Making the Internet safer with an LLM dedicated to cybersecurity

For years, we have been auditing, monitoring and recovering IT systems after incidents. Always the same observation: attacks scale faster than defense. Ransomware operations are industrializing, OT/ICS environments are becoming prime targets, and general-purpose AIs are already used to industrialize phishing, social engineering or vulnerability research.

Our answer is an LLM designed from the ground up to defend: SYLink 8B, the first AI model in the SYLink ecosystem entirely specialized in cybersecurity, and built to help make the Internet safer - concretely, operationally, every day.

1. Why a specialized LLM to secure the Internet?

General-purpose models excel at writing, summarizing, translating. But in security, the requirements are different:

  • We don't want "pretty text": we want concrete action plans.

  • We don't want an approximate answer: we want to know whether an IOC, a CVE or a TTP is real, critical, exploited.

  • And above all, we don't want an ambivalent AI: we want an AI aligned with defense, one that refuses to help an attacker.

Our goal is not to add yet another chatbot, but to create a true defense copilot, capable of raising the security level of everyone: large groups, SMBs/mid-market companies, public sector organizations, industrial operators, MSSPs/SOCs, researchers, students.

2. SYLink 8B: a cyber brain for defenders

SYLink 8B is an 8.2-billion-parameter model, optimized for cybersecurity use cases:

  • Long contexts (logs, reports, SIEM exports, network traces, audit results) to analyze an incident or a potential compromise end to end.

  • Native understanding of industry standards: MITRE ATT&CK, CVE/CVSS, NIST, ISO 27001, CIS, etc.

  • Structured responses: attack scenarios, severity, ATT&CK mapping, detection opportunities, actionable recommendations.

It does not replace human expertise nor existing tools:

it orchestrates, accelerates, documents what teams already do - and helps those who do not yet have the means to staff a full SOC or a CERT team.

3. How does our LLM contribute to a safer Internet?

3.1. By reducing reaction time during an incident

When an incident occurs, every minute counts. SYLink 8B helps to:

  • Qualify an event: a strange log, a suspicious PowerShell command, abnormal network behavior.

  • Suggest probable scenarios (TTPs, attacker objectives, possible lateral movements).

  • Recommend containment actions tailored to the context (isolated host, network segment, disabled accounts, temporary firewall rules).

  • Structure the report (timeline, impacts, actions taken) for management, NATO/Armed Forces, insurers, or the data protection authority.

Less time wasted figuring out "where to start" = less time given to the attacker.

3.2. By democratizing access to security expertise

Today, many SMBs, public sector organizations and healthcare entities have neither a SOC nor a full-time CISO. The result: late patches, default configurations, untested backups, weak passwords, underestimated Internet exposure.

SYLink 8B makes it possible to:

  • Turn a sysadmin or a generalist CIO into a better-armed defender, supported by a cyber assistant.

  • Convert an audit or scan report into a prioritized action plan understandable by management.

  • Explain business risks in plain language: "what does it mean for us if this AD server goes down?", "what is a cloud kill switch?", "why is this VPN critical?".

The more accessible cyber expertise becomes, the fewer easy targets the Internet offers.

3.3. By strengthening detection and threat hunting

Our teams design SYLink 8B to help:

  • SOC teams write/optimize their rules: Sigma, YARA, Snort/Suricata, EDR/XDR detection.

  • Threat hunters turn an intuition into a structured hypothesis and into SIEM queries.

  • Network analysts interpret flows, protocols, including in OT/ICS environments (Modbus, S7, IEC 104, OPC UA, Profinet, etc.).

Our vision: an Internet where every critical IT system is protected by better-written, better-documented and better-shared detection rules.

3.4. By guiding compliance and governance

A safer Internet also requires better digital hygiene:

policies, procedures, processing register, contractual clauses, vendor management, remote access management, etc.

SYLink 8B helps teams:

  • Map their risks, align their posture with NIS2, ISO 27001, NIST CSF, GDPR...

  • Concretely understand what it means to:

    • segment a network,

    • manage VPN access vs. uncontrolled remote access,

    • log, trace and audit sensitive actions.

  • Prepare and structure an audit, certification, or regulatory inspection.

The Internet becomes more resilient when organizations adopt structured security practices at scale.

4. An AI built to defend, not to attack

Making the Internet safer also means setting clear boundaries for our own technology.

We have therefore drawn red lines for SYLink 8B:

  • No assistance writing malware, ransomware, encryption scripts, backdoors or implants.

  • No help exploiting a vulnerability on a system that does not belong to you.

  • No content aimed at circumventing the law, security measures, or harming third parties.

Conversely, the model is optimized to:

  • Suggest hardening measures (OS, network, IAM, cloud).

  • Help configure useful logs and journals for detection.

  • Explain how to fix a vulnerability, not how to exploit it.

A cyber AI that doesn't know how to say "no" to certain uses doesn't improve the Internet - it makes it worse. Our choice is clear: defense only.

5. Confidentiality, sovereignty and control: non-negotiable pillars

By design, LLMs can ingest logs, reports, configuration excerpts that may be sensitive. Our responsibility is therefore twofold: strengthen security without creating a new risk surface.

Our approach:

  • Controlled deployments: SYLink 8B can be used locally / on-prem / on sovereign cloud, with no exfiltration of data to uncontrolled environments.

  • Open model (Apache 2.0): auditability, integration into existing ecosystems, independence from any single vendor.

  • Native integration with existing SYLink solutions (DPI probe, NMS, SYLink Audit, offensive AI engine) to produce a global view: network + endpoints + vulnerabilities + AI.

The Internet will not be safer if organizations simply "plug an AI" somewhere in their IT system without knowing where their data is going. Our priority is to put them back in control.

6. Our vision: cybersecurity AI agents serving the common good

SYLink 8B is only a first building block. We are already working on:

  • 32B and 80B models for even more demanding use cases (large SOCs, MSSPs, very high-volume environments).

  • Specialized AI agents:

    • a "Threat Intel" agent that correlates IOCs & TTPs in near real time,

    • an "IR" agent that helps run incident playbooks,

    • an "Audit & Compliance" agent that turns the actual state of the IT system into a prioritized security roadmap.

  • Deep integration with our network probes and audit tools to move from an observed IT system to an understood IT system, then to a hardened IT system.

Ultimately, we want to contribute to an Internet where:

  • Ransomware campaigns meet systematic resistance, even at the smallest organizations.

  • Industrial operators detect early any abnormal behavior on Modbus, OPC UA, Profinet, etc.

  • Massive data leaks become the exception, not the weekly headline.

7. A collective effort

Making the Internet safer goes far beyond a single company, a single tool, or a single model. It is a collective effort:

  • blue teams sharing their lessons learned,

  • researchers documenting new TTPs,

  • vendors and integrators building compatible ecosystems,

  • decision-makers who agree to invest in resilience rather than only in immediate productivity.

With SYLink 8B, our ambition is simple: put a 100% defense-oriented AI in the hands of those who, every day, protect networks, data and - by extension - our economy and our daily lives.

Source: https://ollama.com/sylink/sylink

We will keep evolving the model, training it, hardening it and specializing it, with one fixed idea:

every avoided attack, every better-contained incident, is a small piece of the Internet that becomes safer.