🤗 Free AI Models

Free AI Models for Cybersecurity

Curated reference of cybersecurity-specific AI models — PhishBERT, SecureBERT, malBERT, and more. HuggingFace Inference API usage, accuracy, limitations, and India-relevant use cases for each.

Cybersecurity-Specific Fine-Tuned Models

PhishBERT

ealvaradob on HuggingFace

Phishing URL & text detection

BERT-based model fine-tuned specifically on phishing URL patterns and email content. Classifies input as phishing/legitimate.

Accuracy

High — 97%+ on benchmark datasets

HuggingFace ID

ealvaradob/phishing-URL-detection

Best Input

URLs, email subjects, landing page content

Limitations

English only. Not trained on Indian-brand phishing. Combine with URLHaus blocklist for best results.

🇮🇳 India use case: Ideal for email security gateway integration. Detect phishing attempts targeting Indian banking portals (SBI, HDFC, UIDAI, IRCTC) by adding these to your test set.

from transformers import pipeline classifier = pipeline("text-classification", model="ealvaradob/phishing-URL-detection") result = classifier("http://sbi-netbanking-secure.xyz/login") print(result) # [{"label": "phishing", "score": 0.997}]

SecureBERT

ehsanaghaei on HuggingFace

Security NLP — vulnerability and threat text

BERT model pre-trained on cybersecurity corpora (CVE descriptions, vulnerability reports, threat intel). Better understands security terminology than general BERT.

Accuracy

Medium-High — strong on NER and classification of security text

HuggingFace ID

ehsanaghaei/SecureBERT

Best Input

CVE descriptions, vulnerability reports, threat intel text, CERT advisories

Limitations

Requires fine-tuning for specific downstream tasks. Not a ready-to-use classifier — use as base model for your own fine-tuning.

🇮🇳 India use case: Pre-train NER to extract IOCs, CVE references, and TTPs from CERT-In advisories automatically.

# Use as base for fine-tuning from transformers import AutoTokenizer, AutoModel tokenizer = AutoTokenizer.from_pretrained("ehsanaghaei/SecureBERT") model = AutoModel.from_pretrained("ehsanaghaei/SecureBERT") # Encode security text inputs = tokenizer("CVE-2024-1234: Buffer overflow in OpenSSL", return_tensors="pt") outputs = model(**inputs)

malBERT

markusbayer on HuggingFace

Malware classification from API calls

BERT model fine-tuned on Windows API call sequences to classify malware families. Input is a sequence of Windows API calls from dynamic analysis.

Accuracy

Medium — 85-90% on benchmark malware datasets

HuggingFace ID

markusbayer/using-bert-for-malware-classification

Best Input

Windows API call sequences from sandbox analysis (Cuckoo, ANY.RUN)

Limitations

Requires pre-processing of sandbox output into API call sequences. Not real-time. Best used in automated sandbox pipeline.

🇮🇳 India use case: Automate malware family classification from ANY.RUN or Cuckoo Sandbox reports — relevant for Indian CERT-In malware incident reporting.

# Input: space-separated API call sequence from sandbox api_calls = "CreateFile WriteFile RegSetValue CreateProcess ConnectSocket" from transformers import pipeline classifier = pipeline("text-classification", model="markusbayer/using-bert-for-malware-classification") result = classifier(api_calls) print(result) # {"label": "Ransomware", "score": 0.91}

CyberSecEval (Meta)

facebook/CyberSecEval on HuggingFace

LLM security benchmark

Meta's evaluation framework for assessing LLM cybersecurity capabilities and safety. Not a model to use directly — a benchmark suite to test which free models are best for your security use case.

Accuracy

Benchmark tool, not a classifier

HuggingFace ID

facebook/CyberSecEval

Best Input

Testing LLM models before deployment in SOC tools

Limitations

Evaluation only — not for production use. Use to compare Llama vs Mistral vs Phi-3 for your specific task.

🇮🇳 India use case: Run before deploying any local model in a regulated environment — validate that the model performs acceptably on security tasks relevant to your organisation.

# Clone the evaluation framework git clone https://github.com/meta-llama/PurpleLlama cd PurpleLlama/CybersecurityBenchmarks pip install -r requirements.txt # Run benchmark against your local Ollama model python benchmark_runner.py \ --model ollama/llama3.2 \ --benchmark "instruct"

SecurityLLM / Sec-BERT

jackaduma on HuggingFace

Network log and security event classification

Fine-tuned model for classifying security events from network logs — distinguishes normal from anomalous network behaviour based on log text.

Accuracy

Medium — best on network/IDS log text

HuggingFace ID

jackaduma/SecBERT

Best Input

Network logs, IDS alerts, firewall logs

Limitations

Limited to network security domain. Requires log pre-processing into text format. English-language logs only.

🇮🇳 India use case: Filter high-volume network alerts by running through SecBERT first — only escalate what the model classifies as anomalous.

from transformers import AutoTokenizer, AutoModelForSequenceClassification import torch model_name = "jackaduma/SecBERT" tokenizer = AutoTokenizer.from_pretrained(model_name) model = AutoModelForSequenceClassification.from_pretrained(model_name) log = "src=10.0.1.50 dst=203.0.113.1 port=4444 proto=TCP action=allowed" inputs = tokenizer(log, return_tensors="pt", truncation=True) outputs = model(**inputs) prediction = torch.nn.functional.softmax(outputs.logits, dim=-1)

General-Purpose Models with Free Tiers

Provider / Model	Free Tier	Best Security Use	Data Privacy	Access
Groq — Llama 3.1 8B / 70B	14,400 req/day (8B), 6,000/day (70B). Sub-second responses.	Log analysis, alert triage, rule writing, policy drafts — fastest free option	Data sent to Groq servers in US. Not for RBI/SEBI regulated data.	console.groq.com — API key free
Google AI Studio — Gemini 1.5 Flash	1,500 req/day, 1M token context. Free, no credit card.	Threat report summarisation (long documents), CERT-In advisory analysis	Data used for Google training unless opted out. Not for sensitive logs.	aistudio.google.com — free tier
Mistral AI — Mistral 7B	Free tier with rate limits. JSON mode built-in.	Structured output — detection rules, policy templates, JSON-formatted IOC lists	Data sent to Mistral EU servers. Better for EU compliance.	console.mistral.ai — free tier
Together AI — Multiple models	$25 free credits. Llama 3, Mixtral, Qwen.	Model variety — test multiple before committing to one for your SOC workflow	Data processed in US. Not for regulated Indian financial data.	api.together.xyz — free credits
Cloudflare AI Workers — Llama 3, Mistral	10,000 req/day free. Edge deployment.	Low-latency for webhook-triggered alert enrichment. Fast.	Cloudflare edge nodes — may be outside India.	developers.cloudflare.com/workers-ai
HuggingFace Inference API	Free tier with queue. Thousands of models.	Specialised security models (PhishBERT, malBERT, SecureBERT). Unique models not available elsewhere.	Data sent to HuggingFace US servers.	huggingface.co — free account
Ollama (local)	Unlimited — runs on your hardware.	All security tasks — recommended for regulated Indian entities. Air-gap compatible.	Zero data egress. Full sovereignty. Best for BFSI/Government.	ollama.com — free open source

HuggingFace Inference API — Quick Start

Free API call (no GPU required — uses HF servers)

import requests HF_TOKEN = "hf_YOUR_FREE_TOKEN" # Get free at huggingface.co/settings/tokens def classify_phishing(url_or_text: str) -> dict: """Use PhishBERT to classify phishing URLs/text.""" API_URL = "https://api-inference.huggingface.co/models/ealvaradob/phishing-URL-detection" headers = {"Authorization": f"Bearer {HF_TOKEN}"} response = requests.post( API_URL, headers=headers, json={"inputs": url_or_text} ) return response.json() # Test with Indian banking phishing URLs test_urls = [ "https://www.sbi.co.in/web/personal-banking", # Legitimate "http://sbi-secure-login.xyz/netbanking", # Phishing "https://net.hdfcbank.com/netbanking", # Legitimate "http://hdfc-bank-update.ml/verify-account", # Phishing ] for url in test_urls: result = classify_phishing(url) print(f"{url[:50]}: {result}")

Handle cold start (model loading delay)

import requests import time def query_with_retry(api_url: str, payload: dict, token: str, max_retries: int = 5) -> dict: """ HuggingFace free tier models sleep between calls. This handles the 503 'model loading' response automatically. """ headers = {"Authorization": f"Bearer {token}"} for attempt in range(max_retries): response = requests.post(api_url, headers=headers, json=payload) if response.status_code == 200: return response.json() if response.status_code == 503: # Model is loading — wait and retry wait_time = response.json().get("estimated_time", 20) print(f"Model loading, waiting {wait_time:.0f}s...") time.sleep(wait_time + 2) continue response.raise_for_status() raise Exception(f"Failed after {max_retries} attempts")

Choosing the Right Free Model — Decision Guide

Your Situation	Recommended Model	Why
Working in RBI/SEBI regulated bank or NBFC	Ollama (local) — Llama 3.2 8B	Zero data egress. Full compliance with RBI data localisation. No question about what data leaves your network.
Government / CERT-In / Defence	Ollama (local) — air-gapped deployment	Same as above. No internet connection required at all.
IT services company (Infosys, TCS, Wipro)	Groq free tier or Ollama local	Depends on client contract. If processing client data, use local. For internal SOC, Groq is fine.
Security researcher / individual analyst	Groq (fast) + HuggingFace specialised models	Best capability at zero cost. Groq for speed, HF for specialised tasks.
Need to classify phishing URLs at scale	HuggingFace PhishBERT	Purpose-built for this task. More accurate than general LLMs for URL classification.
Need to analyse malware API calls	HuggingFace malBERT + Ollama for explanation	malBERT classifies family, then pass results to Llama for explanation.
Need to summarise long threat reports	Google AI Studio Gemini Flash	1M token context window. Handles full threat reports. Free tier is generous.
Need fastest possible response (real-time triage)	Groq (Llama 3 8B)	Sub-second responses. Best for real-time alert enrichment in SIEM pipelines.
Writing detection rules (KQL/SPL)	Groq (Llama 3.1 70B) or Ollama CodeLlama	70B model produces much higher quality detection rules than 8B.
Budget is zero, no GPU, just a laptop	HuggingFace Inference API (free tier)	No hardware required. Free. Slow on first call (cold start) but works.