Cisco has announced a family of security small language models (SLMs) called Antares, which is the name of a star, but also means rival to Mars (the god of war). With these models Cisco is trying to address one of the most difficult issues in security: finding where known vulnerabilities exist in a codebase.
The family consists of three models: Antares-350M, Antares-1B, and Antares-3B. The number at the end of the name represents the number of parameters. The two smaller models are now available as open-weight models via Hugging Face and actually already outperform many other models when it comes to finding vulnerabilities, and at a fraction of the cost. As small models, you can even run them locally, providing more security for companies that want to check their proprietary code that can’t be sent to public servers elsewhere.
In a new Vulnerability Localization Benchmark, the 350M model actually scores better than Gemini 2.5 flash while the 1B model scores better than Gemini 3 Pro and GLM-5.2. The unreleased 3B model has a similar score to GPT-5.5 and is a bit below GPT-5.5 xhigh. Those GPT models have hundreds of billions of parameters, compared to Antares-3B’s three billion parameters, the difference is staggering.
With Antares, Cisco is trying to achieve a middle ground between traditional static analysis tools and general-purpose coding models. Essentially, it has built a product that can reason about code and is optimized for investigating vulnerabilities.
According to Cisco, Antares uses an iterative search pattern that mimics how a human investigator would work through a repository. The models start with a vulnerability description and searches for relevant code patterns. It then reads candidate files, incorporates new evidence, changes direction when a path is unhelpful, and narrows toward the files that are most likely to matter.
It supports the following workflows:
- locating files related to a CWE category in a repository snapshot
- triaging advisory-driven security investigations
- augmenting static analysis with model-driven repository exploration
- supporting CI/CD triage workflows where likely vulnerable files need early review
- enabling local security analysis in environments with strict privacy or compliance requirements
The small size of the Antares models means that the cost of running them is far lower too. The estimated cost per evaluation of the models compared to competing models is shown below:
If you are interested in finding out more about these new modes, you can get them from the Hugging Face page or read the technical paper.