New benchmark built from years of real attack traffic scores AI models on detection and forensic analysis capabilities; launch follows record demand for GreyNoise from government agencies, hyperscalers and frontier labs as AI threats accelerate
WASHINGTON, Nov. 12, 2026 /PRNewswire-PRWeb/ -- GreyNoise, the cybersecurity company that empowers defenders with real-time threat data about attacks at the network edge, today launched the GreyNoise AI Cyber Index, a benchmark that measures how well AI models perform defensive security work. It is available now at benchmarks.greynoise.io.
Built from eight years of real attack data, the Index evaluates 46 closed and open-weight models on defensive tasks. The launch comes as GreyNoise reports record demand for its real-time threat data; more than 100,000 defenders are on its platform, and annual recurring revenue (ARR) is on pace to more than double in 2026.
Why a defensive benchmark, and why now?
AI models are now finding software flaws faster than any organization can keep up with, and the time between vulnerability disclosure and exploitation has shrunk from days to minutes.
"Most of the public benchmarks out there are about offense: can the model break stuff? Almost nobody is measuring whether these models can actually help defenders, in real environments, on the work they do every day," said Andrew Morris, founder and Chief Architect of GreyNoise. "We built the GreyNoise AI Cyber Index to give defenders something real to go on when they pick a model for their security operations. We've been watching attackers for 8 years. So we're not testing models against a made up lab environment, we're testing them against what attackers actually do against GreyNoise sensors. This is just the start. We have other evals in the works, and we'll keep updating the benchmarks as we add them."
The GreyNoise AI Cyber Index evaluates defensive tasks with ground truth rooted in real attack traffic and labeled data used in production by over 100,000 defenders. Because the data comes from attacks GreyNoise observes directly through its Global Observation Grid, not synthetic environments, scores reflect how models handle the attacks defenders actually face.
The best model for one cyber task is not necessarily the best for another.
- Triaging security alerts: speed comes first. A late answer is of little use.
- Writing detections: accuracy comes first. A rule that misses an attack, or fires on benign traffic, creates risk or noise.
- Investigating intrusions: sound judgment comes first. The model has to weigh the evidence and resist plausible decoys.
- Running work at scale: once capability can be trusted, cost per task matters when used in production.
- Refusal rates: A model that refuses a security task cannot help, however capable it is.
That is why the GreyNoise AI Cyber Index reports capability on each task, refusal rates, time and cost per problem, in addition to a composite leaderboard. This way, teams can compare models on what matters most for the job at hand.
What the first results show
- No model is close to a perfect score. The top overall score was Opus 5.5 at 74.2%. However, Anthropic models had some of the highest refusal rates in our evaluations, while the Grok models refused nothing. With refusals being penalized (this means we count a refusal as scoring zero rather than omitting), Grok 4.5 sits atop the leaderboard at 71.7%.
- Detection engineering is hard. The best Suricata score of any model is 75.9% (Opus 4.8) and the best YARA score is 58.4% (Grok 4.5), indicating that model capabilities on detection engineering are far from saturation.
- Open-weight models still lag behind frontier-class models. Only a single open-weight model, MiniMax M3, scored above our Capable threshold at 64.7%.
Record demand for the data behind the index
The real-world attack data that powers the GreyNoise AI Cyber Index is seeing unprecedented business demand.
Highlights from 2026 include:
- ARR on track to more than double year over year
- Its data platform surpasses 100,000 users
- Launched key integrations with leading SOC platforms like Crowdstrike, Elastic, Google SecOps, and Splunk
- New strategic customers across US and international government agencies and F1000 enterprises. GreyNoise also extended its working with major US hyperscalers and foundation labs, providing data and environments to help evaluate and train frontier models on cyber capabilities.
- Early warning research, including Ten Days Before Zero, showing that activity surges in GreyNoise data often precede new vulnerability disclosures.
The demand is being driven by exploitation at AI-speed-and-scale, much of which lands on the network edge. Firewalls, routers, zero-trust proxies, ICS gateways and other edge systems are now the primary access vector for attackers: they face the internet, cannot run endpoint agents, and offer sparse telemetry. GreyNoise's 2026 State of the Edge Report found sustained, systematic exploitation of these systems, with wide gaps in how organizations defend them.
"Every CISO I meet is asking the same few questions: when the next critical vulnerability drops, how fast will it be exploited, how can we see it coming, and what can we do to prepare?" said Ash Devata, CEO of GreyNoise. "AI has turned that from a planning exercise into a weekly fire drill. Attackers are using AI to move faster, and the only way to keep up is to fight AI-enabled offense with AI-enabled defense. But those AI systems are only as good as the data behind them. GreyNoise provides ground truth on what attackers are doing, so defenders can act in seconds. Now that same data is helping defenders understand which models are best suited to real-world defensive work."
About GreyNoise
GreyNoise sees what attackers do on the internet as it happens. Its Global Observation Grid records how threat actors find, exploit, and compromise enterprise systems and turns that activity into real-time, ground-truth intelligence. Enterprises use this intelligence to detect and respond to attacks on their network edge. The United States and allied nations rely on it for battlefield awareness of adversary cyber operations. Hyperscalers and AI labs use the same data, and the environments built from it, to evaluate and train the cyber capabilities of their frontier models. Hundreds of government agencies and Fortune 1000 enterprises use GreyNoise data in their cyber operations, and more than 100,000 defenders work on the GreyNoise platform. Learn more at greynoise.io.
Media Contact
Ruoting Sun, GreyNoise Intelligence, 1 202-630-290, [email protected], https://www.greynoise.io/
Rebecca West, Helium Communications, 1 415-260-6094, [email protected], https://www.heliumcommunications.com/
SOURCE GreyNoise Intelligence
Share this article