100% of Your Code, 100% of the Time: AI Security with Small Models - Strands Decider Standup

Summary

The episode focuses on Strands Decider, an open-source family of small, fast decision models, and its potential role in security workflows.

Security fine-tuning

Chill Pillsbury tested 2B and 12B Decider variants using public security data, including CWE, CVE/NVD, and CVSS-related datasets. In initial experiments, specialized models improved performance by roughly 7%–35% over baseline on security tasks, with the strongest gains in CVSS scoring. Expanding the task to hundreds of possible CWE classifications also showed promise.

These are early research results, and specialization can reduce performance on some general tasks.

Potential security applications

Potential uses include classifying vulnerabilities found in CI/CD code scans and analyzing high-volume logs. A fast model could act as an early filter—flagging, sorting, or clearing cases before they reach slower, more expensive analysis.

The speakers stress that Decider should complement, not replace, established security tools and checks.

Why small models matter

Decider can apply pretrained model capabilities to narrow decision tasks with lower latency and cost than sending every case through a larger LLM. Fabio cited customer reports of cost reductions of up to 70% in a classification use case, while noting that the details were not shared.

Using and deploying the models

The team is working toward managed AWS options, but a managed API was not yet available. The repository includes SageMaker deployment code and notebook examples, and the 2B model can also be run locally. The project’s recipes document training datasets and licenses.

Other development and broader uses

Fabio described ongoing image and video training research, with more than 2,000 additional GPU hours reported. The team is curating appropriately licensed data and is first targeting image understanding before physical-AI action tasks. A larger V2 model roadmap is also underway.

The same approach may support tasks beyond security, such as entity extraction. The team’s premise is that pretrained model intelligence can be adapted to different decision tasks when those tasks can be clearly described.

Reviews, guides, or tutorials

No formal review or step-by-step tutorial is presented. The speakers point to repository recipes, SageMaker deployment samples, and Jupyter notebook examples as ways to explore and run the models.

Main speakers and sources

• Mike Chambers — Host and AWS DevX engineer
• Fabio Nonato de Paula — AWS scientist and Strands Decider lead
• Chill Pillsbury — AWS principal security engineer