What it measures

Meta’s evaluation family covers distinct cybersecurity tasks. The imported CyberSOCEval comparisons measure how models analyze malware reports and reason over threat intelligence, with task results kept separate.

Reading the measurement

Separate satisfying instructions from factual accuracy, human preference and safe behavior. Inspect strict all-constraint success as well as average criterion credit. Judge choice and adversarial prompt selection can materially change the result.

Published evaluation

Exact labels from the published malware-analysis result chart. A response is correct only when every required multiple-choice option and no extra option is selected. Overall denominators include parseable responses and differ by model; the total denominator is not the denominator of each difficulty slice. Source 95% confidence bars are shown in the paper, but unlabeled bounds are not guessed. This is a defensive-analysis task, not an offensive cyber capability composite.

Where this fits in an evaluation suite

Format compliance, preference, truthfulness, and safety require separate measurements. Keep desirable writing style from masking factual errors.

Start with a capability hypothesis, then choose a second test with a different failure mode. Keep the checkpoint, reasoning effort, agent tools, sampling policy, and scoring procedure fixed when measuring a training intervention. Record failures and missing outputs in the denominator.

A reproducible comparison

Exact labels from the published malware-analysis result chart. A response is correct only when every required multiple-choice option and no extra option is selected. Overall denominators include parseable responses and differ by model; the total denominator is not the denominator of each difficulty slice. Source 95% confidence bars are shown in the paper, but unlabeled bounds are not guessed. This is a defensive-analysis task, not an offensive cyber capability composite.

Publish the exact run configuration, item coverage, score units, and available uncertainty. If a source supplies only an aggregate or a single run, preserve that limit. A new model name or a rounded score alone does not establish a capability improvement.

PRIMARY EVIDENCE & FURTHER READING

  1. CyberSOCEval: Benchmarking LLMs Capabilities for Malware Analysis and Threat Intelligence Reasoning — published result table ↗

    Deason, Lauren, Bali, Adam, Bejean, Ciprian, Bolocan, Diana, Crnkovich, James, Croitoru, Ioana et al. · 2025

    All 23 authors

    Deason, Lauren, Bali, Adam, Bejean, Ciprian, Bolocan, Diana, Crnkovich, James, Croitoru, Ioana, Durai, Krishna, Midler, Chase, Miron, Calin, Molnar, David, Moon, Brad, Ostarcevic, Bruno, Peltea, Alberto, Rosenberg, Matt, Sandu, Catalin, Saputkin, Arthur, Shah, Sagar, Stan, Daniel, Szocs, Ernest, Wan, Shengye, Whitman, Spencer, Krasser, Sven, Saxe, Joshua

Reviewed 2026-10-27. Explanation and interpretation by RLTasks. Benchmark ownership remains with its original authors.