Most questions a security team asks repeat. Which of our services use this package? Who owns this repository? What is our policy on this license? A giant general model is more than you need to answer them, and it sends your questions somewhere else. A small language model, trained from what your team already searches for and decides, can answer them locally. Safeguard lets you generate one from Safeguard search itself.
What it is
Every search in Safeguard is a question about your own software estate, and every answer ties to real data: assets, findings, owners and policies. That makes search a natural source for a small, focused model. The idea is simple: use the questions your team asks and the vetted answers they accept to produce a tiny model of your own, specialized for your environment.
Why a small model
- It runs where you want. Small models are practical on local hardware, including air gapped sites.
- It keeps questions private. Nothing needs to leave your environment for routine lookups.
- It is cheap to run. Routine questions do not need the largest model.
- It is narrow on purpose. A model about your estate is less likely to wander.
This follows a pattern Safeguard already uses. The model lineup includes Lion, a smaller model that runs on the device with no network egress and ships in the IDE extension, CLI and pre-commit hook, distilled from a larger one. Zero AI mode needs no model at all. A model of your own is another point on that range.
Examples
A platform team in an air gapped facility generates a small model from its search history and runs it beside the Safeguard runner. Engineers ask about packages and owners without any outbound traffic. A managed security provider builds one model per customer so answers never mix environments. A developer runs a tiny model in the editor for quick lookups and escalates the hard questions.
What to be careful about
- Training data is data. Search history can contain names, internal paths and unpublished findings. Decide what is in scope before you build.
- Record the lineage. Keep a signed record of the base model, the data and the evaluation, the same as any fine-tune.
- Evaluate before you trust it. Test on questions where you already know the answer, including questions it should decline.
- Keep humans on actions. Let the small model answer, and keep approvals on anything destructive or external.
- Plan to refresh. Your estate changes. A model trained on last quarter's repositories will be wrong about this quarter's.
Quick check
Why build a small model instead of using a large one?
It can run locally, keeps routine questions private, costs little to run and stays focused on your own estate.
What should you decide before using search history as training data?
Which data is in scope, since search history can contain names, internal paths and unpublished findings.
