Cisco has deployed its own open-weight, 8-billion-parameter foundation model, "Foundation-Sec-1.1-8B-Instruct," to power cybersecurity applications, starting with its Duo Identity Intelligence service, according to The Register.
Built on Meta's Llama-3.1-8B backbone and fine-tuned for security-specific tasks, the model is optimized for three primary uses: accelerating SOC operations through automated triage and summarization; enabling proactive threat defense via attack simulation and vulnerability prioritization; and providing engineering enablement for configuration validation and compliance assessment.
Cisco is initially using the model to generate weekly email digests for Duo customers, analyzing post-authentication signals like unusual geographic logins or privilege usage to identify identity risks that traditional controls miss. According to the company, using a custom-tuned model, as opposed to general-purpose AI, produces summaries that are "more accurate, more readable, and more aligned with real security workflows," leading to clearer prioritization and more actionable insights.
