Foundation-Sec-1.1

Model Information

Llama-3.1-FoundationAI-SecurityLLM-1.1-8B-Instruct (Foundation-Sec-1.1-8B-Instruct) is an open-weight, 8-billion parameter instruction-tuned language model specialized for cybersecurity applications. It extends the Foundation-Sec-1.1-8B base model with instruction-following capabilities and extended 64k context window support. It leverages prior training to understand security concepts, terminology, and practices across multiple security domains. Further instruction-tuning allows the model to interact with human users in a chat-like interface. Foundation-Sec-1.1-8B-Instruct enables organizations to build AI-driven security tools that can be deployed locally, reducing dependency on cloud-based AI services while maintaining high performance on security-related tasks.

• Model Name: Llama-3.1-FoundationAI-SecurityLLM-1.1-8B-Instruct (Foundation-Sec-1.1-8B-Instruct)
• Extended context window: Increased from 4k to 64k tokens, enabling processing of longer security documents, incident reports, and threat intelligence feeds
• Model Developer: Foundation AI at Cisco
• Model Card Contact: https://fdtn.ai/contact
• Model Release Date: November 20, 2025
• Supported Language(s): English
• Model Architecture: Auto-regressive language model that uses an optimized transformer architecture (Meta Llama-3.1-8B backbone)
• Training Objective: Instruction following and alignment with human preferences
• Training Data Status: This is a static model trained on an offline dataset. Future versions of the tuned models will be released on updated data.
• License: See NOTICE.md

Intended Use

Intended Use Cases

Foundation-Sec-1.1-8B-Instruct is designed for security practitioners, researchers, and developers building AI-powered security workflows and applications. Foundation-Sec-1.1-8B-Instruct is optimized for three core use case categories:

• SOC Acceleration: Automating triage, summarization, case note generation, and evidence collection.
• Proactive Threat Defense: Simulating attacks, prioritizing vulnerabilities, mapping TTPs, and modeling attacker behavior.
• Engineering Enablement: Providing security assistance, validating configurations, assessing compliance evidence, and improving security posture.

The model is intended for local deployment in environments prioritizing data security, regulatory compliance, and operational control.

Downstream Use

Foundation-Sec-1.1-8B-Instruct can be used directly for security-related chat use cases. Example downstream applications include:

• Summarization
  • Summarizing detection playbooks and incident reports
  • Consolidating fragmented analyst notes into structured case summaries
• Classification
  • Mapping threats to MITRE ATT&CK techniques
  • Prioritizing vulnerabilities based on contextual risk
  • Classifying security-relevant emails and leaked file contents
• Named Entity Recognition
  • Extracting compliance evidence from documents
  • Building network behavior profiles from technical manuals
• Question & Answer
  • Assisting SOC analysts with alert triage and investigation
  • Responding to cloud security and software compliance queries
• Reasoning and Text Generation
  • Generating red-team attack plans and threat models
  • Predicting attacker next steps in active investigations
  • Enriching vulnerability scan results with contextual insights

For questions or assistance with fine-tuning Foundation-Sec-1.1-8B-Instruct, please reach out to the team.

Out-of-Scope Use

The following uses are out-of-scope and are neither recommended nor intended use cases:

1. Generating harmful content - The model should not be used to:
   • Generate malware or other malicious code
   • Create phishing content or social engineering scripts
   • Develop attack plans targeting specific organizations
   • Design exploitation techniques for vulnerabilities without legitimate security research purposes
2. Critical security decisions without human oversight - The model should not be used for:
   • Autonomous security decision-making without human review
   • Critical infrastructure protection without expert supervision
   • Final determination of security compliance without human verification
   • Autonomous vulnerability remediation without testing
3. Legal or medical advice - The model is not qualified to provide:
   • Legal advice regarding security regulations, compliance requirements, or intellectual property disputes
   • Legal advice regarding security issues that would reference legal statutes, precedents, or case law necessary to provide legal advice
   • Medical advice regarding health impacts of security incidents
4. Non-security use cases - The model is specifically optimized for cybersecurity and may not perform as well on general tasks as models trained for broader applications.
5. Violation of Laws or Regulations - Any use that violates applicable laws or regulations.

How to Get Started with the Model

Use the code below to get started with the model. The cookbook provides example use cases, code samples for adoption, and references.

# Import the required libraries
import torch
from transformers import AutoTokenizer, AutoModelForCausalLM

# Load the model and tokenizer
tokenizer = AutoTokenizer.from_pretrained("fdtn-ai/Foundation-Sec-1.1-8B-Instruct")
model = AutoModelForCausalLM.from_pretrained("fdtn-ai/Foundation-Sec-1.1-8B-Instruct")

prompt = "CVE-2015-10011 is a vulnerability about OpenDNS OpenResolve improper log output neutralization. What is the corresponding CWE?"

messages = [
    {"role": "user", "content": prompt}
]

model_inputs = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = token