Cisco's Antares AI Models Cut Source Code Vulnerability Costs

Cisco Foundation AI has unveiled Antares, a family of small language models (SLMs) purpose-built for one of security's most labor-intensive challenges: pinpointing known vulnerabilities inside a codebase. Named after the brightest star in the Scorpius constellation, the Antares family currently includes two open-weight models—Antares-350M and Antares-1B—both published on Hugging Face. Cisco positions Antares as a direct response to the painful trade-off security teams face today when triaging newly disclosed vulnerabilities across sprawling code repositories, especially for organizations that handle sensitive credentials and password-related assets that must remain in-house.

Until now, defenders had two main options. Subscribing to a frontier large language model (LLM) delivers strong accuracy but burns budget fast, particularly as the same models surface an ever-growing volume of new CVEs, and it may be off-limits entirely when code is subject to data sovereignty rules. The cheaper alternative—downloading general-purpose open-weight models—keeps data on-premises but tends to produce significantly higher false-positive rates, drowning small security teams in noise. Antares is engineered specifically to break that compromise: low-cost inference, low false positives, and full data sovereignty preserved. For teams already tightening their external attack surface, pairing internal code analysis with checks like an SSL/TLS checker and DNS leak test creates a more complete vulnerability picture.

Technically, Antares mimics how a human investigator works through a repository. Each model starts from a vulnerability description, searches for relevant code patterns, reads candidate files, incorporates new evidence, pivots when a path looks unproductive, and narrows toward the files most likely to be affected. Cisco stresses that Antares is not meant to replace expert judgment—it is designed to accelerate the first, most time-consuming stage of source-code vulnerability triage. The primary audience is budget-constrained defenders: universities, research institutions, nonprofits, and public-sector teams that still maintain critical software but cannot afford frontier-model subscriptions.

To back up its claims, Cisco is also releasing a new benchmark called the Vulnerability Localization benchmark, intended to provide measurable proof of Antares's accuracy against real-world code-scanning scenarios. By open-sourcing both the models and the evaluation framework, Cisco is making a competitive pitch against both closed frontier LLMs and general open-weight GLMs. If Antares delivers on its benchmarks, it could reshape how resource-limited security teams approach continuous vulnerability management—turning a process that once required either deep pockets or large false-positive tolerance into something far more accessible.