Awesome AI for Security

A curated list of tools, papers, and datasets for applying AI to cybersecurity tasks. This list primarily focuses on modern AI technologies like Large Language Models (LLMs), Agents, and Multi-Modal systems and their applications in security operations.

Found this resource helpful for your security research? Consider adding a star ⭐ to support the ongoing curation effort.

Contents

• Related Awesomes Lists
• Models
  • Specialized Security Models
• Datasets
  • Pre-Training Datasets
  • IFT & Capability Datasets
    • Security & Vulnerability Datasets
• Benchmarks & Evaluation
  • Vulnerability Assessment
  • Threat Intelligence
  • Offensive Security
  • General Security Knowledge
• Publications
  • Models & Datasets
  • Benchmarking & Evaluations
  • Other
• Tools & Frameworks
  • Adversarial ML
  • Security Testing
  • Learning Environments
• Security Agents
  • Autonomous Agents
  • Red Team Agents

Related Awesomes Lists

Other collections and lists that may be of interest.

• Awesome AI for Cybersecurity - Earlier comprehensive resource collection, focusing on pre-LLM machine learning applications.
• Awesome ML for Cybersecurity - Established resource for traditional ML approaches in security, predating modern LLM era.
• Awesome AI Security - Complementary list focusing on AI security rather than AI for security applications.
• Awesome AI4DevSecOps - Recent integration of AI technologies within DevSecOps frameworks and methodologies.
• Awesome-MCP-Security - Definitive resource covering all aspects of Model Context Protocol security.

Models

AI models specialized for security applications and scenarios.

Specialized Security Models

• Antares-1B - 1B parameter terminal agent for vulnerability localization; runs on a consumer GPU, navigating repos via shell commands to pinpoint files matching a given CWE, outperforming much larger models like GLM-5.2 (753B) and GPT-5 on VLoc Bench.
• Antares-350M - 350M parameter terminal agent for vulnerability localization, small enough to run CPU-only; outperforms GPT-5 Mini, GPT-OSS-120B, MiniMax-M2.7, and other much larger models on VLoc Bench.
• Foundation-Sec-8B-Reasoning - 8B parameter model extending Foundation-Sec-8B with reasoning capabilities, enabling test-time compute for complex security analysis and achieving state-of-the-art performance on CTI benchmarks.
• Foundation-Sec-1.1-8B-Instruct - Latest 8B parameter Foundation-Sec model with extended 64k context window, enabling processing of longer security documents and incident reports while maintaining strong performance on cybersecurity tasks.
• Foundation-Sec-8B-Instruct - Instruction-tuned 8B parameter security model, designed as a chat-native copilot for cybersecurity workflows including SOC automation, threat defense, and security engineering.
• Foundation-Sec-8B - Base 8B parameter model with cybersecurity-specific pretraining, outperforming Llama 3.1 70B on cyber threat intelligence tasks with 10x fewer parameters.
• Llama-Primus-Base - Foundation model with cybersecurity-specific pretraining on proprietary corpus.
• Llama-Primus-Merged - Combined model through pretraining and instruction fine-tuning.
• Llama-Primus-Reasoning - Reasoning-specialized model enhancing security certification through o1-distilled reasoning patterns.

Datasets

Resources designed for training and fine-tuning AI systems on security-related tasks.

Pre-Training Datasets

• Primus-FineWeb - Filtered cybersecurity corpus (2.57B tokens) derived from FineWeb using classifier-based selection.

IFT & Capability Datasets

• Primus-Reasoning - Cybersecurity reasoning tasks with o1-generated reasoning steps and reflection processes.
• Primus-Instruct - Expert-curated cybersecurity scenario instructions with GPT-4o generated responses spanning diverse tasks.

Security & Vulnerability Datasets

• AI AppSec Index - Open-source reference with 6 structured datasets covering AI remediation benchmarks, ASPM vendor matrix, 48+ real CVEs in AI-generated code, EU CRA compliance mapping, and SAST false positive rates. Available in JSON/CSV with an interactive dashboard.

Benchmarks & Evaluation

This section covers frameworks and methodologies for evaluating AI systems within security contexts.

Vulnerability Assessment

• VLoc Bench - Two-phase agentic benchmark (500 tasks, 290 repos, 147 CWE types) evaluating terminal-based vulnerability localization and patch verification.
• AutoPatchBench - Benchmark for automated repair of fuzzing-detected vulnerabilities, pioneering evaluation standards.
• SecLLMHolmes - Automated framework for systematic LLM vulnerability detection evaluation across multiple dimensions.

Threat Intelligence

• CTI-Bench - Benchmark suite for evaluating LLMs on cyber threat intelligence tasks.
• SECURE - Practical cybersecurity scenario dataset focusing on extraction, understanding, and reasoning capabilities.

Offensive Security

• NYU CTF Bench - Dockerized CTF challenges repository enabling automated LLM agent interaction across categories.
• Practical AI Security Course - AI/ LLM Security Course focusing on applying AI/LLMs to security problems and creating Pen-Testing Agents.

General Security Knowledge

• CyberSecEval 4 - Comprehensive benchmark suite for assessing LLM cybersecurity vulnerabilities with multi-vendor evaluations.
• SecBench - Largest comprehensive benchmark dataset distinguishing between knowledge and reasoning questions.
• MMLU Computer Security - Standard benchmark with dedicated computer security evaluation subset for general LLMs.
• MMLU Security Studies - General benchmark's security studies subset providing broader security knowledge assessment.

Publications

Academic and industry research on AI applications in security.

Models & Datasets

• Foundation-Sec Technical Report - Detailed methodology for domain-adaptation of Llama-3.1 for cybersecurity applications.
• Primus Paper - First open-source cybersecurity dataset collection addressing critical pretraining corpus shortage.

Benchmarking & Evaluations

• SecBench Paper - Multi-dimensional benchmark dataset with unprecedented scale for LLM cybersecurity evaluation.
• NYU CTF Bench Paper - First scalable benchmark focusing on offensive security through CTF challenges.
• SECURE Paper - Industry-focused benchmark targeting Industrial Control System security knowledge evaluation.
• CyberMetric Paper - RAG-based cybersecurity benchmark with human-validated questions across diverse knowledge areas.
• SecLLMHolmes Paper - Comprehensive analysis revealing significant non-robustness in LLM vulnerability identification capabilities.
• LLM Offensive Security Benchmarking - Analysis of evaluation methodologies for LLM-driven offensive security tools with recommendations.

Other

• OffsecML Playbook - Comprehensive collection of offensive and adversarial techniques with practical demonstrations.
• MCP-Security-Checklist - Comprehensive security checklist for MCP-based AI tools by SlowMist.

Tools & Frameworks

Software tools that implement AI for security applications.