Best AI for Cybersecurity in 2026: Which Defender Models You Can Actually Use

Google said on 28 October 2026 that Gemini 4 Carbon scores 88.2% on SEC-bench Pro, a test of finding real software vulnerabilities, and in the same post said access starts with a limited group of approved defenders. That gap between the best number and the model you can open today is the whole story of AI for cybersecurity this autumn.

Hokai chart of the access gate on each defender model, from Google, OpenAI and Anthropic program pages read on 6 November 2026.

Three vendors now run vetted-defender programs: Google's Fairwind, OpenAI's Daybreak and Anthropic's Cyber Verification Program. Each loosens refusals or unlocks a cyber-tuned model for approved teams and keeps it from everyone else. So the useful question is not which model scores highest. It is which model your team can actually get, what it costs, and how far you can trust what it reports.

This guide covers AI used by defenders: code scanning, patching, alert triage, detection work and the SOC. It does not cover securing AI systems themselves, which our guide to AI governance and security tools handles. It also leaves out offensive how-to material on purpose.

What counts as AI for cybersecurity here

Three kinds of product get called "AI for cybersecurity," and they are not interchangeable. A frontier model with a cyber-tuned variant is a model you call through an API or a coding agent. A security agent such as Codex Security or Google's CodeMender wraps a model in a tool kit that scans, validates and drafts fixes. A SOC copilot such as Microsoft Security Copilot sits inside the tools where alerts already land.

The access question differs for each. That matters. Models and agents are gated by who you are. Copilots are gated by what you already buy. Open-weight models are not gated at all, and they are also much smaller.

How to choose: three jobs, three gates

Start with the job, because the job decides the gate. Secure code review, threat modeling, patching known issues and triaging alerts need nothing special. Anthropic's program page says its generally available models can be used by everyone for exactly those tasks, and OpenAI's standard tier lists code review and patching too.

Malware analysis, exploit validation and reverse engineering are where safety classifiers start interrupting. That is the work the vetted programs exist for. Authorized penetration testing and red-team tooling sit at the top of every ladder, and each vendor asks the most of you there.

Pick by this rule. If your work is code and alerts, buy capacity on a generally available model and add a program tier only when a classifier blocks real work. If your work is malware, exploit validation or testing critical systems, apply early, because review takes time and approval is not automatic at any of the three.

The shortlist: who can get which model

The table below is the shortlist. Prices marked "not published" are ones we could not find on the vendor's own pages, and we did not guess them.

Google: Gemini 4 Argon, Carbon and CodeMender

Google's program is Fairwind, and its page lists more than 650 partners. You apply by contacting your Cloud account team. Google says it runs background checks on applicants, prioritizes governments, critical infrastructure operators and core technology platforms, and welcomes academic labs that focus on defensive benchmarking.

What Fairwind asks of partners

The terms are strict. Partners may only run dual-use tasks such as authorized threat simulation, reverse engineering and malware analysis for defensive and academic research. They must use phishing-resistant MFA, may only give model access to internal cybersecurity, incident response or penetration testing teams, and may not resell access.

Gemini 4 Argon is the model the program is built around, and Fairwind partners get a version with cyber capabilities. Google's Gemini cyber page reports Argon at 85.8% on real-world vulnerability discovery across 20 languages, against 71.0% for Gemini 3.8 Flash Cyber. The older Gemini 3.5 Flash Cyber is a July 2026 tune that a newer model has since passed. For a head-to-head against rivals, see our Argon, Astra and Opus comparison.

Carbon is the new one. Google's announcement reports 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench, a patching test, all "evaluated without guardrails." It says Carbon will go to a limited group of approved defenders first and to developers and businesses "as soon as possible," with no date. The introductory price matches Argon's, and the post lists a higher rate once that period ends (both rates are in the shortlist table).

CodeMender is the route for teams outside Fairwind. Google's Fairwind FAQ says non-eligible organizations can use CodeMender with publicly available models, and students are pointed to it. Google's CodeMender page says it builds a proof-of-concept exploit in a customer-managed environment to prove a flaw is real, then drafts a patch that developers review and approve. Its price is "contact sales."

OpenAI: Daybreak Blue, Red and Codex Security

OpenAI's program is Daybreak, and its help article lays out three levels. Standard mainline access covers secure code review, threat modeling and patching. Daybreak Blue reduces refusals on models such as GPT-5.6 Sol for verified defensive work, including vulnerability triage, malware analysis and detection engineering. Daybreak Red adds the cyber-specialized models.

OpenAI calls Blue "the recommended starting point for most security teams." Individuals can apply for Blue if they hold an eligible paid plan, enroll in Advanced Account Security and own a compatible FIDO2 hardware key. Red is open only to approved business and enterprise organizations. Both need approval, and the article says plainly that "approval is not automatic."

GPT-5.6-Cyber arrived on 10 August 2026, built on GPT-5.6 Sol. On 5 November OpenAI added GPT-6 Cyber, which it says scores 48.5% on ExploitGym against 32.1% for GPT-5.6 Cyber. GPT-6 Cyber starts with a select group of Red customers, and GPT-5.6-Cyber is now offered to all of them. OpenAI also announced a $1 billion grant program, Daybreak for Frontline Defenders, to subsidize access for governments and essential service providers.

Codex Security is the agent layer. OpenAI's docs describe four ways to run it: a cloud product that scans connected GitHub repositories, a local plugin with a findings workbench, a command-line tool for repeatable and CI scans, and an SDK. The cloud version is a research preview. It requires a workspace with access, a linked GitHub account and a Codex cloud environment. The docs page does not state a price. OpenAI's lineup of models also includes GPT-6 Astra, the mainline model OpenAI says already supports code review and triage.

Anthropic: the Cyber Verification Program

Anthropic's route is the Cyber Verification Program, updated in October 2026. It now has three access tiers covering Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1. You apply once per organization through Anthropic's verification portal, and the page aims for a decision within seven business days.

Individuals such as independent researchers, maintainers and bug bounty hunters apply separately and can only get the Defense tier at present. Approval alone does nothing: an admin has to assign the grant to a workspace, a role or a linked cloud account. Using the access to serve your own customers needs a separate application. Managed services are open, and products are not open yet.

If you work in the terminal, Claude Code is the usual front end for this kind of code review, and our Codex versus Claude Code comparison covers how the two agents differ. For picking among the Claude models themselves, see which Claude model to use. Anthropic's own company page is here.

SOC work without a gate: Microsoft Security Copilot

Not every defender needs a cyber-tuned model. A SOC analyst triaging incidents mostly needs the assistant inside the tools where alerts land. Microsoft sells Security Copilot on capacity, measured in security compute units, with no application and no vetting.

Provisioned capacity costs $4 per SCU per hour, with a minimum of one SCU, and overage capacity costs $6.

Microsoft's own example shows 4 provisioned SCUs plus 3.2 overage SCUs in one hour. That hour is billed at $35.20. Microsoft 365 E5 and E7 customers get 400 SCUs a month per 1,000 user licenses, capped at 10,000 SCUs a month, so a 4,000-seat tenant gets 1,600.

For a team already on Defender and Sentinel, that makes Security Copilot the cheapest thing to try. The catch is scope. It summarizes incidents, hunts across Microsoft telemetry and writes queries. It does not find zero-day bugs in your source code.

Threat intelligence is a neighboring product. Cyble describes an agentic platform for dark web monitoring and threat intelligence, and its site steers buyers to a demo request rather than a price list. We found no public price.

Open weights: what you can run yourself

If data cannot leave your network, open weights are the only fully ungated option. Cisco's Foundation AI group publishes Foundation-Sec-8B, an 8-billion-parameter base model built on Llama 3.1 and trained further on security text such as threat reports and vulnerability databases. It carries an Apache 2.0 license, and Cisco released it on 28 April 2025.

It is small. Its model card says so. It may not know vulnerabilities published after its training cutoff and may struggle with novel attack patterns. It is a base model for building classifiers and assistants, not a vulnerability hunter. Our guide to open-weight models covers larger general models you can host, and private AI options covers the hosting side.

Check who the model is allowed to work for

Every program limits who the model may work for. That matters most if you run a consultancy or sell security services. OpenAI says Daybreak is for approved internal use only: no customer-facing workflows, no third-party access, no downstream product traffic. Google forbids sharing, redistributing or selling Fairwind access.

Anthropic is the most specific. Its access covers security work on your own organization's code, products and infrastructure. Running the model on a customer's code is a separate application per service. Managed services, where your staff do the work and the customer only gets a report, are open. Products your customers use directly are not.

Check this clause first. Always. A tier that cannot legally cover your clients is the wrong tier, however good its benchmark.

What it costs

Six of the ten rows in the shortlist have no public price, and that is itself a finding. Daybreak, the Anthropic program, Codex Security and Fairwind do not publish a rate card on the pages we read. OpenAI's help article adds that "a commercial agreement or purchase alone does not guarantee" access, so money does not buy a place in the queue.

The prices that do exist are for the ungated layers. Microsoft's SCU rates are public, Google's Carbon introductory rate of $2 and $10 per million tokens is public even though most buyers cannot use it yet, and Foundation-Sec is free to download. For budgeting, treat Red and Fairwind as enterprise contracts negotiated with your account team, and CodeMender as a quote.

How wrong can it be? False positives and hallucinations

None of the three vendors publishes an independent false-positive rate for its defender models in the pages we read. What they publish is benchmark scores they ran themselves, and those answer a different question. Google's Carbon figures are labeled as evaluated without guardrails, which tells you about the model's ceiling and nothing about how it behaves behind your controls.

• GPT-5.6-Cyber95.0% Leader
• GPT-5.5-Cyber57.3%
• GPT-5.6 Sol with Daybreak Blue2.0%
• GPT-5.6 Sol, standard1.5%

Read from OpenAI's 10 August 2026 post. It counts requests answered, not answers that were correct.

Read that chart carefully. OpenAI's 95.0% for GPT-5.6-Cyber measures how often the model answers rather than refuses. The earlier GPT-5.5-Cyber completes 57.3%, while standard Sol completes 1.5% and Sol with Blue access 2.0%. The same post says GPT-5.6-Cyber scored worse than GPT-5.6 Sol on its vulnerability discovery and report-writing test, which OpenAI attributes to shorter, less detailed reports. A model that answers more is not a model that is right more.

Microsoft is the most direct about error. Its application card says output "may be inaccurate, incomplete, biased," that overreliance could mean "missed threats, incorrect incident conclusions," and that generated code may look valid and still be wrong. Google's CodeMender page and the Fairwind terms both keep a person in the loop for patches, and OpenAI recommends sandboxing and action review for its cyber models.

A practical way to cap the risk: have the model produce evidence you can check. A finding should come with a reproduction or a code path, a patch should pass your tests, and a triage verdict should cite the log lines it used. Google says Carbon cuts unsupported claims by about half in its own tests, which implies the other half still exist.

Where your data goes

Access programs trade privacy for trust, and the terms differ more than the marketing does.

OpenAI's GPT-6 Cyber post explains Private Safety Processing: encrypted records kept in customer storage for 30 days and reviewed without exposing prompts to OpenAI staff.

Anthropic's page says its program requires data retention so it can detect bad actors, with a zero-data-retention route only for organizations that already hold a retention exemption for Claude Fable or Mythos models, and it lets eligible organizations hold the data in their own cloud once Enterprise Frontier Safeguards ships. We did not check Microsoft's retention terms for this guide. If your code is covered by client privilege, the same questions apply as in our legal AI guide.

The strongest case against waiting for access

The best objection to this guide is that gated models are the only ones worth discussing. If Carbon finds vulnerabilities at 88.2% and a generally available model does worse, why settle? The honest answer has three parts.

First, you cannot use Carbon today unless Google admits you. Second, the vendors themselves say the everyday jobs do not need the gate: Anthropic lists secure code review, patching known issues and alert triage as open to all, and OpenAI puts patching in its ungated tier as well. Third, the benchmark gaps are vendor-run, and Google's own Argon page shows Grok 4.7, Argon and GPT-6 Astra tied at 68.0% on CWE-bench v1 with Claude Opus 5.5 at 67.0%.

So the best model is not always the best choice. Access decides. The gate buys you the tasks the open models refuse, not a much better patch.

A rollout order for a small security team

Most teams do not need all of this. A sensible order, built from what the vendors say is open today:

1. Run a generally available model over your own repositories for review and known-issue patching, with a person approving every change.
2. Turn on an assistant inside the SOC tools you already pay for, and measure how many of its summaries an analyst has to correct.
3. Apply for the lowest tier that unblocks real work: Daybreak Blue, or the Defense tier of Anthropic's program.
4. Apply for Fairwind or Daybreak Red only when the work involves malware, exploit validation or testing critical systems.

Step two is the one teams skip. A correction rate you measure yourself beats any vendor benchmark.

Who should skip the gated tier

Skip Fairwind and Daybreak Red if your team is a handful of developers shipping a web product. You will not qualify for Fairwind, which prioritizes governments and critical infrastructure, and Red is limited to approved organizations. A generally available frontier model in Codex Security or Claude Code, plus your existing scanners, is the sensible stack. Our coding assistants guide compares the day-to-day tools, and GitHub Copilot is the default for teams already on GitHub.

Skip the vetted tiers too if you are a student or hobbyist. Google points students to CodeMender, Anthropic's Defense tier is open to individuals, and Foundation-Sec runs on a laptop. Do not skip them if you run incident response for a hospital, a utility or a national agency. That is the work Google, OpenAI and Anthropic say the programs were built for.

Not sure which bucket you are in? Smart Match can turn your team size and tooling into a shortlist. The AI security solutions directory lists the commercial security products that sit outside these programs.

What would change the ranking

Watch for three events. If Google opens Carbon to developers at its introductory price, it jumps from "ask Google" to "buy it this week," and the shortlist gets a new default. If OpenAI widens GPT-6 Cyber from select Red customers to all of them, the Red tier becomes the broadest cyber-tuned offering. If an independent group publishes false-positive rates on real codebases, the argument in this guide about vendor-run numbers gets weaker, and we would rewrite it.

Check the Fairwind and Daybreak pages again before you commit budget. Carbon and GPT-6 Cyber were announced eight days apart, OpenAI's help article was edited the day we read it, and the model leaderboard shows which general models are closing the gap.

Frequently asked questions

What is the best AI for cybersecurity in 2026?

It depends on the job and on access. For code review, patching and alert triage, a generally available frontier model with human review works today. Gemini 4 Carbon, GPT-6 Cyber and Claude Mythos 5.1 score highest on vendor benchmarks but need approval from Google, OpenAI or Anthropic.

How do I get access to Gemini 4 Carbon or Gemini 4 Argon for cyber work?

Contact your Google Cloud account team to apply to the Fairwind Program. Google runs background checks and prioritizes governments, critical infrastructure operators and core technology platforms. Carbon is limited to a subset of defenders and has no public release date.

What is the difference between Daybreak Blue and Daybreak Red?

Blue reduces refusals on mainline OpenAI models for verified defensive work and is the recommended starting point. Red adds cyber-specialized models such as GPT-5.6-Cyber and, with separate approval, GPT-6 Cyber. Red is limited to approved business and enterprise organizations.

Can AI models hallucinate security findings?

Yes. Microsoft says Security Copilot output may be inaccurate or incomplete and that generated code may look valid but be wrong. None of the vendors we read publishes an independent false-positive rate, so verify each finding with a reproduction or a test.

Is there a free or open-weight AI model for cybersecurity?

Cisco Foundation AI publishes Foundation-Sec-8B under Apache 2.0, an 8-billion-parameter base model you can run locally. It is small, has a fixed training cutoff and is not a vulnerability hunter. Anthropic and Google also point individuals and students to lower tiers.

Covered in this guide

• anthropic: Anthropic is a Public Benefit Corporation started by 7 ex-OpenAI researchers. It builds the Claude model family and counts Amazon and Google among its largest backers.
• claude-fable-5: The first generally available Mythos-class Claude model, with 1M context and 95.0% SWE-bench Verified. Released June 2026 by Anthropic.
• claude-mythos-5.1: Anthropic's Mythos-class model, identical to Fable 5.1 but with safeguards relaxed for verified cyber and life-sciences users, scoring 1,853 on GDPval-AA v2.
• claude-opus-5.5: Anthropic's September 2026 flagship LLM with a 1 million token context window, built for long-running agentic coding and computer use.
• claude-sonnet-5.5: Anthropic's fastest Sonnet-class model, launched in September 2026, with a 1M context and output more than 30% faster than Sonnet 5.
• codex-security: OpenAI's application security agent scans connected GitHub repositories, tests likely bugs in a sandbox, and drafts fixes for review as pull requests.
• cyble: AI-native cyber threat intelligence platform rated 4.8/5 on G2 from 151 reviews, built by Y Combinator-backed Cyble for enterprise SOC teams.
• gemini-3.5-flash-cyber: Gemini 3.5 Flash Cyber (Google DeepMind, 2026) is a gated fine-tune of Gemini 3.5 Flash for finding and patching vulnerabilities inside CodeMender.
• gemini-3.8-flash-cyber: Gemini 3.8 Flash Cyber (Google DeepMind, Sept 2026) reports 86.2% on CyberGym and is limited to vetted Fairwind Program defenders; Gemini 4 Argon now sits above it.
• gemini-4-argon: Google DeepMind's Gemini 4 frontier model, generally available on the paid Gemini API: 1M-token context and output, text, image, video, audio and PDF input.
• gemini-4-carbon: Google DeepMind's Gemini 4 Carbon, announced in October 2026: a cybersecurity and long-horizon coding model in limited access for approved cyber defenders.
• github-copilot: GitHub's AI coding assistant with agent mode and MCP support across 6 IDEs, plus a free plan with no credit card required.
• gpt-5.6-sol: GPT-5.6 Sol by OpenAI (July 2026): flagship-tier pricing, 2x token efficiency vs peers, ultra multi-agent coordination, programmatic tool calling. Microsoft 365 Copilot preferred model.
• gpt-5.6-cyber: OpenAI's gated cybersecurity fine-tune of GPT-5.6 Sol, released August 2026 for vetted Daybreak Red partners doing authorized exploit development and vulnerability research.
• gpt-6-astra: OpenAI's flagship model, launched September 2026 as the first ever rated at the Preparedness Framework's Critical cybersecurity level.
• microsoft: Microsoft, founded 1975, is a public company (NASDAQ: MSFT) and the Redmond maker of Windows, Azure, GitHub and the Copilot assistants, with $331.8B of fiscal 2026 revenue.
• openai: OpenAI builds ChatGPT, the GPT-6 family (Astra, Sol, Luna), Codex and the OpenAI API. It reports 1.2B weekly ChatGPT users and an $852B valuation after its March 2026 round.

Sources