license: apache-2.0
base_model: unsloth/Qwen3.6-27B
library_name: peft
pipeline_tag: text-generation
language:
- en
tags:
- cybersecurity
- cyber-threat-intelligence
- threat intelligence
- cti
- mitre-attack
- vulnerability
- cvss
- cwe
- qwen3_5
- lora
BeyondCTI-27B
BeyondMemory Intelligence | Website License: Apache 2.0 | Authors: Samet "samogod" Gozet & Safa Karakuş @ BeyondMemory Intelligence
A cyber threat intelligence model fine-tuned from Qwen3.6-27B. It reads vulnerability descriptions and threat reports and produces the structured output an analyst actually needs: a CWE class, a CVSS v3.1 vector, a set of MITRE ATT&CK technique IDs, or an answer to a security knowledge question.
It has the highest CTI-ATE score in this comparison, ahead of GPT-5.4 and Gemini 3.5 Flash. ATE is the task that hands a model a real threat report and asks which MITRE ATT&CK techniques it describes. Of the four CTIBench tasks it is the closest to the work an analyst does with an APT writeup, and it is where general-purpose frontier models fall off hardest: GPT-5.4 and Gemini both sit above 81 on multiple-choice questions, then drop to 46.5 and 28.2 on technique extraction. Pulling structured intelligence out of messy prose is a different skill from closed-book recall, and it is the one this model is built for. The same holds on the other two structured tasks, CWE mapping and CVSS scoring, where it leads the comparable open model at the same protocol.
Model Overview
| Base model | unsloth/Qwen3.6-27B (qwen3_5, hybrid Gated DeltaNet) |
| Parameters | 27B (LoRA adapter, r=32) |
| Precision | bf16 |
| Context window | 4096 tokens (training); base supports more |
| Modality | Text only (the base is vision-language; the vision tower is frozen and unused) |
| License | Apache 2.0 |
Benchmark Results
CTIBench, official protocol: system prompt "You are a cybersecurity expert specializing in cyberthreat intelligence.", greedy decode, n=500 per task (CTI-ATE uses the full 60-item set). The figure at the top of this card carries the full comparison.
The greedy column is our own measurement of their published model on this harness, at the same protocol we ran ours on. That is the like-for-like comparison. The thinking column, along with GPT-5.4 and Gemini 3.5 Flash, is as reported on the qwen36-secura model card; we did not run those ourselves.
On CTI-MCQ the frontier APIs remain ahead. That task is a closed-book quiz drawn largely from MITRE documentation, so it rewards breadth of memorized knowledge rather than the extraction and scoring work the rest of the benchmark measures.
Benchmark items are never trained on. Training data is decontaminated against every CTIBench split before training, fail closed, and the scores above are raw eval output.
Intended Use
Vulnerability triage (CTI-RCM). Give it a CVE description or an advisory and it returns the CWE weakness class with a short justification. Useful for backlog triage and for normalising vendor advisories that ship without a CWE mapping.
Severity scoring (CTI-VSP). It produces a full CVSS v3.1 base vector, metric by metric. Treat the output as a first-pass estimate to be reviewed, not as an authoritative score.
Report analysis (CTI-ATE). Give it a threat report and the MITRE Enterprise technique list, and it extracts the parent technique IDs. This is the model's strongest task and the one most worth automating.
Knowledge questions (CTI-MCQ). It answers multiple-choice security questions. For open-ended knowledge work a frontier API will generally serve you better; this model is tuned for structured CTI output, not for general recall.
Not intended for offensive tooling, exploit generation, or as an autonomous decision-maker in an incident response chain. Keep an analyst in the loop.
Getting Started
This repository holds the LoRA adapter (~640 MB), not merged weights. The base model
unsloth/Qwen3.6-27B is downloaded separately and the adapter is applied on top, so both loaders below
pull roughly 55 GB on first run.
Transformers + Unsloth
from unsloth import FastLanguageModel
model, proc = FastLanguageModel.from_pretrained(
"BeyondMemory/BeyondCTI-27B", max_seq_length=4096, load_in_4bit=False, dtype="bfloat16")
tok = getattr(proc, "tokenizer", proc)
FastLanguageModel.for_inference(model)
SYS = "You are a cybersecurity expert specializing in cyberthreat intelligence."
def ask(prompt, max_new_tokens=512):
ids = tok.apply_chat_template(
[{"role": "system", "content": SYS}, {"role": "user", "content": prompt}],
add_generation_prompt=True, enable_thinking=False, return_tensors="pt").to(model.device)
out = model.generate(ids, max_new_tokens=max_new_tokens, do_sample=False)
return tok.decode(out[0][ids.shape[1]:], skip_special_tokens=True).strip()
print(ask("Analyze the following CVE description and map it to the appropriate CWE. Ensure the last "
"line contains only the CWE ID. CVE Description: A SQL injection in the login form lets a "
"remote attacker run arbitrary SQL via the username parameter."))
vLLM
Serve the base text-only and attach the adapter as a LoRA module:
vllm serve unsloth/Qwen3.6-27B \
--enable-lora \
--lora-modules beyondcti=BeyondMemory/BeyondCTI-27B \
--max-lora-rank 32 \
--language-model-only \
--reasoning-parser qwen3 \
--max-model-len 16384
Then call it with model="beyondcti". If you would rather serve a single merged checkpoint, merge
locally first with PeftModel.from_pretrained(base, adapter).merge_and_unload() and point vLLM at the
output directory.
from openai import OpenAI
client = OpenAI(base_url="http://localhost:8000/v1", api_key="EMPTY")
r = client.chat.completions.create(
model="beyondcti", temperature=0,
messages=[
{"role": "system", "content": "You are a cybersecurity expert specializing in cyberthreat intelligence."},
{"role": "user", "content": "Analyze the following CVE description and calculate the CVSS v3.1 "
"vector. Ensure the final line contains only the vector string. "
"CVE Description: An unauthenticated remote attacker can execute "
"arbitrary code by sending a crafted packet."},
])
print(r.choices[0].message.content)
Decoding
Use greedy (temperature=0, do_sample=False) for all four tasks. The model is trained to answer
directly, so thinking mode adds latency without improving the structured tasks.
Hardware Requirements
| Setup | VRAM |
|---|---|
| bf16 inference (adapter on base) | ~60 GB, one 80 GB card |
| 4-bit inference | ~20 GB |
| Fine-tuning (LoRA, bf16, batch 1) | ~70 GB, one 80 GB card |
Trained on a single H200 for one epoch.
Training
| Method | Supervised fine-tuning, LoRA only, no continued pretraining |
| LoRA | r=32, alpha=64, RSLoRA, on q/k/v/o/gate/up/down |
| Schedule | 1 epoch, lr 1e-4 cosine, response-masked, packing off |
| Sequence length | 4096 |
| Hardware | 1× H200 |
Limitations
CTI-MCQ is a closed-book knowledge test and sits near the base model's ceiling, so fine-tuning moves it very little; frontier APIs score higher there. CTI-ATE is measured on 60 items and carries a wide confidence interval, so read that column as a strong result rather than a settled one. Knowledge is bounded by the base model's cutoff, so recent CVEs and newly documented techniques may be missed. CVSS scoring reflects the conventions of its training distribution and can disagree with a vendor's own rating. General, non-CTI capability is not benchmarked; treat this as a task-specialized model.
Citation
@misc{beyondcti27b,
title = {BeyondCTI-27B: a task-specialized cyber threat intelligence model},
author = {BeyondMemory},
year = {2026},
url = {https://huggingface.co/BeyondMemory/BeyondCTI-27B}
}
Acknowledgements
Built on unsloth/Qwen3.6-27B and trained with Unsloth.
Evaluated on AI4Sec/cti-bench. Comparison figures
for other systems are taken from the qwen36-secura
model card.