Cisco has expanded its AI-infused cybersecurity offerings as it looks to empower security teams to work smarter.

Chief among the updates is an updated version of its security-optimized Foundation line of AI model that features enhanced reasoning capabilities – meaning it takes a more structured approach at handling tasks.

Available via the open-source repository platform Hugging Face, Foundation-Sec-8B-Reasoning is a fine-tuned version of Meta’s Llama 3.1 model. But unlike earlier iterations, Cisco touts its latest reasoning version as boasting “domain-specific analytical capabilities.”

The networking giant said its model can support security workflows that “demand logical reasoning,” citing its use across tasks like attack path analysis, risk evaluation, and threat modeling.

Example tasks Foundation-sec-8B-Reasoning can perform include analyzing logs and telemetry to identify malicious activity, evaluating system configurations and policies to identify potential vulnerabilities, and assessing permissions to assess threats from over-privileged accounts. Security engineers can explore potential use cases via a specifically developed “cookbook” detailing deployment options and practical adaptation approaches.

“Generic reasoning models can assist, but they may lack the ability to understand the specific logic and structure of security workflows,” Cisco execs Yaron Singer and Amin Karbasi wrote in a blog post. “Foundation-sec-8B-Reasoning bridges that gap by combining instruction-following with explicit reasoning traces. This enables it to explain not only ‘what’ it recommends, but also ‘why’ – helping analysts build trust in AI-assisted decisions.”

And at just 8 billion parameters, Cisco’s model size means it doesn’t require vast amounts of storage to run – a boon for operators considering spiraling component prices. In terms of AI model size, Foundation-sec-8B-Reasoning is around the mid-tier level, which typically makes it more apt for specialized tasks, unlike large-scale language models (LLMs) which as Singer and Karbasi put it, are more “generic.”

A 31-page technical paper outlining the model claims it offers “substantial performance gains” compared to its predecessor, Foundation-Sec-8B-Instruct. Compared against rival systems on security-focused benchmarks like CTIBench sees the Cisco model offer performance levels competitive with models almost 10 times its size.

Agentic AI, but with a pitchfork

A Cisco Foundation-Sec model was showcased late last year in demos that saw it powering an AI agent application capable of handling investigations for security incidents.

Paired with an agentic framework, the model was touted as a means to augment security operations center (SOC) use cases, like running investigations in Cisco XDR and compiling summaries of potential security incidents

In its latest line of cybersecurity updates, Cisco has doubled down on agentic AI offerings with the introduction of an open-source tool capable of proactively unearthing undetected threats.

Built on the firm’s PEAK (prepare, execute, and act with knowledge) Threat Hunting Framework, the PEAK Threat Hunting Assistant acts in what Cisco describes as a “personal research analyst” for identifying threats previously unknown to a firm’s network.

Available via GitHub, the offering leverages a combination of underlying AI models and automated research tools to intuitively streamline threat hunting processes.

“[The assistant] goes beyond simple LLM calls and is designed around teams of cooperating agents capable of goal-directed reasoning, tool use, and automated feedback loops,” Cisco Foundation AI researcher David Bianco wrote in a blog post. “A key design principle is human-in-the-loop feedback. You can ‘chat’ with the PEAK Assistant at any point to guide its research, clarify findings, or incorporate requirements unique to your organization. This ensures the output is always relevant and aligned with your specific hunting objectives and environment.”

Cisco wants AI to think like a security expert

Cisco’s third and final AI-infused security offering unveiled this week was a framework designed to enable AI models to think like security experts.

The Adaptive AI Search Framework, detailed in a 37-page technical paper, enables AI models to refine their reasoning based on evidence encountered during the retrieval process.

Cisco’s approach aims to move beyond “one-shot” methods, where a single query often yields poor results for complex tasks requiring coherent reasoning.

Instead, Cisco engineers came up with a means to make the retrieval process more adaptive, enabling security-focused AI models to search iteratively, “much like a human investigator would.”

“This is done using a series of techniques: synthetic trajectory generation to create diverse search behaviors, supervised fine-tuning to establish the scaffolding for multi-turn search, reinforcement learning (GRPO) to refine search behavior, and finally inference time beam search to exploit the learned self-reflection capabilities,” a company blog post explained.

“For security teams, this capability improves threat intelligence analysis, accelerates incident response, and supports proactive vulnerability research across diverse data sources," Singer, Cisco’s VP for AI and security in its Foundation AI segment, wrote. “By tightly coupling retrieval behavior with reasoning, Foundation AI’s framework enables agentic systems to continuously adjust their approach as new information emerges.”