AI Cybersecurity Models Are Becoming More Interchangeable, Shifting Value to Workflows and Data
Summary
The article argues that AI cybersecurity capabilities are converging and becoming cheaper and more accessible, shifting competitive advantage from model access to proprietary context, data, workflow integration, evaluation and trusted action.
Key points
- The author says frontier AI labs are releasing models faster, with cybersecurity capabilities increasingly converging across providers.
- The article describes open-weight models as closing the gap with proprietary models on cybersecurity benchmarks, including vulnerability discovery and simulated attack tasks.
- It argues that connecting a model to penetration-testing tools is not, by itself, a durable cybersecurity product advantage.
- The article notes that benchmark results reveal less about performance in complex production settings such as SOC operations, AppSec, IAM and incident response.
- Smaller models and local deployment could make cybersecurity AI more practical for organizations concerned about data confidentiality and cloud costs.
- The author expects durable value to come from company-specific context and data, integration into security workflows, evaluation, trust and safe action.
Article Details
- Topic
- The commoditization of AI cybersecurity capabilities and the shift toward data, workflow integration, evaluation, and trust as sources of value.
People
Vendors
AikidoAikido’s latest benchmark used 11.7B tokens to test 10 models against 32 new vulnerabilities. Open-weight models like DeepSeek, Qwen, Kimi, and GLM now compete directly with, and sometimes outperform, public closedAnthropic5. April–June 2026 — Anthropic turns capability into defenseMoonshot AIKimi K2 Thinking — Moonshot AIOpenAIGPT‑4o System Card — OpenAIZ.aiZ.ai releases GLM-5.2.
Products
AstraThen OpenAI warns that Astra may reach Critical capability.Claude 4Last year, AI in cybersecurity advanced quickly. GPT-5 was the first model to show practical cybersecurity skills, analyzing and acting on real use cases. Claude 4.5 followed soon after.Claude 4.5Last year, AI in cybersecurity advanced quickly. GPT-5 was the first model to show practical cybersecurity skills, analyzing and acting on real use cases. Claude 4.5 followed soon after.Claude MythosAnthropic’s Project Glasswing gives selected defenders access to Claude Mythos, an especially capable cyber model.DeepSeekbenchmark used 11.7B tokens to test 10 models against 32 new vulnerabilities. Open-weight models like DeepSeek, Qwen, Kimi, and GLM now compete directly with, and sometimes outperform, public closed frontier modelsDeepSeek V3.1DeepSeek V3.1 becomes the strongest DeepSeek model tested by the U.S. CAISI. It still substantially trails GPT-5 on cyber, particularly exploitation, but the direction is clear. (NIST)DeepSeek V4 ProDeepSeek V4 Pro finds 28 of the 32 vulnerabilities across three runs—the best result in the test.GLMtokens to test 10 models against 32 new vulnerabilities. Open-weight models like DeepSeek, Qwen, Kimi, and GLM now compete directly with, and sometimes outperform, public closed frontier models in cybersecurityGLM-5.26. June 2026 — GLM-5.2 changes the open-weight equationGLM-5.311. August 2026 — GLM-5.3 shows an even stranger phenomenon: cyber capability emergesGPT-5Last year, AI in cybersecurity advanced quickly. GPT-5 was the first model to show practical cybersecurity skills, analyzing and acting on real use cases. Claude 4.5 followed soon after.GPT-5.3-CodexGPT-5.3-Codex becomes the first OpenAI model treated as High capability in cybersecurity.GPT-5.6GPT-5.6 reaches OpenAI’s High cyber capability threshold.GPT-5.6-CyberThen it launches GPT-5.6-Cyber and expands Daybreak around a very different message from 2023: get frontier capability into defenders’ hands before attackers operationalize it at scale.GPT-6With GPT-6 now released, it is time to review what has changed since then. I’ve built a timeline from 2023 to 2026 of all model releases with their cybersecurity capabilities.Grok 4.6Three DeepSeek Pro runs cost about $295 and outperform the tested Opus 5, Grok 4.6 and GPT-5.6 Sol configurations.Kimi11.7B tokens to test 10 models against 32 new vulnerabilities. Open-weight models like DeepSeek, Qwen, Kimi, and GLM now compete directly with, and sometimes outperform, public closed frontier models inKimi K2 Thinking3. November 2025 — Kimi K2 Thinking pushes the open frontierKimi K37. July 2026 — Kimi K3 pushes it furtherMythoswith a few sets of actors, etc. I’ve covered this quite a lot, especially in this article for Mythos, but I strongly believe it’s not true.Opus 4cyber improvements over DeepSeek V3.1: 50.5% versus 36.7% on CVE-Bench. It still trails GPT-5 and Opus 4 on agentic cyber tasks. (NIST)Opus 5Three DeepSeek Pro runs cost about $295 and outperform the tested Opus 5, Grok 4.6 and GPT-5.6 Sol configurations.Qwenused 11.7B tokens to test 10 models against 32 new vulnerabilities. Open-weight models like DeepSeek, Qwen, Kimi, and GLM now compete directly with, and sometimes outperform, public closed frontier models in
Tools
Cyber Gyman AI to tools, use a Kali Linux setup, and test if it can perform penetration testing. Benchmarks like Cyber Gym use this approach, and AIs perform well here.CyberGymYet it more than doubles GLM-5.2 on exploitation benchmarks and reaches state-of-the-art performance on CyberGym according to Z.ai’s evaluations. (Hugging Face)Kali Linuxit is well documented and easy to explain. The typical method is to connect an AI to tools, use a Kali Linux setup, and test if it can perform penetration testing. Benchmarks like Cyber Gym use this approach, and