Foundation-Sec 8B · QLoRA · evidence gates

SOC reasoning.
Human control.

NanoSOC1 is a gated 8B SOC copilot for structured event triage, evidence correlation, MITRE ATT&CK attribution and reversible response recommendations.

Inspect model + evidence ↗ Open the lab ↓
8BFoundation Security base
5,492pinned RAG documents
81%v8 negative-heavy recall · n=200 positive
0automatic destructive actions
01 / Frozen evidence

Metrics with the uncomfortable parts included.

Both comparisons use the same frozen holdout and deterministic generation. These are narrow laboratory results—not production guarantees.

same frozen holdout progression

Base → v6 → current v8

1,000 identical events · 200 malicious / 800 benign · sample IDs hash-verified

Accuracy0% → 6.9% → 70.5%
Detection recall0% → 33% → 81%
Specificity0% → 0.375% → 67.875%
F1N/A → 16.71% → 52.34%
False-positive rateunclassified → 65.5% → 32.125%
v8 negative-heavy diagnostic

1,000 events

200 malicious · 800 benign · in-domain offline triage

Valid JSON100%
Detection recall81%
Precision38.66%
Specificity67.875%
False-positive rate32.125%
v8 ATT&CK attribution

24 techniques

independent attribution diagnostic · separate from detection

Valid JSON12.5%
Technique exact0%
Macro F10%
Parent accuracy0%
Abstain91.67%
02 / Safe walkthrough

Inspect the decision contract.

Select a fictional, sanitized scenario to inspect the structured evidence path. These are illustrative fixtures, not live model predictions or benchmark samples.

● ● ●structured triage fixture

            
Analyst verification required. Technique IDs and response steps must be checked against source evidence before action.

          

        

      


      

        

          
03 / System design

          
The model is one component.
NanoSOC keeps untrusted logs, model reasoning and high-impact actions behind explicit boundaries.

        

        

          
01Redact
Normalize events and remove secrets or tenant identifiers.

          
02Route
Select single-log or correlation adapter by task contract.

          
03Ground
Retrieve pinned MITRE, CISA KEV and Sigma evidence.

          
04Gate
Check provenance, confidence, injection and drift signals.

          
05Approve
Route consequential actions to a human with rollback context.

        

      


      

        

          
04 / Claim boundary

          
What is not proven yet.

        

        

          
False-positive behavior
The 1,000-event v8 diagnostic has 32.125% FPR versus a 3% product target. The gate is not passed.

          
MITRE attribution
The independent 24-technique diagnostic scores 0% exact. Detection and attribution remain separate quality gates.

          
Cross-source NIDS
The eight-source 3090 development run held macro FPR at 2.888%, but macro recall was only 8.729%. Failed weights were not released.

          
Firewall appliance
The stateful engine passed its authored 1,068-event fixture. Independent PCAP, line-rate, failover and customer shadow tests remain open.

          
Production efficacy
Only F0 currently passes all Excel gates. Customer pilot, independent red-team and legal approval remain open; no autonomous action is allowed.