TL;DR
Open-weight models can match the performance of expensive closed models in threat intelligence tasks at a fraction of the cost, given sufficient interaction turns. This study evaluates 26 models, revealing that open-weight models excel when message limits are relaxed.
✦ Why It Matters
Consider adopting open-weight models for threat intelligence tasks to reduce costs while maintaining performance.
Key Takeaways
How It Works
The study utilizes CTI-REALM, where agents query a telemetry store to transform threat intelligence reports into actionable detections. By evaluating models under a common framework, it identifies that open-weight models can perform comparably to closed models when given sufficient interaction turns.
The introduction of stage-level metrics allows for a more granular assessment of model performance, enabling task routing to the most capable model at each stage.
Related