Cisco has unveiled Antares, a new family of security-focused small language models (SLMs) designed to tackle one of the most resource-intensive challenges in cybersecurity: locating where known vulnerabilities exist within a codebase.
The company is releasing two models, Antares-350M and Antares-1B, as open-weight models that are freely available to the broader community via Hugging Face. A third model, Antares-3B, is already in the pipeline.
Antares is released as part of a broader Cisco push to establish practical, trustworthy AI for security practitioners, with the decision to make it open weight that others can adapt and build upon, with the aim of cultivating shared standards for enterprise AI security tooling.
Inside Antares: How the Models Work
At its core, Antares is built to close a gap that existing tools have long struggled with. Traditional static analysis tools are rules-heavy and generate noisy outputs that require extensive manual triage. General-purpose coding models can reason about code but are not optimized for the structured, investigative work of security vulnerability analysis.
Antares operates differently. Inspired by prior Cisco Foundation AI research demonstrating that compact models can learn to search, reflect, and backtrack without relying on scale, each model follows an iterative search pattern modeled on how a human security analyst navigates an unfamiliar repository. Starting from a vulnerability description, the model searches for relevant code patterns, reads candidate files, incorporates new findings, changes direction when a path proves unproductive, and progressively narrows its search toward the files most likely to be relevant.
The output is a ranked list of source files likely to contain a given vulnerability, accompanied by the terminal exploration trace that informed the result. This gives security teams a reviewable, repeatable starting point for triage rather than a black-box answer. Practical use cases include locating files linked to a specific CWE category, triaging advisory-driven investigations, augmenting static analysis with model-driven repository exploration, and flagging potentially vulnerable files early in CI/CD pipelines.
Why SLMs, and What This Means for Enterprises
The decision to build small, specialized models rather than rely on large general-purpose ones is deliberate, and it speaks directly to the practical constraints security teams face every day.
Vulnerability triage is expensive. It demands expertise, time, infrastructure, and, critically, access to sensitive source code. For many organizations, routing that code through a cloud-based LLM creates significant data privacy and compliance risks. Antares is compact enough to run locally or on premises, keeping sensitive codebases entirely within an organization's own environment.
That capability matters especially for resource-constrained teams. Universities, public sector institutions, research organizations, and smaller security functions have historically lacked the budget to run token-intensive AI models on critical tasks. Antares is built to make AI-assisted vulnerability triage accessible to those organizations as well.
