Researchers have released MiST, a pair of language models tuned specifically for cybersecurity work, and the training method behind them is the more interesting part.
MiST comes in 8B and 32B parameter sizes, built on top of Qwen base models. Instead of dumping huge amounts of raw security text into continued pre-training, the team curated a small, expert-vetted seed corpus and used it to generate synthetic training data for an intermediate "mid-training" stage, sitting between general pre-training and task-specific fine-tuning. On public cybersecurity benchmarks, the 8B model gained 13.1 percentage points in mean accuracy over its Qwen baseline, and the 32B model gained 8.6 points - relative improvements of 27% and 15.8%, respectively.
The quality-over-quantity approach matters because most domain adaptation work still leans on scale: more raw text, more compute, hope for the best. MiST's results suggest a smaller, carefully vetted dataset paired with synthetic augmentation can outperform that brute-force method, and do it more cheaply. The researchers also found MiST checkpoints make better starting points for further fine-tuning and reinforcement learning, which matters more than the benchmark numbers themselves.
Benchmark gains are easy to produce and harder to trust - the real test is whether these models hold up triaging an actual incident, not a curated test set.