---
title: "Cybersecurity AI Models by API for Security Teams"
canonical: https://pentestllm.ai/cybersecurity-ai
generated: 2026-11-11T18:04:53.009Z
source: https://pentestllm.ai/cybersecurity-ai
base_url: https://api.pentestllm.ai/v1
---

![Rows of server cabinets in a data centre](https://pentestllm.ai/img/datacenter.webp)

## Two halves of the same job

Security teams split into people who find problems and people who watch for them, and both spend much of the day reading. Defenders read alerts, logs and threat reports. Testers read scanner output, source code and advisories. A model that has been tuned on security material, and that does not decline the subject, shortens that reading for both.

General assistants often stop at the word exploit even when the question is defensive, such as asking what an attack in a public report looked like on the wire so that a rule can be written for it. The builds listed here are tuned or abliterated to answer security questions other models decline. Expect reduced refusals, not none.

## Defensive work the models take

- Alert triage: Summarize an alert with its surrounding log lines and say what would confirm or dismiss it.
- Detection rules: Draft Sigma, YARA or query-language rules from a described behaviour, with the reasoning for each condition.
- Threat reports: Condense a long vendor report into techniques, indicators and the controls that apply to your estate.
- Reported email: Classify a message a user reported and pull out the indicators worth blocking.
- Incident notes: Turn a timeline of raw notes into a readable incident summary for people who were not on the call.

## Offensive security work the models take

- Scanner output: Rank findings by severity and likelihood, and name the checks that separate real from false positive.
- Code review: Read a diff or a file for injection, access control and memory safety problems.
- Framework mapping: Map each finding to CWE, OWASP and MITRE ATT&CK identifiers for the report.
- Reporting: Draft findings and an executive summary in your house format.

## Why an API and not another console

Most security teams already have the consoles they need. What they lack is a model that can be called from the SIEM enrichment script, the CI job that reviews a pull request, or the agent an analyst runs in a terminal. An API fits all three. Requests go to `https://api.pentestllm.ai/v1` with a bearer key, in the same shape the OpenAI and Anthropic SDKs already send.

The model id `auto/security` picks a build per request, so a one-line classification is not billed at the price of a long reasoning task. Where a build supports it, a JSON schema in the request returns structured output a pipeline can parse. The API can also run web search, page fetch and a code sandbox on its side; the fees for those are on the [pricing page](https://pentestllm.ai/pricing).

## What a team should check first

Read the [acceptable use policy](https://pentestllm.ai/acceptable-use) and the privacy page before sending production data, and decide which data classes your own rules let you send to any outside API. Start with one narrow job, such as triage of a single alert type, and measure it against how an analyst handles the same queue. The [docs](https://pentestllm.ai/docs) cover keys, endpoints and errors, and the [models page](https://pentestllm.ai/models) shows each build’s context window and supported parameters.

## 9 security builds, priced per token

Read from the live catalog on 2026-11-11. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id `auto/security` has no price of its own: each request is billed at the build that answered.

| Build | Input | Output | Context |
| --- | --- | --- | --- |
| [Qwen3.8 27B Cybersecurity](https://pentestllm.ai/models/qwen3.8-27b-cybersecurity) | $0.40 | $2.40 | 262,144 |
| [Gemma 4 26B A4B Cybersecurity](https://pentestllm.ai/models/gemma-4-26b-a4b-it-cybersecurity) | $0.4224 | $1.3376 | 262,144 |
| [GLM-5.3 Flash Cybersecurity](https://pentestllm.ai/models/glm-5.3-flash-cybersecurity) | $0.5093 | $1.6975 | 1,048,576 |
| [Red Team (Flash)](https://pentestllm.ai/models/uplink-red-team-flash) | $0.90 | $3.00 | not published |
| [Red Team (Pro)](https://pentestllm.ai/models/uplink-red-team-pro) | $1.50 | $6.00 | not published |
| [OrcaCyber MiniMax M3.1 Flash](https://pentestllm.ai/models/minimax-m3.1-flash-cybersecurity) | $2.00 | $4.00 | 261,632 |
| [OrcaCyber Qwen3.8 Flash Next](https://pentestllm.ai/models/orcacyber-qwen3.8-flash-next) | $2.00 | $4.00 | 261,632 |
| [Cyber Frontier](https://pentestllm.ai/models/cyber-frontier) | $5.25 | $15.75 | 1,048,576 |
| [OrcaCyber Zero 1.5](https://pentestllm.ai/models/orca-zero-1.5-cybersecurity) | $7.50 | $18.75 | 999,488 |

[Full price list and tool fees](https://pentestllm.ai/pricing) · [Every model](https://pentestllm.ai/models) · [API docs](https://pentestllm.ai/docs)

## Questions

- On the defensive side: alert triage, detection rule drafts, threat report summaries and incident notes. On the offensive side: scanner output triage, code review, framework mapping and report drafting for authorized tests.
- The builds are tuned or abliterated for security work, so they answer security questions that general models decline. They are reached through the same OpenAI-format and Anthropic-format requests, so existing client code needs only a new base URL, key and model id.
- No. Usage is billed per token from a prepaid balance, starting at a $10 top-up by card or crypto. On 2026-11-11 the lowest-priced security build costs $0.40 per million input tokens.
- Builds that support the response_format parameter return JSON that matches a schema you send. The models page lists the supported parameters of each build.
- People doing lawful security work on systems they own or have written permission to test, including in-house defenders working on their own estate. The acceptable use policy sets out what is not allowed.

## Read next

- [Hacker AI Security-tuned models by API for ethical hacking and authorized testing.](https://pentestllm.ai/hacker-ai)
- [Cybersecurity LLM API The API itself: endpoints, the auto/security router, server tools and per-token prices.](https://pentestllm.ai/cybersecurity-llm-api)
- [Malware analysis Models for static triage, behaviour summaries and detection rules. Analysis and detection only.](https://pentestllm.ai/malware-analysis)
- [Vulnerability research Models for code review, CVE and patch analysis, and advisory writing.](https://pentestllm.ai/vulnerability-research)

## One key, from $10

PentestLLM is for systems you own or have written permission to test. The [acceptable use policy](https://pentestllm.ai/acceptable-use) says what is not allowed.

[Get a key](https://app.pentestllm.ai/console)

usage, 1,000 agent turns on Qwen3.8 27B Cybersecurity

- Input, 8,000 tokens at $0.40 per million: $0.0032
- Output, 1,000 tokens at $2.40 per million: $0.0024
- One turn: $0.0056
- 1,000 turns: $5.60

output price per million tokens, 9 builds

$1.3376 Gemma 4 26B A4B Cybersecurity OrcaCyber Zero 1.5 $18.75