**Cisco’s Antares: A New Open-Weight Model for Vulnerability Detection**
In the ongoing battle to secure complex software supply chains, artificial intelligence is becoming an indispensable ally. However, the traditional AI landscape often presents a difficult trade-off: high-performance large language models (LLMs) are prohibitively expensive, while smaller open-weight general language models (GLMs) often flood security teams with false alarms, making them impractical for precise code analysis.
Cisco Foundation AI has introduced a potential solution with **Antares**, a new small language model (SLM) designed to change the economics of vulnerability detection. Named after the bright binary star in the Scorpius constellation, Antares represents a focused engineering effort to bring near-frontier security capabilities to organizations of all sizes, particularly those with limited budgets.
### Purpose-Built for Security Triage
Unlike general-purpose LLMs, Antares is purpose-built for the specific and arduous task of pinpointing known vulnerabilities within a codebase. When a new security flaw is disclosed, development teams must quickly determine if their own code is at risk and, if so, where the vulnerability resides. This process, known as vulnerability localization, is currently slow and resource-intensive.
Antares tackles this challenge using a search pattern that mimics human investigation. The model starts with a vulnerability description, searches for relevant code patterns, reads candidate files, incorporates new evidence, and adjusts its direction when a path proves unhelpful. The goal is not to replace the expert judgment of security professionals but to assist them in the critical first stages of triage, narrowing down the vastness of a codebase to the files most likely to contain a flaw.
### An Open-Weight, Enterprise-Grade Solution
The model is distributed as an open-weight SLM, available on Hugging Face. This places it in a unique category distinct from both expensive, closed frontier models and general-purpose open-weight GLMs.
“Open weight is not quite open source, but the ‘weights’ (effectively the brain of the model that defines how it ‘thinks’) can be controlled by the user,” explains the analysis of typical open-weight models. This feature is particularly valuable for organizations with strict data sovereignty requirements, as the code being analyzed never leaves the company’s infrastructure.
Cisco positions Antares as the “Goldilocks” solution: a model that delivers low cost and low false positives while maintaining data control. It is explicitly targeted at budget-constrained entities, including universities, research institutions, nonprofits, and public-sector teams that maintain critical but resource-intensive software systems.
### Performance and Validation
The true test of any security tool is its real-world efficacy. To provide concrete proof of its capabilities, Cisco has released a new benchmark called the **Vulnerability Localization Benchmark**. This benchmark is designed to test a model’s ability to efficiently navigate unfamiliar codebases and recognize vulnerability patterns associated with specific Common Weakness Enumeration (CWE) categories.
In benchmark testing against top-tier competitors, Antares demonstrated compelling value. It was faster and significantly cheaper than its rivals, completing tasks **172x cheaper than OpenAI’s GPT-5.5** and **15.2x cheaper than Z.ai’s GLM-5.2**. Despite its low cost, the model delivered near-frontier accuracy, producing a ranked list of source files most likely to contain a vulnerability that security teams could then investigate.
### A Foundation for the Future
The launch of Antares is part of a broader Cisco initiative to “help the community build a more durable foundation for AI-assisted defense.” This involves the development of open specifications, reusable security knowledge, compact deployable models, and measurable benchmarks to track progress. The ultimate ambition is a world where any security team, regardless of its budget or computational resources, can effectively integrate AI into its daily security operations.
As attackers increasingly leverage AI for their malicious activities, the efficiency and accessibility of tools like Antares are not just a convenience; they are a necessity for maintaining a resilient digital landscape.
***
### FAQ
**Q: What is Cisco Antares?**
A: Cisco Antares is a small language model (SLM) developed by the Cisco Foundation AI. It is designed specifically to help security teams locate known vulnerabilities within their source code. It is distributed as an open-weight model, meaning users can control the model’s core “brain,” which is useful for data-sensitive environments.
**Q: What problem does Antares solve?**
A: Antares solves the problem of inefficient and costly vulnerability detection. Traditional methods involve either very expensive proprietary AI models or cheaper open-weight general models that produce too many false positives. Antares aims to provide a “low cost with low false positives” alternative that is better suited for security-specific tasks.
**Q: How does Antares work?**
A: Antares follows a human-like investigation pattern. Given a vulnerability description, it searches for relevant code patterns, reads candidate files, incorporates new evidence, and changes direction when a path is unhelpful to narrow down the files most likely to contain the vulnerability. Its goal is to assist security teams in the initial triage phase.
**Q: Who is Antares for?**
A: Antares is primarily targeted at organizations with budget-restrained security resources. This includes universities, research institutions, nonprofits, and public-sector teams that maintain important but legacy software systems.
**Q: Has Antares been tested against other models?**
A: Yes. Cisco has released a benchmark called the Vulnerability Localization Benchmark. In testing, Antares was compared to top-performing models from OpenAI (GPT-5.5) and Z.ai (GLM-5.2). It was found to be 172x cheaper than the closed LLM and 15.2x cheaper than the open-weight GLM, while maintaining competitive speed and accuracy.
**Q: Where can I access Antares?**
A: The Antares models (Antares-350M and Antares-1B) are available as open-weight models on Hugging Face.
***
### Conclusion
Cisco’s Antares represents a significant step forward in making advanced AI-driven security accessible. By focusing on a specific, high-impact problem and delivering demonstrable results at a fraction of the cost, it empowers smaller organizations to defend their codebasts more effectively. In an era where AI is being weaponized by attackers, tools like Antares are crucial for democratizing defensive capabilities and building a more secure foundation for the digital world.
