While enterprise software teams can use AI to identify security flaws, the cost of tokens—particularly for frontier models—and the risk of sending proprietary source code to cloud-hosted services are barriers to adoption. Cisco is aiming to address that with the launch of Antares, a family of small language models (SLMs) designed specifically for repository-level vulnerability localization.
The vendor is releasing the Antares-350M and Antares-1B versions as open-weight models on Hugging Face. The models are built to help security teams pinpoint vulnerable code within large software repositories while consuming significantly fewer tokens than general-purpose frontier models.
Just as importantly for many enterprises, they are intended to run locally inside customer-controlled environments, allowing security teams to analyze sensitive source code without exposing intellectual property to external AI services.
Although frontier AI models are powerful, they may not be the most appropriate option for cybersecurity applications, Supriti Vijay, AI Researcher at Cisco, told CX Today.
“Frontier models are highly capable and remain a strong option for complex cases, but general-purpose models are not always the best fit for specialized security workflows. Beyond cost, they may encounter restrictions in legitimate security use cases and may not be optimized for the specific task at hand.”
Traditional static analysis tools are valuable, but they are often rule-heavy and can produce results that require substantial triage. General-purpose coding models can reason about code, but they may not be optimized for security investigation, terminal navigation, or structured vulnerability localization.
Antares emerged from research by the Cisco Foundation AI team that found compact models can learn and revise search strategies, indicating that useful retrieval behavior does not necessarily require model scale.
The release reflects a growing shift in enterprise AI strategy. As enterprise AI budgets are stretched by increasingly large foundation models, vendors are developing domain-specific models that deliver targeted capabilities with lower infrastructure costs and stronger data governance.
Reducing the Cost of AI-Powered Code Security
Application security requires more than a simple choice between frontier and open-source models, Vijay explained. “Different stages of application security, including repository exploration, vulnerability localization, verification, prioritization and remediation, require different capabilities.”
Repository-level vulnerability localization has become an important application of AI within application security. Instead of reviewing every file manually, AI models can identify the sections of code that are most likely to contain the vulnerability described in a security advisory or bug report. That can reduce investigation time substantially, particularly for large codebases with millions of lines of code.
However, using frontier models for this task presents practical challenges. Entire repositories often exceed context windows, requiring code to be broken into multiple prompts that consume large numbers of tokens. As organizations scan hundreds or thousands of repositories, inference costs can escalate quickly. And many enterprises remain reluctant to upload proprietary source code into externally-hosted AI platforms because of intellectual property, regulatory and data residency requirements.
Antares is designed to address those concerns by delivering repository-level localization using models that can be deployed within enterprise environments while requiring substantially less compute than larger models.
“Organizations are usually balancing three factors: capability, operating cost and control over sensitive code,” Vijay noted.
“Frontier services provide strong capabilities without requiring internal infrastructure, but they can bring high API costs, latency, vendor dependence and concerns about how proprietary code is processed, retained or used to improve their own models.”
While running local models can give teams more control and predictable costs, the organization needs to manage deployment, monitoring and maintenance.
“With Antares, we are exploring a different approach based on the idea that useful intelligence does not always require massive infrastructure, and that efficient, task-specific learning can deliver strong results at a much smaller scale,” Vijay said.
Right-Sizing AI for Security Workflows
Antares can act as an efficient, cost-effective layer alongside frontier and generalized models.
Smaller, specialized models will reduce dependence on frontier models, but they are unlikely to replace them entirely,” Vijay explained.
“We expect enterprises to adopt a layered approach: compact models running locally for high-volume, repeatable tasks, with larger models used selectively for cases that require deeper investigation.”
Cisco has developed a Vulnerability Localization Benchmark, and testing showed the Antares models outperforming powerful closed- and open-weight models at lower cost.
Running a full 500-entry evaluation took approximately 15 minutes on a single GPU and cost less than $1, making it roughly 15x cheaper to run than the leading open model and 172x cheaper than the leading frontier model.
“Our results suggest that, for well-defined tasks, domain-specific training can matter as much as model size,” according to Vijay. “Smaller specialized models can be faster, lower-cost and easier to deploy, while frontier models can be used selectively when broader reasoning is needed.”
“With Antares, our focus was on scaling capability through efficient, task-specific learning rather than relying on model size alone,” Vijay added.
The vendor points out that Antares can help public sector institutions and smaller security teams use AI in their cyber defenses, as they may lack the resources to use token-intensive AI models for critical tasks. It can also support organizations that are required to run air-gapped and closed-network deployments.
