Jane Edwards 
- The benchmark draws on eight years of real-world attack data
- GreyNoise plans to expand the benchmark with additional evaluations
- Explore the latest AI developments at the 2027 Artificial Intelligence Summit on March 18
GreyNoise has introduced a benchmark designed to assess artificial intelligence models’ ability to support cyber defense operations.
Faster, AI-driven cyberattacks are pushing government and industry to rethink how they select and deploy tools for network defense. Government and industry experts will convene at the Potomac Officers Club’s 2027 Artificial Intelligence Summit on March 18 to discuss the latest developments in AI technologies and their expanding role in the government contracting sector. Register now to secure your seat.
The company said Thursday the GreyNoise AI Cyber Index is publicly accessible on its website as its threat data platform surpasses 100,000 users.
What Is the GreyNoise AI Cyber Index?
The GreyNoise AI Cyber Index is a benchmark that evaluates how well AI models handle cyber defense tasks, such as triaging alerts, writing detection rules and investigating intrusions. The initial edition tests 46 closed and open-weight models against attack traffic captured by the company’s Global Observation Grid.
The index reports each model’s task scores, refusal rates, and time and cost per problem. In the first round, Opus 5.5 earned the top raw score. Grok 4.5 ranked first on the leaderboard, which counts refused tasks as zero.
What Did GreyNoise Officials Say About the AI Cyber Index?
Andrew Morris, founder and chief architect of GreyNoise, said most public benchmarks focus on offensive capabilities, and few assess whether models can assist defenders in operational environments.
“We built the GreyNoise AI Cyber Index to give defenders something real to go on when they pick a model for their security operations. We’ve been watching attackers for 8 years. So we’re not testing models against a made up lab environment, we’re testing them against what attackers actually do against GreyNoise sensors,” Morris explained.
He added that GreyNoise has more evaluations in development and will update the benchmarks as new ones are introduced.
GreyNoise CEO Ash Devata noted that chief information security officers want to know how quickly the next critical vulnerability will be exploited and how they can anticipate and prepare for it.
“Attackers are using AI to move faster, and the only way to keep up is to fight AI-enabled offense with AI-enabled defense. But those AI systems are only as good as the data behind them,” Devata said. “Now that same data is helping defenders understand which models are best suited to real-world defensive work.”
How Has GreyNoise Expanded Its Government Work?
The GreyNoise AI Cyber Index builds on the company’s broader focus on AI-driven threats. In April, the company released a report warning that AI models in cybersecurity may be trained too late to detect emerging threats. Nishawn Smagh, director of intelligence at GreyNoise, later said in an Executive Spotlight interview that AI is accelerating both cyberattacks and cyber defense.
The company has also expanded its platform with C2 Detection, a capability that gives security teams visibility into compromised edge devices. GreyNoise has pitched the tool to federal agencies as a way to spot compromised infrastructure earlier amid warnings about Iranian cyberthreats.
On the leadership front, GreyNoise named Mike Habte director of federal sales. It later added four senior leaders to support U.S. and allied government agencies: Steve Miller as principal threat researcher, Joe Lampert as director of national security solutions, Andrew Thompson as senior vice president of adversary operations and Mark Mager as head of adversary engagement.
