Cynos identifies the security task, selects the least expensive model that can meet the bar, and has a domain-expert judge check every answer for frontier-grade results.
CynosInference loopSecurity modelsOpen modelsFrontier modelsAgents
Cynos ships ready-made agents for everyday security work. Run one, compare it to a frontier model, then take the code and build on it.
Featured agents
agent/threat-modeling
Finds the security issues in a design doc or architecture diagram before anything ships.
agent/mitigation
Writes WAF rules that protect a vulnerability until it can be patched.
agent/threat-intel
Tracks critical, actively exploited vulnerabilities and how to fix each one.
agent/detection-engineering
Turns MITRE ATT&CK techniques into validated Sigma detection rules.
More on the way. New agents are added to the library regularly.
The problem
No single model is best at every security workflow. There are three ways to run inference for security today, and each one fails.
The highest price on every request, including work a small model handles fine, and not the best answer on most security workflows.
Routes on prompt length and price with no idea what security work the request is. Accuracy drops on the calls that matter: exploitability, severity, remediation.
Neither approach tells you whether the result was any good. Nothing evaluates it before your application sees it.
The approach
Task-aware routing, purpose-built security models, and a domain-expert judge, used together.
Reads the intent of each request and routes it to the model that performs that workflow best at the lowest price.
You pick the fallback model. Cynos costs the same or less than sending everything to it.
Small models fine-tuned on one security workflow each. Frontier performance at a fraction of the cost.
Fine-tuned for vulnerability management and cloud security first, with more workflows coming.
Every answer is judged against a bar specific to the workflow. Rejected answers go back to the model with a critique before your application sees them.
If the rework stalls, the task escalates to the fallback model.
How it works
Point your agents at Cynos instead of a single provider.
Cynos identifies the security workflow the request belongs to, its complexity, and the bar the answer must clear, not just how long the prompt is.
The cheapest model that can do the job, from our purpose-built security models, open models, and closed frontier models.
A domain-expert judge scores the result against criteria for that workflow.
If the answer clears the bar, Cynos returns it. If not, the judge sends a critique back to the model for another round. When that stalls, the task escalates to the fallback model.
Cynos runs the routing and the judge. Open-weight models run on a partner inference provider. Customer-approved hosting, such as Amazon Bedrock in your own AWS account, is on the roadmap.
Benchmarks
The whole inference layer, judge rounds included, measured against single models on six security workflows.
| Benchmark | Cynos | GPT-5.6 Sol | GLM-5.3 | DeepSeek V4 Pro | MiniMax M3 | GLM-5.3 Flash |
|---|---|---|---|---|---|---|
Vulnerability triage Triage a vulnerability finding on exploitability and reachability | 84.2 $66 | 76.4 $423 | 85.2 $111 | 82.4 $55 | 83.7 $23 | 82 $7 |
Misconfiguration triage Triage a misconfig alert: eliminate false positives, set severity | 85 $12 | 77 $38 | 84 $28 | 74 $5 | 81 $4 | 76 $2 |
Terraform mitigation generation Produce Terraform code for the mitigation (IaC-Eval) | 50.2 $4 | 47.4 $27 | 31.2 $11 | 29.9 $5 | 25.1 95¢ | 29 $1 |
Root-cause mapping of CVEs Identify the underlying weakness class (CWE) | 63 $5 | 57 $34 | 61 $41 | 55 $16 | 57 $2 | 61 $2 |
Threat advisory analysis CyberSOCEval Threat Intel | 59.4 $17 | 57.8 $34 | 54.8 $15 | 53.7 $5 | 57 $2 | 53.1 65¢ |
Malware report analysis CyberSOCEval Malware Analysis | 33.8 $42 | 30 $183 | 33.3 $33 | 33 $20 | 25 $7 | 30 $4 |
Score per benchmark, with the run's cost beneath it. Cynos costs are end to end: routing, model calls, and every judge round. The other columns are a single model call.
Top score on five of six, and within a point on the sixth, at 40% less cost.
$146 across these six runs versus $739 sending them all to GPT-5.6 Sol.
Benchmarked across
Use cases
Cynos routes each workflow to the model measured best on it.
Exploitability analysis, reachability, severity scoring, patch prioritization
Alert triage, false-positive suppression, investigation summaries
Anomalous access detection, entitlement review, identity threat analysis
Control mapping, evidence review, policy-to-framework alignment
Detection rule authoring, tuning, coverage analysis
Advisory analysis, TTP extraction, actor attribution
Get started
Build your first agent on Cynos. One endpoint, with routing, purpose-built models, and the domain-expert judge built in.
