GLM-5.3 is live. Run Z.ai's latest model on Friendli Model APIs. Try it today ➜
fdtn-ai
Available on FriendliAI
Run this model inference on single tenant GPU with unmatched speed and reliability at scale.
Model Details
Model Provider
fdtn-ai
Model Tree
meta-llama/Llama-3.1-8B
Input Modalities
Output Modalities
Supported Functionality
Foundation-Sec-8B (Llama-3.1-FoundationAI-SecurityLLM-base-8B) is an open-weight, 8-billion parameter base language model specialized for cybersecurity applications. It extends Llama-3.1-8B model through continued pretraining on a curated corpus of cybersecurity-specific text, including threat intelligence reports, vulnerability databases, incident response documentation, and security standards. It has been trained to understand security concepts, terminology, and practices across multiple security domains. The model is designed to serve as a domain-adapted base model for use in applications such as threat detection, vulnerability assessment, security automation, and attack simulation. Foundation-Sec-8B enables organizations to build AI-driven security tools that can be deployed locally, reducing dependency on cloud-based AI services while maintaining high performance on security-related tasks.
https://arxiv.org/abs/2504.21039Foundation-Sec-8B is designed for security practitioners, researchers, and developers building AI-powered security workflows and applications. Foundation-Sec-8B is optimized for three core use case categories:
The model is intended for local deployment in environments prioritizing data security, regulatory compliance, and operational control.
Foundation-Sec-8B can be used directly for security-related language tasks and serves as a strong starting point for fine-tuning across a variety of cybersecurity workflows. Example downstream applications include:
For questions or assistance with fine-tuning Foundation-Sec-8B, please contact Paul Kassianik (paulkass@cisco.com) or Dhruv Kedia (dkedia@cisco.com).
The following uses are out-of-scope and are neither recommended nor intended use cases:
Use the code below to get started with the model. The cookbook provides example use cases, code samples for adoption, and references.
python
# Import the required librariesimport torchfrom transformers import AutoTokenizer, AutoModelForCausalLM # Load the model and tokenizertokenizer = AutoTokenizer.from_pretrained("fdtn-ai/Foundation-Sec-8B")model = AutoModelForCausalLM.from_pretrained("fdtn-ai/Foundation-Sec-8B") # Example: Matching CWE to CVE IDsprompt="""CVE-2021-44228 is a remote code execution flaw in Apache Log4j2 via unsafe JNDI lookups (“Log4Shell”). The CWE is CWE-502. CVE-2017-0144 is a remote code execution vulnerability in Microsoft’s SMBv1 server (“EternalBlue”) due to a buffer overflow. The CWE is CWE-119. CVE-2014-0160 is an information-disclosure bug in OpenSSL’s heartbeat extension (“Heartbleed”) causing out-of-bounds reads. The CWE is CWE-125. CVE-2017-5638 is a remote code execution issue in Apache Struts 2’s Jakarta Multipart parser stemming from improper input validation of the Content-Type header. The CWE is CWE-20. CVE-2019-0708 is a remote code execution vulnerability in Microsoft’s Remote Desktop Services (“BlueKeep”) triggered by a use-after-free. The CWE is CWE-416. CVE-2015-10011 is a vulnerability about OpenDNS OpenResolve improper log output neutralization. The CWE is""" # Tokenize the inputinputs = tokenizer(prompt, return_tensors="pt") # Generate the responseoutputs = model.generate( inputs["input_ids"], max_new_tokens=3, do_sample=True, temperature=0.1, top_p=0.9,) # Decode and print the responseresponse = tokenizer.decode(outputs[0], skip_special_tokens=True)response = response.replace(prompt, "").strip()print(response)Foundation-sec-8B was pretrained on approximately 5.1 billion tokens of cybersecurity-specific data curated in-house by Cisco’s Foundation AI team. The dataset was meticulously collected from public sources on the web.
The pre-training corpus was built through a multi-stage pipeline that included large-scale web crawling, relevancy filtering, deduplication, and quality filtering.
Data cutoff: April 10th, 2025.
More detailed methodology is available in the technical report.
Foundation-sec-8B is based on the Llama 3.1 8B architecture. Pre-training was performed on Cisco Foundation AI’s internal compute cluster.
Key training details:
More detailed methodology is available in the technical report.
Foundation-sec-8B was benchmarked on cybersecurity and general reasoning tasks, using a standardized 5-shot prompting setup (temperature = 0.3).
| Benchmark | Foundation-sec-8B | Llama 3.1 8B | Llama 3.1 70B |
|---|---|---|---|
| CTI-MCQA | 67.39 | 64.14 | 68.23 |
| CTI-RCM | 75.26 | 66.43 | 72.66 |
Benchmark Overview:
Key highlights:
For full benchmark details and evaluation methodology, please refer to the technical report.
Foundation-Sec-8B has several limitations that users should be aware of:
To address the limitations of Foundation-Sec-8B, we recommend:
# Import the required librariesimport torchfrom transformers import AutoTokenizer, AutoModelForCausalLM # Load the model and tokenizertokenizer = AutoTokenizer.from_pretrained("fdtn-ai/Foundation-Sec-8B")model = AutoModelForCausalLM.from_pretrained("fdtn-ai/Foundation-Sec-8B") # Example: Matching CWE to CVE IDsprompt="""CVE-2021-44228 is a remote code execution flaw in Apache Log4j2 via unsafe JNDI lookups (“Log4Shell”). The CWE is CWE-502. CVE-2017-0144 is a remote code execution vulnerability in Microsoft’s SMBv1 server (“EternalBlue”) due to a buffer overflow. The CWE is CWE-119. CVE-2014-0160 is an information-disclosure bug in OpenSSL’s heartbeat extension (“Heartbleed”) causing out-of-bounds reads. The CWE is CWE-125. CVE-2017-5638 is a remote code execution issue in Apache Struts 2’s Jakarta Multipart parser stemming from improper input validation of the Content-Type header. The CWE is CWE-20. CVE-2019-0708 is a remote code execution vulnerability in Microsoft’s Remote Desktop Services (“BlueKeep”) triggered by a use-after-free. The CWE is CWE-416. CVE-2015-10011 is a vulnerability about OpenDNS OpenResolve improper log output neutralization. The CWE is""" # Tokenize the inputinputs = tokenizer(prompt, return_tensors="pt") # Generate the responseoutputs = model.generate( inputs["input_ids"], max_new_tokens=3, do_sample=True, temperature=0.1, top_p=0.9,) # Decode and print the responseresponse = tokenizer.decode(outputs[0], skip_special_tokens=True)response = response.replace(prompt, "").strip()print(response)