GreyNoise AI Cyber Index scores models on defensive tasks
Original title: GreyNoise AI Cyber Index: Benchmarking AI Models on Defensive Capabilities
Forty-six models face 145 problems; with refusals scored zero, Grok 4.5 leads at 71.7 percent.
GreyNoise launched the AI Cyber Index to measure whether models can help defenders rather than write exploits. The launch set covers Network Detections, File Detections, and Attack Forensics, weighted 55, 30, and 15 percent, using labeled traffic from GreyNoise's observation grid. Models write Suricata or YARA rules or trace an alert to an exploit, and answers are graded against held-out attacks and benign lookalikes. As of November 11, 2026, no model scored perfectly.
Unconfirmed: Published figures are GreyNoise's Index results as of November 11, 2026, and the excerpt cuts off mid-results.
- Claude Opus 5.5 scored 74.2 percent raw but refused 16.5 percent of attempts.
- Penalizing refusals drops Opus 5.5 to 63.9 percent, under the 64.5 percent capable line.
- Grok 4.5 refused nothing and led the penalized view at 71.7 percent.
- Network Detection has 51 problems, File Detection 63, and Attack Forensics 31.
- A model is called capable at 90 percent of the top score, or 64.5 percent with refusals penalized.
- Products
- GreyNoise AI Cyber Index
- Organizations
- GreyNoise
- AI models
- Claude Opus 5.5Grok 4.5
From the original article
6 min read at greynoise.io.png&w=1280&q=75)
GreyNoise benchmarked 46 AI models on real defensive security tasks including network detections, file detections, and attack forensics. See which models are actually capable of helping defenders.
greynoise.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.