New benchmark built from years of real attack traffic scores AI models on detection and forensic analysis capabilities; launch follows record demand for GreyNoise from government agencies, hyperscalers and frontier labs as AI threats accelerate.
WASHINGTON, D.C. -- Nov. 12, 2026 -- GreyNoise, the cybersecurity company that empowers defenders with real-time threat data about attacks at the network edge, today launched the GreyNoise AI Cyber Index, a benchmark that measures how well AI models perform defensive security work. It is available now at benchmarks.greynoise.io.
Built from eight years of real attack data, the Index evaluates 46 closed and open-weight models on defensive tasks. The launch comes as GreyNoise reports record demand for its real-time threat data: more than 100,000 defenders are on its platform, and annual recurring revenue (ARR) is on pace to more than double in 2026.
Why a defensive benchmark, and why now
AI models are now finding software flaws faster than any organization can keep up with, and the time between vulnerability disclosure and exploitation has shrunk from days to minutes.
"Most of the public benchmarks out there are about offense: can the model break stuff? Almost nobody is measuring whether these models can actually help defenders, in real environments, on the work they do every day," said Andrew Morris, founder and Chief Architect of GreyNoise. "We built the GreyNoise AI Cyber Index to give defenders something real to go on when they pick a model for their security operations. We've been watching attackers for 8 years. So we're not testing models against a made up lab environment, we're testing them against what attackers actually do against GreyNoise sensors. This is just the start. We have other evals in the works, and we'll keep updating the benchmarks as we add them."
The GreyNoise AI Cyber Index evaluates defensive tasks with ground truth rooted in real attack traffic and labeled data used in production by over 100,000 defenders. Because the data comes from attacks GreyNoise observes directly through its Global Observation Grid, not synthetic environments, scores reflect how models handle the attacks defenders actually face.
The best model for one cyber task is not necessarily the best for another.
- Triaging security alerts: speed comes first. A late answer is of little use.
- Writing detections: accuracy comes first. A rule that misses an attack, or fires on benign traffic, creates risk or noise.
- Investigating intrusions: sound judgment comes first. The model has to weigh the evidence and resist plausible decoys.
- Running work at scale: once capability can be trusted, cost per task matters when used in production.
- Refusal rates: A model that refuses a security task cannot help, however capable it is.
That is why the GreyNoise AI Cyber Index reports capability on each task, refusal rates, time and cost per problem, in addition to a composite leaderboard. This way, teams can compare models on what matters most for the job at hand.
What the first results show
- No model is close to a perfect score. The top overall score was Opus 5.5 at 74.2%. However, Anthropic models had some of the highest refusal rates in our evaluations, while the Grok models refused nothing. With refusals being penalized (this means we count a refusal as scoring zero rather than omitting), Grok 4.5 sits atop the leaderboard at 71.7%.
- Detection engineering is hard. The best Suricata score of any model is 75.9% (Opus 4.8) and the best YARA score is 58.4% (Grok 4.5), indicating that model capabilities on detection engineering are far from saturation.
- Open-weight models still lag behind frontier-class models. Only a single open-weight model, MiniMax M3, scored above our Capable threshold at 64.7%.
Record demand for the data behind the index
The real-world attack data that powers the GreyNoise Cyber Index is seeing unprecedented business demand.
Highlights from 2026 include:
- ARR on track to more than double year over year
- Its data platform surpasses 100,000 users
- Launched key integrations with leading SOC platforms like Crowdstrike, Elastic, Google SecOps, and Splunk
- New strategic customers across US and international government agencies and F1000 enterprises. GreyNoise also extended its working with major US hyperscalers and foundation labs, providing data and environments to help evaluate and train frontier models on cyber capabilities.
- Early warning research, including Ten Days Before Zero, showing that activity surges in GreyNoise data often precede new vulnerability disclosures.
The demand is being driven by exploitation at AI-speed-and-scale, much of which lands on the network edge. Firewalls, routers, zero-trust proxies, ICS gateways and other edge systems are now the primary access vector for attackers: they face the internet, cannot run endpoint agents, and offer sparse telemetry. GreyNoise's 2026 State of the Edge Report found sustained, systematic exploitation of these systems, with wide gaps in how organizations defend them.
"Every CISO I meet is asking the same few questions: when the next critical vulnerability drops, how fast will it be exploited, how can we see it coming, and what can we do to prepare?" said Ash Devata, CEO of GreyNoise Intelligence. "AI has turned that from a planning exercise into a weekly fire drill. Attackers are using AI to move faster, and the only way to keep up is to fight AI-enabled offense with AI-enabled defense. But those AI systems are only as good as the data behind them. GreyNoise provides ground truth on what attackers are doing, so defenders can act in seconds. Now that same data is helping defenders understand which models are best suited to real-world defensive work."
About GreyNoise Intelligence
GreyNoise empowers the security teams of enterprises and global governments to act with speed and confidence by providing fresh, verifiable threat intelligence about systems at the network edge. This allows security teams to reduce noise in security operations, perform in-depth investigations and threat hunts, and focus on the most critical threats to their networks. Our Global Observation Grid enables us to observe and analyze threat actor campaigns at global scale and share this intelligence with customers in real-time. For more information, please visit https://www.greynoise.io/, and follow us on Twitter, Mastodon and LinkedIn.
