Open-Source LLMs Reshape SOC Workflows

The rapid rise of machine-speed cyberattacks has accelerated the use of open-source large language models (LLMs) in security operations centers (SOCs). At RSAC 2025, Cisco and Meta introduced new AI models designed to help organizations scale cyber defense capabilities and reduce response time to threats, VentureBeat reports. These developments reflect a broader trend of moving from general-purpose AI to domain-specific models built for cybersecurity. Open-source LLMs, with their adaptability and cost-efficiency, are becoming core infrastructure for both startups and established providers.

Cisco’s newly launched Foundation-sec-8B model, trained specifically on curated cybersecurity datasets, illustrates the shift toward precision-built AI. Created by Cisco’s Foundation AI group, the 8-billion parameter model is designed for SOC tasks such as threat detection, code validation, and configuration analysis. Unlike retrofitted general models, Foundation-sec-8B is built on Meta’s Llama 3.1 and optimized for minimal infrastructure use, making it more accessible for varied enterprise needs. The model is available open-source, enabling organizations to integrate and customize without vendor lock-in.

Meta, meanwhile, expanded its AI Defenders Suite with tools like Llama Guard 4 and LlamaFirewall. These additions help secure AI pipelines by detecting policy violations, guarding against prompt attacks, and improving code safety. Meta’s new benchmarking suite, developed with CrowdStrike, provides a framework to test AI effectiveness in real-world SOC scenarios, advancing the industry’s ability to evaluate and improve autonomous security workflows. The focus on real-time protection and lightweight deployment continues to drive adoption among security teams seeking responsive, AI-integrated defenses.

Open-source collaboration was also front and center with ProjectDiscovery’s Nuclei, which won recognition at RSAC for its community-driven approach to vulnerability detection. The alignment between Cisco, Meta, and ProjectDiscovery highlights a growing consensus: security innovation is more scalable and effective when shared. With LLMs now tailored for the cybersecurity domain, organizations can deploy smarter, faster, and more unified threat response mechanisms—creating an ecosystem where defense is no longer siloed, but collective.