recurring field note on enterprise AI, agentic systems, AI governance, and the operating models leaders need as AI moves from experiments into real work.
