Cisco's Antares Small Model: A Disruptive Move or Strategic Fill for Secure AI?

Core Judgment: Cisco's move is not about disrupting the AI security track, but using a "small model + scenario-specific" strategy to attempt building a moat in the niche field of vulnerability detection. For Cisco, this is a key step in redefining its security business growth curve.

Short Term: Cisco is Fighting an "Asymmetric War" with "Small Models"

The story of large models dominating everything in AI security has been told for too long. OpenAI's GPT-4o, Google's Gemini, often have hundreds of billions of parameters, but few actually land in security scenarios. The reason is simple: security is a battlefield requiring "high precision, low latency, and strong privacy." Large models take seconds for a single inference, bandwidth costs are extremely high, and they cannot be deployed locally on clients—which is precisely Cisco's home turf.

Antares directly launched 350M and 1B parameter versions, with a 3B version coming later. What does this parameter scale mean? It can run on Cisco's routers, switches, firewalls, and other edge devices, and can even be embedded in terminal devices. Cisco is clearly betting that: true vulnerability detection isn't about "guessing" with cloud large models, but "real-time scanning" with local small models.

[!info] According to Cisco's official data, Antares achieves 12 percentage points higher accuracy than generic models of comparable parameter size on CVE vulnerability classification tasks, with inference latency controlled within 50 milliseconds. For security analysts, 50 milliseconds means response speed improves by an order of magnitude.

More importantly, Cisco holds the world's largest installed base of network equipment. Over 300 million routers and switches generate network traffic and log data daily, serving as a natural training ground. Antares can leverage these devices for "federated learning," continuously optimizing the model without leaking customer data. Once this "data flywheel" starts spinning, it is difficult for competitors to replicate.

Long Term: The Competitive Landscape Will Shift from "General Large Models" to "Scenario-Specific Small Models," but Cisco Faces Two Hidden Worries

The first worry is that security-native vendors like Palo Alto Networks and CrowdStrike are already running faster. Palo Alto's Precision AI solution achieved real-time threat detection based on small models back in 2023; its model had only 200M parameters but was specialized for malicious traffic classification. CrowdStrike's Charlotte AI follows a "large model + small model" hybrid route, using large models for context understanding and small models for endpoint detection.

Cisco's advantage lies in the network layer, but vulnerability detection ultimately falls to "code auditing" and "binary analysis," which are relatively weak links for Cisco. Antares is currently positioned only for "known vulnerability matching" and "simple vulnerability classification," and has not yet touched upon autonomous discovery of unknown vulnerabilities (0-days). This is like adding a "keyword matching" filter layer to a search engine, rather than true "intelligent search."

The second worry is: the small model track itself isn't crowded, but the barrier to entry is lowering. Hugging Face already has many small models fine-tuned for security domains, such as CodeBERT and SecBERT, with parameter scales between 100M-500M. If Cisco cannot form a barrier through "data + hardware binding," it can easily be replicated by the open-source community.

Cisco's biggest bet in AI security isn't the algorithm, but its "network equipment + edge computing" hardware ecosystem. But the problem is, when customers are already accustomed to using CrowdStrike's endpoint agents or Palo Alto's cloud firewalls, why switch to Cisco?

Trend Prediction: Edge Security AI Will Enter the "Modular" Era, and Cisco May Become the Winner of "Security as Hardware"

Over the next three years, I predict the deployment model of security AI will shift from "centralized cloud analysis" to "edge real-time response." If Cisco can push Antares to existing customers via "firmware updates," requiring only the activation of an additional License on the device, it can immediately generate revenue—this is more direct than any cloud subscription model.

But Cisco needs to be wary: do not repeat the mistake of failed "router + security" integration. In the 2010s, Cisco tried integrating firewalls and IPS into routers, only to be picked off one by one by professional security vendors. This small model strategy, if merely "an add-on feature of network equipment" rather than "an independent security product," may ultimately become a giveaway for hardware sales.

My judgment is: Cisco will launch an "Security as a Service" version of Antares before 2025, allowing third-party security vendors to run customized small models on its devices via APIs and open platforms. At that time, Cisco's role will transform from "equipment manufacturer" to "edge AI computing platform." The ceiling of this track might be much higher than we imagine.

Original Link: https://www.ithome.com/0/980/239.htm