Abstract

Large language models (LLMs) are transforming everyday applications, yet they lag behind in specialized fields, such as cybersecurity, due to a lack of high-quality, domain-specific models and training datasets. To address this gap, we present _CyberPal 2.0_ , a family of cybersecurity-expert small language models (SLMs) ranging from 4B20B parameters. To train CyberPal 2.0, we generate an enriched chain-of-thought cybersecurity instruction dataset built with our data enrichment and formatting pipeline, _SecKnowledge 2.0_ , which integrates expert-in-the-loop steering of reasoning formats alongside LLM-driven multi-step grounding, yielding higher-fidelity, task-grounded reasoning traces for security tasks. Across diverse cybersecurity benchmarks, CyberPal 2.0 consistently outperforms its baselines and matches or surpasses various open and closed-source frontier models, while remaining a fraction of their size. On core threat-investigation tasks, such as correlating vulnerabilities and bug tickets with weaknesses, our best 20B-parameter model _outperforms GPT-4o, o1, o3-mini, and Sec-Gemini v1_ , ranking _first_ , while our smallest 4B-parameter model ranks _second_ . On core cyber threat intelligence knowledge tasks, our models outperform almost all tested frontier models, ranking _second only to Sec-Gemini v1_ . To foster reproducibility and practical adoption, we will release our models as open source.