DeepSeek-R 11.5B Cyber

A cybersecurity-focused DeepSeek-R 11.5B reasoning model optimized and redefined for penetration testing, defensive security, malware analysis, digital forensics, secure software development, security research, and cybersecurity education.

---

Overview

DeepSeek-R 11.5B Cyber is a customized cybersecurity-focused variant of the DeepSeek-R 11.5B reasoning model, designed for cybersecurity professionals, SOC analysts, penetration testers, security researchers, students, developers, and system administrators.

The model is optimized for local deployment and can assist with security analysis, vulnerability assessment, scripting, secure coding, incident response, digital forensics, threat hunting, security documentation, and cybersecurity education.

The model is available in approximately 1.1 GB size with a 40K context window, making it suitable for lightweight local AI security workflows. It is designed to run on CPU systems and can also benefit from GPU acceleration.

---

Features

• 🛡️ Cybersecurity-Focused AI Assistant
• 🔍 Vulnerability Analysis
• 💻 Secure Code Generation
• 🧠 Advanced Reasoning
• ⚡ Fast Local Inference
• 🐍 Python & Bash Scripting
• 🌐 Network Security
• 🔐 Web Application Security
• 📊 SOC & SIEM Support
• 📝 Security Documentation
• 🧪 CTF Learning Assistant
• 🔎 Threat Hunting
• 🦠 Malware Analysis
• 💾 Digital Forensics
• 🚨 Incident Response
• 🤖 AI Agent Ready
• 🖥️ CPU Deployment Support

---

Installation

Pull the model:

ollama pull babar_jamali/deepseek-r-11.5b-cyber

Run the model:

ollama run babar_jamali/deepseek-r-11.5b-cyber

---

Example Prompts

Penetration Testing

Explain how to perform an authorized web application security assessment following the OWASP Testing Guide.

Secure Coding

Review this PHP authentication code and identify security weaknesses and recommended mitigations.

Network Security

Explain how to detect ARP spoofing attacks on an authorized corporate network.

Vulnerability Assessment

Explain how to prioritize vulnerabilities discovered during an internal security assessment.

Digital Forensics

Describe the steps for investigating a compromised Windows workstation while preserving digital evidence.

Malware Analysis

Explain the behavior of ransomware and describe defensive detection and mitigation techniques.

Python

Create a Python script that parses web server logs and highlights suspicious authentication activity.

Linux

Write a Bash script that monitors failed SSH login attempts and generates a security report.

SOC

Create a SOC investigation workflow for detecting suspicious PowerShell activity.

Incident Response

Create an incident response checklist for a ransomware incident affecting an organization's endpoints.

Threat Hunting

Create a threat hunting methodology for identifying suspicious network authentication activity.

Secure Laravel Development

Act as a Senior Application Security Consultant.

Review a Laravel application for:

• Authentication
• Authorization
• SQL Injection
• XSS
• CSRF
• File Upload Security
• Session Security
• API Security
• Input Validation
• Recommended Mitigations

---

Primary Use Cases

• Cybersecurity Training
• SOC Operations
• Threat Hunting
• Secure Software Development
• Vulnerability Assessment
• Security Awareness
• Digital Forensics
• Incident Response Planning
• CTF Practice
• Security Research
• Security Documentation
• Linux Administration
• Network Analysis
• Malware Analysis
• Application Security
• DevSecOps

---

Security Domains Covered

• OWASP Top 10
• Web Application Security
• API Security
• Network Security
• Windows Security
• Linux Security
• Active Directory
• SIEM Fundamentals
• Threat Intelligence
• Malware Analysis
• Digital Forensics
• Incident Response
• Cloud Security
• Vulnerability Management
• Secure Coding Practices
• Security Monitoring
• Log Analysis
• OSINT
• Threat Hunting

---

Security Tools & Technologies

The model can assist with learning, understanding, configuring, scripting, and authorized use of security tools and technologies such as:

• Nmap
• Wireshark
• Burp Suite
• Metasploit
• Nuclei
• Nikto
• OWASP ZAP
• OpenVAS
• Nessus
• Snort
• Suricata
• Splunk
• ELK Stack
• Sigma
• YARA
• Volatility
• Linux Security Tools
• Windows Security Tools
• PowerShell
• Python
• Bash

---

Programming & Scripting

The model is suitable for security-related programming and automation using:

• Python
• Bash
• PowerShell
• PHP
• JavaScript
• TypeScript
• C
• C++
• Java
• Kotlin
• Go
• Rust
• SQL

---

Hardware Requirements

The model is designed for lightweight local deployment.

Recommended

• Model Size: Approximately 1.1 GB
• Context Window: Up to 40K
• RAM: 8 GB recommended
• CPU: Modern multi-core processor
• GPU: Optional
• Storage: 3 GB or more recommended

CPU inference is supported, while GPU acceleration can provide improved inference performance.

---

Local AI Deployment

Run the model directly from your terminal:

ollama run babar_jamali/deepseek-r-11.5b-cyber

Use the model through the Ollama API:

curl http://localhost:11434/api/chat \
  -d '{
    "model": "babar_jamali/deepseek-r-11.5b-cyber",
    "messages": [
      {
        "role": "user",
        "content": "Explain how to investigate suspicious SSH authentication logs."
      }
    ]
  }'

---

AI Agent Integration

The model can also be used with compatible local AI development and agent workflows.

Claude Code

ollama launch claude --model babar_jamali/deepseek-r-11.5b-cyber

OpenCode

ollama launch opencode --model babar_jamali/deepseek-r-11.5b-cyber

Hermes Agent

ollama launch hermes --model babar_jamali/deepseek-r-11.5b-cyber

OpenClaw

ollama launch openclaw --model babar_jamali/deepseek-r-11.5b-cyber

---

Best Practices

To get the most useful security responses:

• Clearly describe your authorized environment.
• Specify the operating system and technologies involved.
• Explain the security objective.
• Provide relevant logs, alerts, or error messages.
• Request explanations alongside commands or scripts.
• Ask for defensive recommendations and mitigations.
• Validate generated commands before executing them.
• Use isolated labs for security experimentation.

Example:

Act as a Senior Security Consultant.

Analyze the following authorized SOC alert.

Environment:
• Ubuntu Server
• Nginx
• MySQL
• SSH
• Fail2ban

Objective:
Determine whether the authentication activity indicates a possible brute-force attack.

Provide:

• Initial Assessment
• Indicators of Compromise
• Investigation Steps
• Relevant Logs
• Detection Recommendations
• Mitigation Steps
• Long-Term Security Improvements

---

Ideal For

• Penetration Testers
• SOC Analysts
• Security Engineers
• Ethical Hackers
• Blue Teams
• Red Teams
• DevSecOps Engineers
• System Administrators
• Cybersecurity Students
• Security Researchers
• Software Developers
• CTF Players
• Security Instructors
• IT Professionals

---

Model Variants

The model currently provides:

Latest

babar_jamali/deepseek-r-11.5b-cyber:latest

Hackmode

babar_jamali/deepseek-r-11.5b-cyber:hackmode

Pull a specific variant with:

ollama pull babar_jamali/deepseek-r-11.5b-cyber:hackmode

Run it with:

ollama run babar_jamali/deepseek-r-11.5b-cyber:hackmode

---

Limitations

As a locally deployed language model, responses may contain inaccuracies or incomplete information.

Security-related output should always be:

• Reviewed by a qualified professional.
• Tested in an authorized environment.
• Validated before deployment.
• Evaluated against the actual system configuration.

The model should not be treated as a replacement for professional security testing, incident response procedures, or organizational security controls.

---

Responsible Use

This model is intended for:

• Cybersecurity education
• Defensive security research
• Authorized penetration testing
• Security analysis
• Secure software development
• SOC operations
• Threat hunting
• Incident response planning
• Digital forensics education
• Capture-the-Flag (CTF) practice
• Security automation in authorized environments

Always obtain proper authorization before testing systems, networks, applications, accounts, or infrastructure.

Users are responsible for complying with applicable laws, regulations, organizational policies, and ethical guidelines.

---

Credits

Base Model

DeepSeek-R by the DeepSeek team, an open family of reasoning models.

Cyber Edition

Customized and maintained by:

Babar Ali Jamali

Software Developer • Cybersecurity Researcher • AI Engineer

---

Quick Start

ollama pull babar_jamali/deepseek-r-11.5b-cyber

ollama run babar_jamali/deepseek-r-11.5b-cyber

---

⭐ If you find this model useful, consider sharing it with the cybersecurity community and providing feedback to help improve future releases.

Happy Hacking — Responsibly! 🛡️💻