Foundation models are reshaping how security teams detect threats, triage alerts, and write code. They are also being used in ways that do not work, and being avoided in ways that should be reconsidered. This page is the practical reference.
Read the video transcript
What if one model could learn the underlying grammar of cyber activity, then adapt to many security jobs without starting over each time? That is the mind-bending idea behind a foundation model. As security telemetry proliferates, DeepTempo's vertical foundation model, LogLM, is coming to the fore. In this video, we'll look at how it's built, what it does, and how it compares with general-purpose LLMs and traditional machine learning.
A foundation model is pre-trained at scale to learn reusable representations, then adapted downstream instead of rebuilt from scratch. Waymo uses a foundation encoder for visual inputs in autonomous driving. Stripe built a purpose-built payments foundation model that supports anti-fraud. DeepTempo applies the same architectural idea to operational telemetry: one pre-trained LogLM foundation, with classifiers adapted to specific detection tasks.
Traditional machine learning detection often trains a separate model or baseline for each customer, and even for each user or entity within a customer. It learns what normal looks like in that environment, and accuracy erodes as users, applications, and traffic patterns change. Teams retrain, retune thresholds, and chase drift. LogLM starts from broad pre-training across environments and telemetry types, so it generalizes on arrival. Customer adaptation can improve the fit without discarding the shared foundation.
Four transformer properties help explain that generalization. Self-attention relates every part of a sequence to every other part, preserving long-range connections that recurrent models can lose. Contextual embeddings change an event's representation based on its surroundings. Flexible inductive bias makes fewer rigid assumptions than recurrent or convolutional models. And parallel training lets transformers learn from data at a scale older sequential architectures could not practically reach.
General-purpose LLMs are transformers trained mainly on human text, but their decoder architecture is built to generate the next token. That makes them excellent for writing, summarizing, and open-ended reasoning. Detection is a different job. Purpose-built encoders like LogLM, Waymo's visual encoder, and Stripe's payments model produce stable embeddings for classification in one pass. In repeated classification tests, specialized encoders outperform generative approaches, while production-scale generation can cost orders of magnitude more. Detection needs subsecond, consistent classification across millions of events.
A cybersecurity foundation model needs its own vocabulary. DeepTempo security and AI engineers, working with early design partners including the Bank of New York, had to define how fields, IP addresses, ports, paths, identifiers, and event sequences should be represented. They also had to design the underlying LogLM architecture around that telemetry.
Operational telemetry has the properties transformers can exploit. Events form sequences, and order changes meaning. Useful signals are sparse inside huge volumes of routine activity. Context changes what an event means: the same connection can be ordinary from a workstation and suspicious after a credential dump on a domain controller. LogLM learns what happens together, what follows what, and which combinations form a behavioral story.
LogLM converts activity into dynamic behavioral embeddings: compact representations whose meaning reflects the surrounding sequence and environment. Lightweight classifier heads read those embeddings, identify attacker intent, and map findings to MITRE ATT&CK. The output is not generated prose. It is stable, verifiable signal in real time, including zero-shot detection before customer-specific adaptation. The shared foundation keeps improving over time.
DeepTempo turns LogLM findings into structured JSON for your SIEM, Vigil, or another AI SOC. The findings also include the behavioral embeddings themselves, so defenders can run similarity search across them for threat hunting and investigations. Whether you use LogLM to see attacks other systems miss or search for related behavior after the fact, it brings state-of-the-art detection without the frequent retraining overhead of traditional per-customer machine learning. Pair it with the open-source Vigil AI SOC, another AI SOC, or your existing workflow. Learn more at deeptempo.ai.
What is a foundation model?
A foundation model is a large neural network trained on a broad dataset that can be adapted to many downstream tasks without retraining from scratch. The term was coined by Stanford's HAI in 2021 to describe models like GPT-3, BERT, and CLIP.
Three properties define a foundation model: pretraining at scale on a large dataset using self-supervised objectives, transferable representations across many tasks, and adaptability via prompting, fine-tuning, or classifier heads.
LLMs are foundation models for natural language. Vision foundation models are foundation models for images. LogLMs are foundation models for operational telemetry: same architectural family, applied to a different domain.
The four ways foundation models are used in security
Analyst copilots
LLMs help analysts triage alerts, summarize incidents, write detection logic, and query data lakes in natural language. Microsoft Security Copilot, Splunk AI Assistant, and a half-dozen vendor-specific equivalents sit in this category. Where this works: scaling junior analysts, accelerating investigation, reducing alert fatigue. Where this struggles: hallucination on technical specifics, slow on bulk data, and importantly does not actually detect anything new.
Code analysis
Foundation models for code read source and binaries to find vulnerabilities, suggest fixes, or write exploits. Where this works: static analysis, code review, exploit-pattern recognition. Where this struggles: production scale, runtime context, novel vulnerability classes.
Phishing classification
Specialized text classifiers detect phishing, BEC, and adversarial content inside email security gateways. Where this works: high-volume email triage, zero-day phishing campaigns where linguistic structure betrays the attempt. Where this struggles: targeted spear phishing, multi-channel attacks, localization gaps.
Threat detection from telemetry
This is the newest and highest-leverage use case: foundation models trained on operational telemetry to detect attacks directly. Instead of helping a human read logs, the model reads logs and produces detections. DeepTempo's LogLM is the first production-scale example of this category.
Where general-purpose LLMs fail in security
There is a recurring temptation: We already have GPT or Claude, can we point it at our logs? You can. It usually does not work, for several specific reasons.
Logs are out-of-distribution. General-purpose LLMs are trained on human text. Logs are structured, repetitive, full of identifiers, and look like noise to a text-trained model.
Cost at scale. A petabyte-scale log volume run through a frontier LLM is economically infeasible. Cost-per-detection is one to three orders of magnitude too high.
Latency. Frontier LLMs measure latency in seconds. Production detection needs sub-second response across millions of events per minute.
Inconsistency. LLMs are non-deterministic. Detection systems need stable, classifiable signal, embeddings, not free-text guesses.
Lack of domain grounding. General-purpose models do not know what NetFlow records mean in context. They can guess. They will sometimes guess wrong with high confidence.
Vertical foundation models
A vertical foundation model is purpose-built for one domain. Vertical models trade breadth for depth. They do not know everything humans have written, but they know their domain better than any generalist can.
Examples across industries: BioGPT for biomedical literature, CodeLlama for code, BloombergGPT for finance, Prithvi for geospatial, LogLM for security telemetry.
Vertical foundation models tend to be significantly smaller, faster at inference, cheaper to run, more accurate within their domain, and easier to ground because domain experts can validate behavior against ground truth.
Why a foundation model for logs makes sense
Operational telemetry has the same three properties that make natural language a good fit for foundation models: sequence and context, sparse meaningful signal, and a domain-specific vocabulary that benefits from purpose-built tokenization.
The output of a LogLM is not generated text. It is embeddings. Lightweight classifiers on top of those embeddings map activity to MITRE ATT&CK techniques and produce detections in real time.
How DeepTempo applies this
DeepTempo built its detection product around a vertical foundation model rather than around a frontier LLM because the architecture matches the problem. The engineering investments behind LogLM (training corpus curation, custom tokenization, classifier head training against MITRE ATT&CK, evaluation discipline, adaptation pipeline) compound over time, which is what makes a vertical model a defensible product rather than a research artifact.
