Benchmark Almanac

CTIBench

ChatGPT-4 (snapshot unspecified) 71% tops its leaderboard Llama 3-70B 65.7% leads the models we track
Not in model cards

Models answer cyber threat intelligence questions. Tasks cover knowledge questions, CVE to CWE mapping, CVSS severity scoring, threat actor attribution and technique extraction.

Five task sets scored separately, listed as NeurIPS 2024 spotlight by the maintained repo. Dataset is CC BY-NC-SA 4.0 on Hugging Face, so reuse is non-commercial. arXiv v3 dated 11 November 2024.

Released
June 2024
Kind
Finding and exploiting real bugs
Level
Expert
Scored
Checked automatically
Answers
Short answer
Tasks
All public
Strongest model tested
Llama 3-70B #181 on the capability index
Last model added
April 2024
Scores refreshed
November 12th, 2026

In the authors’ words

Cyber threat intelligence (CTI) is crucial in today's cybersecurity landscape, providing essential insights to understand and mitigate the ever-evolving cyber threats. The recent rise of Large Language Models (LLMs) have shown potential in this domain, but concerns about their reliability, accuracy, and hallucinations persist. While existing benchmarks provide general evaluations of LLMs, there are no benchmarks that address the practical and applied aspects of CTI-specific tasks. To bridge this gap, we introduce CTIBench, a benchmark designed to assess LLMs' performance in CTI applications. CTIBench includes multiple datasets focused on evaluating knowledge acquired by LLMs in the cyber-threat landscape. Our evaluation of several state-of-the-art models on these tasks provides insights into their strengths and weaknesses in CTI contexts, contributing to a better understanding of LLM capabilities in CTI.

Abstract of CTIBench: A Benchmark for Evaluating LLMs in Cyber Threat Intelligence (arXiv:2406.07599, CC0)
5
Entries on its own leaderboard, 2 models we track

ChatGPT-4 (snapshot unspecified) tops the leaderboard with 71%

Best score per entry from the benchmark's own leaderboard, read on November 12th, 2026. Where a model ran with several settings or harnesses, we keep its best. Names in gray aren't in our model list: fine-tunes, agent systems, products and older models. They don't count toward leaders. The best model we track is Llama 3-70B, at 65.7%.

  1. 1 ChatGPT-4 (snapshot unspecified) CTI-MCQ accuracy 71%
  2. 2 Llama 3-70B CTI-MCQ accuracy 65.7%
  3. 3 Gemini-1.5 (snapshot unspecified) CTI-MCQ accuracy 65.4%
  4. 4 Llama 3-8B CTI-MCQ accuracy 61.3%
  5. 5 ChatGPT-3.5 (snapshot unspecified) CTI-MCQ accuracy 54.1%

Source: Official CTIBench leaderboard

#EntryScoreSettingDateSource
1 ChatGPT-4 (snapshot unspecified) 71% CTI-MCQ accuracy Official leaderboard
2 Llama 3-70B 65.7% CTI-MCQ accuracy Apr 2024 Official leaderboard
3 Gemini-1.5 (snapshot unspecified) 65.4% CTI-MCQ accuracy Official leaderboard
4 Llama 3-8B 61.3% CTI-MCQ accuracy Apr 2024 Official leaderboard
5 ChatGPT-3.5 (snapshot unspecified) 54.1% CTI-MCQ accuracy Official leaderboard

Scores over time

All the scores we have, one dot each, so a model tested at several settings appears more than once.

On the benchmark’s own leaderboard
0% 20% 40% 60% 80% 100% 2024 Near the ceiling (85%) Llama 3-70B 0% 20% 40% 60% 80% 100% 2024 Near the ceiling (85%) Llama 3-70B

Source: Official CTIBench leaderboard

No lab model card reports it yet

We read the headline results of 522 launch posts from 52 labs, and none of them list this benchmark.

More in Cybersecurity

All 115 in Cybersecurity
  • ExploitGym In use 869 real-vulnerability exploit-development tasks (userspace, V8, Linux kernel). Success means capturing a flag through the intended vulnerability. GPT-6 Astra 42.4%
  • ExploitBench In use 41 recent V8 JavaScript-engine N-day vulnerabilities. Progress measured by 16 grader-verified capability flags across five tiers. GPT-6 Astra 100%
  • CyberBench v1.1 (Vals) In use Agents work on OSS-Fuzz memory-safety bugs from ARVO images in two tracks. They write a proof-of-concept input that crashes the target, or patch the source so the crash stops and tests still pass. Muse Wonder 80.4%
  • SRE-Bench In use Software reverse engineering without source: 262 binary instances from 19 private programs, each with six graded objectives. GPT-6 Astra 56.9%
  • CyScenarioBench In use Scenario-based long-horizon security challenges in sandboxes, organized in task, scenario and campaign tiers. Evaluation set kept private. Gemini 4 Argon 100%
  • ExploitBench - Internal Port In use Agents develop working exploits for recently disclosed vulnerabilities to limit contamination. Scored as arbitrary code execution success rate. GPT-6 Cyber 42%