fdtn-ai/Foundation-Sec-1.1-8B-Instruct

Hugging Face
TEXT GENERATIONConcurrency Cost:1Model Size:8BQuant:FP8Ctx Length:32kPublished:Nov 18, 2025License:otherArchitecture:Transformer0.0K Warm

Foundation-Sec-1.1-8B-Instruct is an 8-billion parameter instruction-tuned language model developed by Foundation AI at Cisco, built on the Meta Llama-3.1-8B architecture. Specialized for cybersecurity applications, it features an extended 64k context window for processing long security documents. This model excels at tasks like SOC acceleration, proactive threat defense, and engineering enablement, offering significant gains over Llama-3.1-8B on security-specific benchmarks.

Loading preview...

Overview

Foundation-Sec-1.1-8B-Instruct is an 8-billion parameter instruction-tuned language model from Foundation AI at Cisco, based on the Meta Llama-3.1-8B architecture. It is specifically designed for cybersecurity applications, featuring an extended 64k token context window (up from 4k) to handle extensive security documents, incident reports, and threat intelligence feeds. The model is instruction-tuned and aligned with human preferences, enabling chat-like interactions for security-related tasks.

Key Capabilities

  • SOC Acceleration: Automates triage, summarization, case note generation, and evidence collection.
  • Proactive Threat Defense: Simulates attacks, prioritizes vulnerabilities, maps TTPs, and models attacker behavior.
  • Engineering Enablement: Provides security assistance, validates configurations, assesses compliance evidence, and improves security posture.
  • Enhanced Performance: Achieves +3 to +13 point gains over Llama-3.1-8B-Instruct on cybersecurity benchmarks (CTI-MCQA, CTI-RCM, CTI-VSP) and competitive instruction-following capabilities against models like GPT-4o-mini.

Good for

This model is ideal for security practitioners, researchers, and developers building AI-powered security workflows and applications, particularly for local deployment where data security and regulatory compliance are critical. It supports tasks such as summarization of incident reports, classification of threats to MITRE ATT&CK, named entity recognition for compliance, and Q&A for alert triage. It is recommended to use with additional safeguards like LlamaGuard for optimal safety performance.