Small language models — Claude Haiku, Gemini Flash, Phi, small open-weight variants — are often presented as budget-constrained alternatives to large models. For specific security use cases, they're not compromises; they're the right tool. Low latency, high throughput, adequate quality on the specific task. Knowing which security workflows are SLM-appropriate is the capability that makes task-routed architectures work in practice.
Where SLMs fit security workflows
Four categories:
- Bulk classification. Routing findings to appropriate queues. Adequate quality; massive volume.
- Template-based extraction. Pulling specific fields from CVE descriptions, vendor advisories, or code.
- Routine summarisation. One-line summaries for dashboards. Doesn't need Opus-class reasoning.
- Quick-turn developer feedback. IDE-latency-sensitive workflows.
For these, SLMs produce the same outcome faster and cheaper.
Where SLMs don't fit
Three categories:
- Multi-step reasoning over complex evidence. Exploit hypothesis on a reachable taint path.
- Fix-PR generation with breaking-change awareness.
- Adversarial scenarios. SLMs are more susceptible to prompt injection than larger models.
For these, the quality delta matters.
How Griffin AI uses them
Three integration points:
- Finding deduplication and classification routes to Haiku-class models.
- Bulk SBOM metadata enrichment uses SLMs for the per-component work.
- Fast-turn dashboard summarisation uses SLMs with larger models as fallback.
The task-routed architecture exploits SLMs where they're adequate and escalates where they're not.
What to evaluate
Two questions:
- What percentage of your security workload is SLM-appropriate?
- Does your platform route tasks to appropriately-tiered models automatically?
How Safeguard Helps
Safeguard's Griffin AI includes automatic task routing between model tiers. SLMs handle what they handle well; larger models step in where the SLM's quality is inadequate. For customers whose cost-per-finding numbers need the SLM efficiency gains, the architecture delivers them.