A small language model is a compact AI model tuned for a narrower set of tasks than a general-purpose large language model. It is usually optimized for lower cost, faster responses, and more predictable behavior on well-defined inputs, such as classifying emails, extracting fields from logs, or drafting short responses from controlled data.
In cyber security, small language models matter because they can be easier to constrain and monitor than broad chat systems. Teams often use them for phishing detection, alert triage, malware or ticket summarization, and policy-based text extraction, especially when data should stay on-premises or in a restricted environment. Attackers can also use compact models to mass-produce convincing lures or automate simple reconnaissance. Like any model, a small language model still needs grounding, validation, and human review when its output can affect access, compliance, or incident response.