ESET launches NeoCortex AI model with 200x lower training costs
ESET has introduced NeoCortex, a purpose-built foundational AI model designed to power its LiveCortex security operations product within the ESET PROTECT Platform. The Bratislava-headquartered vendor says the model processes billions of raw telemetry events daily, reducing them to a curated incident feed: only around one in 90,000 events, or 0.00111%, surfaces as an actionable incident for customers.
The headline technical claim is a 200-fold reduction in training cost compared with general-purpose large reasoning models, which ESET attributes to domain-specific training data, cybersecurity-focused vocabulary, purpose-built engineering and privately owned hardware. The company says the efficiency gains translate into more frequent updates to learned incident patterns, lower infrastructure overhead and more predictable operational costs for defenders.
What NeoCortex does
NeoCortex is built on what ESET describes as a "world-model architecture", a design approach oriented towards understanding how digital environments behave over time rather than generating plausible text responses across broad topics. In practice, the model reconstructs missing incident context, correlates fragmented signals across endpoints, identities, cloud workloads and networks, and estimates likely attacker next steps. ESET calls this capability "minus-one-day defence": giving analysts a probabilistic view of attack progression before the next stage unfolds.
Juraj Malcho, chief technology officer at ESET, said the company was "applying our AI investment to develop specialised foundational cybersecurity intelligence that remains under our control and strengthens, rather than replaces, human expertise." The model does not operate as a standalone decision-maker; it sits within a layered architecture that also includes deterministic controls, correlation logic, validation and human oversight of critical response decisions.
On AI safety, ESET has designed NeoCortex with restricted sandboxes, read-only tooling, defined token limits, continuous monitoring and a kill switch. The self-hosted deployment model means sensitive telemetry and model operations stay within ESET's own infrastructure, avoiding dependence on third-party AI providers and the commercial or geopolitical risks that come with that reliance.
Market context and competitive positioning
The announcement reflects a broader shift in enterprise cybersecurity towards AI-native detection and response, a category that now spans ESET's own extended detection and response (XDR) stack, alongside offerings from CrowdStrike, Microsoft Sentinel, Palo Alto Networks Cortex and a growing cohort of specialist vendors including Darktrace and Vectra AI. The shared challenge across all of them is alert fatigue: security operations centres routinely receive volumes of telemetry that analysts cannot manually triage.
ESET's differentiation argument rests on two pillars. First, domain specialisation: by training exclusively on security data rather than general corpora, the company argues it achieves higher precision at lower compute cost. Second, sovereignty: the self-hosted model addresses a concern that has grown louder in European enterprise procurement, particularly since the EU AI Act and ongoing debates around US cloud provider dominance of critical infrastructure. For ESET, an EU-headquartered, privately owned company, the sovereignty narrative aligns naturally with its existing regulatory positioning under GDPR and NIS2.
The 200x training-cost claim is sourced from ESET's internal research and has not been independently benchmarked against named comparators. Buyers evaluating the figure should request ESET's methodology and comparable baseline model specifications before drawing conclusions.
Regulatory read-across
The EU AI Act classifies AI systems used in critical infrastructure, including cybersecurity tooling deployed on critical systems, as high-risk under Annex III. That classification brings conformity assessment, transparency and human-oversight obligations that align closely with the safeguards ESET describes: the kill switch, human expert oversight and auditability. ESET's self-hosted architecture also simplifies compliance with NIS2 Article 21 security requirements for operators of essential services, which mandate risk-management measures covering supply-chain dependencies.
ESET says NeoCortex is available now within the ESET PROTECT Platform, though it did not disclose pricing tiers, specific customer references or capacity limits in the release.