Belgian cybersecurity company Aikido has released Altar, an open-weight artificial-intelligence model designed to run inside an organisation’s own infrastructure, including environments that cannot send sensitive code or security findings to third-party cloud services. The model is a compressed derivative of Z.AI’s GLM-5.3, trimmed from a full-precision footprint of roughly 1.51 terabytes to 328 gigabytes, and is being positioned for code analysis, penetration testing and other defensive workloads where data residency, operational secrecy and predictable control matter as much as raw model capability.
A Security Model Designed to Stay Inside the Network
The most consequential part of Aikido’s announcement is not that another cybersecurity company has attached artificial intelligence to its product line. That has become common across the software-security market. The more important shift is architectural: Altar is intended to be operated locally, under the customer’s own control, rather than consumed only through an external inference API. In practical terms, that can allow a security team to analyse proprietary source code, internal architecture documentation, vulnerability reports and penetration-test context without transmitting those materials to a separate model provider.
That distinction matters most in sectors where security data is itself highly sensitive. A vulnerability report can reveal far more than a normal business document. It may contain exploit paths, secrets-management weaknesses, authentication flaws, internal hostnames, network diagrams, source-code fragments and descriptions of controls that have not yet been fixed. Sending that material to a remote inference service may be acceptable for some organisations under contractual and technical safeguards, but it can be unacceptable for banks, critical infrastructure operators, defence contractors, government agencies or companies working under strict data-residency obligations.
Aikido says Altar was developed partly to support its Aikido Machine autonomous penetration-testing appliance, which can operate entirely inside customer infrastructure, including air-gapped environments. The company’s argument is straightforward: if a security tool is expected to reason deeply about an organisation’s most sensitive systems, then the model performing that reasoning should be deployable where the data already lives. Reuters reported that the model will be used in Aikido products deployed to customers including Belgian bank Belfius, giving the launch an immediate enterprise context rather than leaving it as a research demonstration.
The launch comes as companies are experimenting with more autonomous security agents that can inspect code, call tools, propose patches and conduct multi-step investigations. Those workflows create a privacy challenge because the model may need much more context than a simple chatbot request. An agent can accumulate code, logs, findings and tool outputs across an entire investigation. Keeping inference local does not eliminate security risk, but it changes where that risk is concentrated and who controls the infrastructure, logs and data flows.
How Aikido Shrunk a Massive Model
Altar is based on GLM-5.3, a large mixture-of-experts model. In this architecture, many specialised neural-network “experts” exist within the model, but only a small subset is activated for each token. Mixture-of-experts systems can provide high capability without activating every parameter for every computation, yet the entire expert pool still has to be stored and served. That creates a deployment problem for companies that want powerful models on premises: even if only part of the model is active at a given moment, the system still needs enough memory to hold the full set of weights.
Aikido says the full GLM-5.3 model occupies about 1,506.7 gigabytes in BF16 precision. A quantised AWQ INT4 version reduces that to about 488.2 gigabytes. Altar goes further by applying expert pruning after quantisation, reducing the stored weights to 328 gigabytes. The company says the resulting model keeps 168 of the original 256 routed experts in each backbone expert layer, removing 88, or about 34.4 percent. The router still selects eight experts for each token, but it chooses from the smaller remaining pool.
Two different techniques are doing the work. Quantisation stores many model weights using fewer bits, reducing memory requirements at the cost of some numerical precision. Pruning removes model components judged less important for the target workload. Aikido used a method called Router-weighted Expert Activation Pruning, or REAP, developed by Cerebras researchers. Instead of simply discarding the experts selected least often, the method estimates how much each expert contributes by considering the router’s weighting and the magnitude of the expert’s output.
Aikido calibrated the pruning process using traces from its internal penetration-testing harness, together with coding, tool-use, reasoning and multilingual material. The company says no customer data was used. That detail is important because a security model trained or calibrated on customer investigations could create difficult questions about confidentiality and cross-customer leakage. Aikido describes the process as selecting which capabilities to preserve rather than teaching the model new security skills.
The technical goal is not to make Altar small in ordinary computing terms. At 328 gigabytes, it remains a very large model. Rather, the goal is to move it from an impractical footprint for many enterprise deployments toward a configuration that can be served on specialised but commercially available hardware. Aikido’s model card says the system is designed to run using vLLM on four Nvidia H200 GPUs. That still represents substantial infrastructure, but it is a very different proposition from serving a model with well over a terabyte of full-precision weights.
The Benchmark Results Are Promising but Narrow
Aikido has published benchmark results intended to show what was lost during compression. On an internal CVE benchmark covering 32 known vulnerabilities across 30 repositories, with three runs per case, Altar averaged 60.4 percent recall per run and rediscovered 23 of the 32 vulnerabilities at least once. The quantised but unpruned GLM-5.3 baseline averaged 61.5 percent recall and also covered 23 vulnerabilities. The full-precision parent model averaged 65.6 percent recall and covered 25 of 32.
Those numbers support Aikido’s central technical claim: cutting the already quantised model from 488 gigabytes to 328 gigabytes produced only a modest decline on the company’s chosen vulnerability-identification task. Compared with the quantised parent, average recall fell by about one percentage point while vulnerability coverage across the three runs was unchanged. Compared with the full-precision parent, Altar retained 23 of the 25 vulnerabilities found at least once, while average recall dropped by 5.2 percentage points.
The results should nevertheless be read carefully. This is an internal benchmark built and reported by the company releasing the model, not an independent industry-wide evaluation. Aikido itself describes the scope narrowly. The test measures targeted rediscovery of known vulnerabilities inside a pipeline that uses other models in surrounding stages. It does not measure blind discovery across an entire unfamiliar codebase, does not execute exploits to validate every finding and does not evaluate the patch-proposal stage. A model that performs well on one benchmark can still behave differently in long, messy production investigations.
That caveat is especially important for agentic security systems. Real penetration testing involves more than identifying a suspicious line of code. It can require understanding authentication state, business logic, chained weaknesses, environmental assumptions and the consequences of taking an action. False positives waste analyst time, while false negatives can create a false sense of security. An autonomous system may also make tool calls whose safety depends on scope, authorisation and environment. The quality of the surrounding orchestration layer therefore matters as much as the language model itself.
Aikido says Altar identified a valid critical-severity vulnerability during a client production penetration test shortly after deployment. That is a useful signal that the model is already being exercised outside a lab benchmark, but it remains a company-reported example. The launch does not establish that Altar is generally superior to closed frontier models, human penetration testers or competing security-specific models. What it demonstrates more clearly is that a large general model can be aggressively compressed around a security workload while retaining much of its measured vulnerability-identification performance.
Why Local AI Is Becoming a Cybersecurity Product Category
The wider significance of Altar is tied to a growing enterprise debate over where artificial-intelligence inference should occur. The first wave of generative AI adoption relied heavily on centrally hosted models accessed through consumer interfaces or cloud APIs. That model offers convenience and rapid updates, but it also means organisations must decide what data can leave their environment, how prompts and outputs are retained, what contractual protections apply and whether external infrastructure is appropriate for highly privileged workloads.
Cybersecurity magnifies those concerns because the highest-value inputs are often the materials companies are most reluctant to expose. Security scanners can see source code, cloud configuration, dependency lists, credentials, network topology and descriptions of unpatched weaknesses. A penetration-testing agent may also need access to staging or production systems. Even when a cloud provider offers strong data-use commitments, many regulated organisations still prefer architectures that reduce the number of parties handling sensitive information.
Local inference can also help organisations maintain operations when external connectivity is unavailable or intentionally restricted. Industrial networks, defence environments and some government systems are segmented specifically to reduce exposure. A cloud-only security model may be unusable in those settings. By contrast, an on-premises model can be integrated into a controlled enclave, with access managed through existing identity, network and logging systems.
Yet “local” should not be confused with “automatically secure.” Running a model inside the firewall shifts responsibility toward the customer. The organisation must secure the GPU servers, model files, inference stack, orchestration software, logs and any tools the agent is permitted to call. A compromised local model service could become a powerful internal pivot point. Sensitive prompts can still leak through poor logging practices, broad permissions or insecure integrations. Model provenance and update procedures also become part of the software-supply-chain problem.
The operational trade-off therefore resembles earlier enterprise technology cycles. Cloud services centralise maintenance and can deliver security updates quickly, while on-premises systems offer greater control but demand more internal expertise. The likely outcome is not that one model wins universally, but that security teams develop different inference tiers: remote frontier models for low-risk tasks, private cloud deployments for controlled enterprise workloads and fully local models for the most sensitive or disconnected environments.
Open Weight Is Not the Same as Open Source
Aikido describes Altar as open weight. That phrase is important because it is more precise than the broader and often contested label “open source AI.” Open-weight releases make the trained model parameters available for download and local operation, usually under a particular licence. They do not necessarily provide the complete training dataset, training code, data-curation process or every other component that would allow an outside researcher to reproduce the model from scratch.
Altar’s Hugging Face model card says it inherits the GLM-5.3 licence. The card identifies the release as a 504-billion-parameter prune of GLM-5.3, though Hugging Face’s interface reports a model size of roughly 501 billion parameters in the hosted metadata. The deployment notes specify a 328-gigabyte W4A16 footprint and recommend four H200 GPUs. For security-conscious organisations, the availability of weights can enable local validation, controlled serving and deeper technical inspection than a closed API permits.
At the same time, open weights create a different risk and governance profile. A downloadable model can be modified, fine-tuned or integrated into tools beyond the original vendor’s intended use. Defensive security models are particularly dual-use because the technical abilities needed to identify a vulnerability can overlap with those needed to exploit it. A model that can reason about authentication flaws, insecure deserialisation or privilege boundaries can help a defender fix systems, but similar knowledge can also lower the effort required for offensive experimentation.
That does not make open-weight security models inherently irresponsible. Security research has long depended on open tools, shared exploit knowledge, public vulnerability databases and reproducible methods. The relevant question is how capability, access, safeguards and accountability fit together. Organisations deploying a local model should still impose authorisation boundaries, audit tool calls, separate testing from production systems and preserve human review for consequential actions.
The open-weight model also changes procurement dynamics. A buyer is less dependent on a single hosted inference endpoint and may be able to retain a model version after a vendor changes commercial terms. It can test performance on internal workloads before committing to broader deployment. For European companies concerned with strategic autonomy, that ability to operate a capable model under local control can be commercially and politically attractive even if the underlying base model, hardware and software stack remain internationally sourced.
Europe’s Sovereignty Debate Moves From Policy to Infrastructure
The launch fits a broader European push to reduce dependence on externally controlled digital infrastructure. Much of that debate has focused on cloud computing, semiconductor supply, data residency and the concentration of advanced AI development in the United States and China. Cybersecurity adds another layer because the systems being protected often include regulated data and critical services, making control over inference infrastructure more than a symbolic issue.
Aikido is headquartered in Ghent and reached a $1 billion valuation in January after raising $60 million in a Series B round led by DST Global. Reuters reported at the time that the company had increased revenue fivefold over the preceding year and nearly tripled its customer base, with about half of revenue coming from the United States. That profile matters because it shows the company is pursuing a European-origin security platform while competing in a global market rather than building only for local public-sector demand.
Its customer list has included companies such as Revolut, SoundCloud and Niantic, while Reuters said Belfius is among the institutions using Aikido solutions into which Altar will be deployed. For European banks and other regulated firms, local inference can align with internal policies that restrict where source code or vulnerability data may be processed. It may also make it easier to demonstrate that certain security analyses occur within a defined technical boundary.
Still, sovereignty is not binary. Altar is derived from Z.AI’s GLM-5.3, relies on a pruning method associated with Cerebras research, is designed for Nvidia H200 hardware and is served using the open-source vLLM ecosystem. The result is a stack assembled from technologies originating across different companies and jurisdictions. What Aikido is offering is therefore less a claim of total technological independence than a way for organisations to regain control over where the final inference workload runs and where sensitive operational context is stored.
That distinction may prove more useful than broad slogans about technological autonomy. Enterprises rarely control every layer of the computing stack. What they can control is architecture: which components are allowed to communicate externally, where keys and code reside, what telemetry leaves the network, which software versions are approved and how failures are contained. Altar’s relevance to the European sovereignty debate lies in making that architectural choice available for a class of AI security workloads that increasingly require large-model reasoning.
The Hardware Cost Still Sets a High Bar
Even after a 78.2 percent reduction from the full-precision parent’s storage footprint, Altar is not a lightweight model. Four H200 GPUs place it firmly in the data-centre class. That means the addressable users are likely to be enterprises, security vendors, managed service providers and institutions with existing accelerated-computing capacity, rather than small development teams looking to run a security assistant on a workstation.
The cost calculation is more complex than simply comparing a GPU server with an API subscription. A locally hosted model requires capital expenditure or reserved infrastructure, power, cooling, monitoring, software maintenance and staff capable of operating a high-performance inference environment. Utilisation also matters. A server that runs continuously for many teams can be economical in a different way from a machine that sits mostly idle for occasional scans.
On the other hand, local infrastructure can provide predictable capacity and remove per-token pricing from the centre of the security workflow. That may matter for agentic systems because they can generate very large context windows and repeated inference calls during a single investigation. A penetration-testing agent might inspect repositories, parse logs, call scanners, reason about results and revisit earlier evidence many times. The economics of that pattern can differ sharply from a short interactive prompt.
Aikido’s pruning strategy is therefore as much about concurrency and operational headroom as raw model storage. The company argues that when agents retain long investigation histories, context consumes GPU memory alongside the model. Reducing the model footprint leaves more memory available for context and parallel investigations. If that translates into higher throughput, it could be more important commercially than the headline storage reduction itself.
Future compression could broaden the market. Aikido says it is exploring lower-bit formats such as EXL3 and further H200 serving optimisations. It also plans to move beyond compression into fine-tuning for security workflows, tool use and long-horizon reasoning. The central technical challenge will be preserving specialised capabilities while continuing to reduce infrastructure requirements. If security-focused models can eventually deliver useful performance on less expensive hardware, local AI could move from a niche requirement for highly regulated organisations into a standard enterprise deployment option.
AI Is Accelerating Both Sides of the Vulnerability Race
The timing of the launch reflects a wider change in cybersecurity. Artificial intelligence is reducing the cost of several tasks that once required more specialised labour: reading unfamiliar code, summarising documentation, generating test cases, translating between programming languages and reasoning through potential weaknesses. Those same capabilities are useful to defenders and attackers. The result is not a simple story in which AI makes software safer or more dangerous; it increases the speed at which both sides can search, experiment and automate.
Security teams are especially interested in agents because vulnerability management has long suffered from a gap between detection and remediation. Traditional scanners can generate large numbers of alerts, many of which require human triage. A more capable reasoning system could potentially decide which findings are exploitable, trace the relevant code path, reproduce the issue and propose a fix. That would move security automation from alert generation toward investigation and action.
But increasing autonomy raises the stakes of mistakes. A model that misclassifies a vulnerability may send engineers in the wrong direction. An agent with permission to execute tests could disrupt a service if scope controls fail. A model connected to code repositories and deployment systems could have access far beyond what a normal chatbot sees. Defensive AI therefore needs the same principles applied to other privileged systems: least privilege, segmentation, logging, approval gates and clear separation between observation and destructive action.
Local deployment can support those controls by keeping the inference layer inside the same security boundary, but it does not replace them. A powerful on-premises model with unrestricted tool access could be more dangerous than a constrained remote assistant. The architecture around the model remains decisive. Security leaders evaluating systems such as Altar will need to examine not only benchmark accuracy but also identity integration, auditability, secrets handling, tool permissions, update channels and incident response.
This is why the emergence of domain-specific security models is notable. General-purpose frontier models may remain more capable across broad tasks, but specialised systems can be engineered around the operational constraints of security work. That includes deployment inside restricted networks, integration with scanners and repositories, preservation of technical context and support for repeatable investigations. The contest may increasingly be less about which model has the highest general benchmark score and more about which system can safely operate inside a real security programme.
What Enterprises Should Measure Before Trusting a Local Security Model
The release of model weights gives organisations more freedom to test Altar, but evaluation will need to go beyond headline recall figures. Security teams should begin with their own representative workloads: languages, frameworks, repository sizes, vulnerability classes and application architectures that resemble production. A model tuned to one mixture of code and tools may behave very differently on another.
Consistency is as important as peak performance. A system that finds a flaw in one of three runs may be useful as an additional source of evidence, but it cannot be treated like a deterministic control. Teams should track repeatability, false-positive rates, time to useful finding and whether the model can explain the evidence supporting its conclusion. They should also test failure modes, including ambiguous instructions, incomplete repositories, misleading comments and adversarial content embedded in code or documentation.
Prompt injection is particularly relevant for agentic security. A model examining untrusted repositories may encounter text deliberately designed to manipulate its behaviour. If the model can call tools, read secrets or alter files, malicious instructions hidden in source code, issues or documentation could attempt to redirect the agent. Local deployment prevents those prompts from leaving the environment, but it does not prevent the model from obeying them. Robust separation between untrusted content and control instructions remains necessary.
Organisations should also examine the software-supply chain around the model. Downloaded weights need integrity verification. Containers and inference runtimes require patching. GPU drivers, orchestration libraries and agent frameworks become part of the trusted computing base. Because Altar inherits the GLM-5.3 licence, legal teams may also need to assess usage terms before deployment, particularly if the model is modified or embedded into commercial services.
Finally, buyers should compare total security outcomes rather than model capability in isolation. A less capable model that can operate continuously on private code may outperform a stronger model that policy prevents employees from using. Conversely, a local system that demands so much infrastructure that it is rarely updated or poorly monitored may create operational debt. The right architecture depends on risk tolerance, workload sensitivity, scale and the organisation’s ability to operate AI infrastructure securely.
A Test of Whether Specialised Models Can Beat General-Purpose Convenience
Altar arrives at a moment when the AI industry is debating whether value will continue to concentrate in a small number of enormous general-purpose models or spread toward specialised systems tuned for particular domains. Cybersecurity is a strong test case because it rewards both technical reasoning and environmental control. The most capable model in the abstract is not necessarily the most deployable model for an air-gapped industrial network, a regulated bank or a repository containing proprietary code.
Aikido’s approach is to start with a very large general model and remove capacity that appears less useful for the target workload, rather than training a small security model from the ground up. If that strategy proves durable across more independent benchmarks, it could offer a template for other specialised enterprise models. Legal analysis, scientific computing, industrial engineering and healthcare may all have similar incentives to compress capable base models around narrow workloads while keeping sensitive data inside controlled infrastructure.
The trade-off is that specialisation can hide weaknesses outside the calibration domain. A pruning process that preserves coding and penetration-testing performance may degrade capabilities that later turn out to matter in a real investigation, such as understanding obscure documentation, rare languages or unusual business logic. Aikido says it included multilingual material specifically to reduce that risk, but the broader principle remains: compression is a choice about what to keep, and those choices need to be tested against production diversity.
The company’s decision to publish model weights and a technical explanation of its compression process gives outside researchers a better opportunity to examine those trade-offs. That transparency does not substitute for independent evaluation, but it allows the discussion to move beyond marketing claims. Researchers can inspect the model card, run their own security benchmarks and compare the system with both the GLM-5.3 parent and other open or closed models.
For the wider market, the most important question is whether customers value control enough to accept the infrastructure burden. If they do, local AI could become a defining segment of enterprise cybersecurity, particularly in Europe where data sovereignty and critical-infrastructure resilience are already central policy concerns. If they do not, the convenience and rapid improvement of cloud-hosted frontier models may remain dominant. Altar turns that abstract debate into a deployable product choice.
The Next Phase Will Be Decided in Production
Aikido’s launch is technically significant because it combines several trends that have often been discussed separately: mixture-of-experts compression, open-weight distribution, autonomous security agents, air-gapped deployment and European demand for greater control over sensitive digital infrastructure. The result is not a small model and not a complete answer to the risks of AI-enabled cybersecurity. It is, however, a concrete attempt to make high-end model reasoning compatible with environments that cannot simply send their most sensitive data to an external API.
The company’s own data suggest that the compression trade-off is manageable on its internal CVE benchmark. A 328-gigabyte model retained the same three-run vulnerability coverage as the 488-gigabyte quantised parent and most of the coverage of the full-precision model. The more important evidence will now come from production: how often Altar finds meaningful vulnerabilities, how consistently it performs across different codebases, how safely it uses tools and whether customers can operate the infrastructure without creating new security weaknesses.
Competition will also matter. Large model providers are adding stronger privacy controls and private deployment options, while cybersecurity vendors are building their own agents and model layers. Open-weight ecosystems continue to improve quickly. Aikido therefore has no permanent advantage simply because it is early. Its bet is that domain-specific optimisation and local control will remain valuable even as general models become more capable.
For defenders, that is a useful development. Cybersecurity has repeatedly suffered when organisations are forced to choose between powerful tools and acceptable control over sensitive data. A model that can run behind the firewall, operate in an air-gapped enclave and still perform useful vulnerability analysis expands the set of architectures available to security teams. Whether Altar becomes a widely adopted model or a stepping stone to something smaller and more capable, the direction is clear: AI security is moving closer to the systems it is meant to protect.
