How open-source LLMs are disrupting cybersecurity at scale

Open-source large language models (LLMs) continue to revolutionize the cybersecurity landscape, serving as a strong catalyst for increasing innovation and enabling both startups and established vendors to accelerate time to market.

From new generative AI applications to advanced security tools, these models are the foundation of the future of generative AI-based cybersecurity. Open source models that are gaining traction in the cybersecurity field include Meta’s LLaMA 2. LaMA 3.2, Falcon from the Technology Innovation Institute, Stability AIs StableLMand those hosted by Hugging faceincluded The BLOOM of BigScience. All of these models are increasingly adopted and used, largely due to their greater cost-effectiveness, flexibility and transparency.

Cybersecurity software providers face a growing number of governance and licensing challenges as they enable their platforms to scale in response to the rapidly changing nature of open-source LLM development. Designing an architecture that can quickly adapt and take advantage of the latest features offered by the latest open-source LLMs is a challenge.

Itamar Sher, CEO and co-founder of Seal securityrecently spoke (virtually) with VentureBeat to discuss the fundamental but evolving role of open-source LLMs in their businesses. “Open-source LLMs allow us to scale security patches for open-source components in ways that closed models cannot,” he said.

The ability to quickly scale models is critical for companies like Seal, which use open source components to ensure the rapid deployment of patches across environments. He added that “open-source LLMs give us access to a community that continually improves models and provides a layer of intelligence and speed that would not be possible with proprietary systems.”

The growing importance of open-source LLMs in cybersecurity

Cybersecurity vendors have long relied on customizing their apps, tools and platforms to lock customers into a particular solution, especially in the areas of threat detection and mitigation. However, VentureBeat hears that there is an intense backlash against this strategy, which is further accelerating the popularity of open source LLM.

Gartner’s Hype cycle for open source software 2024 reflects the increasing prominence of open-source LLMs, putting them at the height of inflated expectations. This placement reflects what VentureBeat is hearing about an increase in interest and adoption across the cybersecurity vendor landscape and within enterprises.

Credit: Gartner, Inc. (2024, August 8). Open source software hype cycle, 2024 (ID: G00811366). Gartner, Inc.

The Hype Cycle shows that the maturity of open-source LLMs is still emerging, with market penetration between 5% and 20%. The plateau for this technology is predicted to be reached within the next two to five years, highlighting its rapid growth and growing dominance in the cybersecurity field.

VentureBeat sees more and more cybersecurity startups taking advantage of the customization flexibility and scalability of open-source LLMs in their platform, apps and tool strategies. A widespread use case is refining models to meet domain-specific needs, from improving real-time threat detection to improving vulnerability management.

Sher said, “By integrating open-source LLMs, we can tailor models for specific threats and use cases, allowing us to remain agile and responsive to evolving cybersecurity challenges.”

Comparing the benefits and challenges of open-source LLMs

Open-source LLMs provide several benefits for the development and operation of cybersecurity systems, including the following:

Customization, scale and flexibility: One of the key drivers for adopting open-source LLMs, which are proving popular with cybersecurity companies standardizing them, is the ability to quickly adapt the models for specific use cases. Seal Security’s integration of LLMs into its security platforms, apps, tools and service offerings illustrates how companies can use these models to streamline patch management processes for open source components. John Morello, CTO and co-founder of IntestineSj told VentureBeat in a recent interview that the open-source nature of BERT from Google The open-source language model allows Gutsy to customize and train its model for specific security use cases while maintaining privacy and efficiency.

Community Collaboration: Open-source LLMs benefit from the rapidly growing base of developer communities that are pushing their boundaries and scaling daily to solve complex cybersecurity challenges. These communities set a fast pace for continuous innovation, allowing companies, developers and universities to conduct research to benefit from shared insights and improvements. For example, Seal Security has joined MITER’s CVE Numbering Authority (CNA) to improve collaboration around open-source vulnerabilities.

Reduce supplier lock-in: Open source models provide companies with a way to avoid vendor lock-in, giving them greater control over costs and reducing dependence on proprietary systems. VentureBeat sees this problem becoming a critical issue at the heart of the future of cybersecurity, where flexibility is the goal. Rapid response to threats and a consistent approach to deploying patches are critical to the future of cybersecurity.

However, these benefits are not without challenges. Gartner notes in their research that open-source LLMs often require significant infrastructure investments, which can pose long-term operational challenges for companies that do not have well-funded and staffed in-house IT and security teams.

The licensing complexities associated with open source models can also pose legal and compliance risks. Sher explained that “open source models provide us with transparency, but managing their lifecycles and ensuring compliance is still a major concern.”

Cybersecurity contributions from open-source LLMs are growing

VentureBeat sees cybersecurity providers adopting open-source LLMs at the core of their platforms, gaining a competitive advantage with their improvements in threat detection and response. Seal Security has been able to leverage open source models for real-time detection and vulnerability management by integrating them into their security patching systems. According to Sher, “Our infrastructure is designed to quickly switch between different LLMs depending on the threat landscape and ensure we stay ahead of emerging vulnerabilities.”

Gartner predicts that small language models, or edge LLMs, will see greater adoption in domain-specific applications, led by cybersecurity. Edge LLMs are by definition decentralized, closer to the data they need to analyze, allowing for faster processing and real-time threat detection.

Edge LLMs are designed to require less computing power, making them more manageable and cheaper to train, which is ideal for cybersecurity use cases that require real-time speed and accuracy. By being able to function at the edge, these LLMs can quickly detect threats in environments where latency is critical, such as IoT devices or remote systems.

Protection against software supply chain attacks

Despite the growing number of contributions that open-source LLMs make, they also come with risks. A major concern is the rising number of software supply chain attacks. Gartner’s Hype Cycle for Open-Source Software 2024 notes that open source components have increasingly become the target of state-sponsored attacks. The average age of vulnerabilities in open-source codebases is approx 2.8 yearsmaking it critical for companies to implement and keep their patch management and governance systems up to date.

Seal Security’s recent designation as a CVE Number Authority (CNA) It is essential that the provider plays a more critical role in mitigating the risks of supply chain attacks. The company can now identify, document and attribute vulnerabilities through the CVE program, helping to improve the security of open source code across the industry. Their partnership with MITER further expands these capabilities, allowing Seal to share findings with the broader cybersecurity community.

As Sher highlighted, this partnership helps improve security for everyone using open source software, strengthening the company’s commitment to protecting the global software ecosystem.

Looking ahead

Open-source LLMs are redefining the cybersecurity landscape for the better by reducing the outdated lock-in of proprietary technologies and platforms. VentureBeat sees how quickly these models are advancing in terms of accessibility, quality and speed, making them a viable alternative to proprietary systems.

For companies like Seal Security, the future lies in continually evolving their open-source LLM capabilities to stay ahead of the ever-changing threat landscape. “We are constantly evaluating new models and infrastructures to ensure we provide the best security solutions to our customers,” concludes Sher.