A cyber threat intelligence model fine-tuned from Qwen3.6-27B. It reads vulnerability descriptions and threat reports and produces the structured output an analyst actually needs: a CWE class, a CVSS v3.1 vector, a set of MITRE ATT&CK technique IDs, or an answer to a security knowledge question.

It has the highest CTI-ATE score in this comparison, ahead of GPT-5.4 and Gemini 3.5 Flash. ATE is the task that hands a model a real threat report and asks which MITRE ATT&CK techniques it describes. Of the four CTIBench tasks it is the closest to the work an analyst does with an APT writeup, and it is where general-purpose frontier models fall off hardest: GPT-5.4 and Gemini both sit above 81 on multiple-choice questions, then drop to 46.5 and 28.2 on technique extraction. Pulling structured intelligence out of messy prose is a different skill from closed-book recall, and it is the one this model is built for. The same holds on the other two structured tasks, CWE mapping and CVSS scoring, where it leads the comparable open model at the same protocol.

Model Overview


Base model	`unsloth/Qwen3.6-27B` (qwen3_5, hybrid Gated DeltaNet)
Parameters	27B (LoRA adapter, r=32)
Precision	bf16
Context window	4096 tokens (training); base supports more
Modality	Text only (the base is vision-language; the vision tower is frozen and unused)
License	Apache 2.0

Benchmark Results

CTIBench, official protocol: system prompt "You are a cybersecurity expert specializing in cyberthreat intelligence.", greedy decode, n=500 per task (CTI-ATE uses the full 60-item set). The figure at the top of this card carries the full comparison.

The greedy column is our own measurement of their published model on this harness, at the same protocol we ran ours on. That is the like-for-like comparison. The thinking column, along with GPT-5.4 and Gemini 3.5 Flash, is as reported on the qwen36-secura model card; we did not run those ourselves.

On CTI-MCQ the frontier APIs remain ahead. That task is a closed-book quiz drawn largely from MITRE documentation, so it rewards breadth of memorized knowledge rather than the extraction and scoring work the rest of the benchmark measures.

Benchmark items are never trained on. Training data is decontaminated against every CTIBench split before training, fail closed, and the scores above are raw eval output.

Intended Use

Vulnerability triage (CTI-RCM). Give it a CVE description or an advisory and it returns the CWE weakness class with a short justification. Useful for backlog triage and for normalising vendor advisories that ship without a CWE mapping.

Severity scoring (CTI-VSP). It produces a full CVSS v3.1 base vector, metric by metric. Treat the output as a first-pass estimate to be reviewed, not as an authoritative score.

Report analysis (CTI-ATE). Give it a threat report and the MITRE Enterprise technique list, and it extracts the parent technique IDs. This is the model's strongest task and the one most worth automating.

Knowledge questions (CTI-MCQ). It answers multiple-choice security questions. For open-ended knowledge work a frontier API will generally serve you better; this model is tuned for structured CTI output, not for general recall.

Not intended for offensive tooling, exploit generation, or as an autonomous decision-maker in an incident response chain. Keep an analyst in the loop.

Getting Started

This repository holds the LoRA adapter (~640 MB), not merged weights. The base model unsloth/Qwen3.6-27B is downloaded separately and the adapter is applied on top, so both loaders below pull roughly 55 GB on first run.

Transformers + Unsloth

python

from unsloth import FastLanguageModel

model, proc = FastLanguageModel.from_pretrained(
    "BeyondMemory/BeyondCTI-27B", max_seq_length=4096, load_in_4bit=False, dtype="bfloat16")
tok = getattr(proc, "tokenizer", proc)
FastLanguageModel.for_inference(model)

SYS = "You are a cybersecurity expert specializing in cyberthreat intelligence."

def ask(prompt, max_new_tokens=512):
    ids = tok.apply_chat_template(
        [{"role": "system", "content": SYS}, {"role": "user", "content": prompt}],
        add_generation_prompt=True, enable_thinking=False, return_tensors="pt").to(model.device)
    out = model.generate(ids, max_new_tokens=max_new_tokens, do_sample=False)
    return tok.decode(out[0][ids.shape[1]:], skip_special_tokens=True).strip()

print(ask("Analyze the following CVE description and map it to the appropriate CWE. Ensure the last "
          "line contains only the CWE ID.  CVE Description: A SQL injection in the login form lets a "
          "remote attacker run arbitrary SQL via the username parameter."))

vLLM

Serve the base text-only and attach the adapter as a LoRA module:

bash

vllm serve unsloth/Qwen3.6-27B \
  --enable-lora \
  --lora-modules beyondcti=BeyondMemory/BeyondCTI-27B \
  --max-lora-rank 32 \
  --language-model-only \
  --reasoning-parser qwen3 \
  --max-model-len 16384

Then call it with model="beyondcti". If you would rather serve a single merged checkpoint, merge locally first with PeftModel.from_pretrained(base, adapter).merge_and_unload() and point vLLM at the output directory.

python

from openai import OpenAI
client = OpenAI(base_url="http://localhost:8000/v1", api_key="EMPTY")

r = client.chat.completions.create(
    model="beyondcti", temperature=0,
    messages=[
        {"role": "system", "content": "You are a cybersecurity expert specializing in cyberthreat intelligence."},
        {"role": "user", "content": "Analyze the following CVE description and calculate the CVSS v3.1 "
                                    "vector. Ensure the final line contains only the vector string.  "
                                    "CVE Description: An unauthenticated remote attacker can execute "
                                    "arbitrary code by sending a crafted packet."},
    ])
print(r.choices[0].message.content)

Decoding

Use greedy (temperature=0, do_sample=False) for all four tasks. The model is trained to answer directly, so thinking mode adds latency without improving the structured tasks.

Hardware Requirements

Setup	VRAM
bf16 inference (adapter on base)	~60 GB, one 80 GB card
4-bit inference	~20 GB
Fine-tuning (LoRA, bf16, batch 1)	~70 GB, one 80 GB card

Trained on a single H200 for one epoch.

Training


Method	Supervised fine-tuning, LoRA only, no continued pretraining
LoRA	r=32, alpha=64, RSLoRA, on q/k/v/o/gate/up/down
Schedule	1 epoch, lr 1e-4 cosine, response-masked, packing off
Sequence length	4096
Hardware	1× H200

Limitations

CTI-MCQ is a closed-book knowledge test and sits near the base model's ceiling, so fine-tuning moves it very little; frontier APIs score higher there. CTI-ATE is measured on 60 items and carries a wide confidence interval, so read that column as a strong result rather than a settled one. Knowledge is bounded by the base model's cutoff, so recent CVEs and newly documented techniques may be missed. CVSS scoring reflects the conventions of its training distribution and can disagree with a vendor's own rating. General, non-CTI capability is not benchmarked; treat this as a task-specialized model.

Citation

bibtex

@misc{beyondcti27b,
  title  = {BeyondCTI-27B: a task-specialized cyber threat intelligence model},
  author = {BeyondMemory},
  year   = {2026},
  url    = {https://huggingface.co/BeyondMemory/BeyondCTI-27B}
}

Acknowledgements

Built on unsloth/Qwen3.6-27B and trained with Unsloth. Evaluated on AI4Sec/cti-bench. Comparison figures for other systems are taken from the qwen36-secura model card.