Small is Beautiful: Cisco Unveils Antares, Two Small Language Models for Vulnerability Analysis

There's no need for models with trillions of parameters that require GPU batteries to find vulnerabilities in source code. This is the stance of Cisco, which has released two small language models (Small Language Models, SLM) specifically designed for security. They are called Antares and are open weight, available for free to everyone via Hugging Face.

Cisco Launches Antares, Language Models to Identify Vulnerabilities

Analyzing source code for vulnerabilities is a labor-intensive and highly sensitive process: in some cases, it's simply not possible to use AI tools to conduct it due to limitations imposed by internal or external regulations. Conducting it manually is often very complex and difficult, so much so that even the best analysts struggle to find all possible vulnerabilities.

This explains the success of analysis tools like Claude from Anthropic: AI is often more effective at finding issues, and it does so at a lower cost. However, it remains necessary to have experts validate what the AI finds, but their job is undoubtedly made easier and quicker by AI tools.

Using large language models, however, is not a strict necessity, according to Cisco. Antares is a language model available in two sizes (350 million parameters and one billion parameters) specifically designed to find vulnerabilities in code and to do so through an iterative process that retraces its steps if unproductive.

Research by the Cisco Foundation AI team has shown that the process followed by the model is more important than its size. Hence the much smaller size, at least compared to competitors, of Antares. The idea is that it is necessary to run models locally, without having to upload source code to the cloud, thus making it possible to analyze with AI tools even where it was previously impossible, since the entire process occurs locally and no data leaves the device.

Antares scans files containing code and returns an ordered list of those most likely to contain vulnerabilities, along with a log of what was done via the terminal. In this way, Antares guides analysts in the right direction without replacing them.

To assess the performance of Antares, Cisco has also developed a new benchmark specifically for vulnerability detection, a task quite different from generic code writing: it is called the Vulnerability Localization Benchmark and includes over 500 test cases.

Cisco states, "We are releasing Antares as an open-weight model because the cybersecurity community needs more accessible technological components to create practical defenses at the repository level. Triage of vulnerabilities is a resource-intensive activity. It requires specialized skills, time, adequate infrastructure, and access to sensitive code. These costs significantly impact companies already operating with limited resources dedicated to security: universities, research institutes, non-profit organizations, and public sector teams that still manage important software."

Antares is part of a broader Cisco project, which includes Foundry Security Spec for having a dedicated framework for security assessment through AI agents, and CodeGuard to define rules and skills to guide agents in writing more secure source code.

Cisco writes in the press release that "AI applied to security must go beyond isolated demonstrations of great impact and focus on systems that professionals can evaluate, govern, and improve over time." In other words: a system like Claude Mythos is useful, but it must be accessible to a wide audience to be truly effective, and it is not under the control of security professionals or the community at large, who thus cannot intervene to improve it and guide its development. An open system, usable even locally and that cannot be shut down at the whim of the current ruler, can certainly be more beneficial in the long run.