datasets
Training and evaluation data, with the modality, task and licence stated up front. Listed live from the Hugging Face Hub.
Trendyol-Cybersecurity-Instruction-Tuning-Dataset
Trendyol Cybersecurity Defense Instruction-Tuning Dataset (v2.0)
🚀 TL;DR
53,202 meticulously curated system/user/assistant instruction-tuning examples covering 200+ specialized cybersecurity domains. Built by the Trendyol Security Team for training state-of-the-art defensive security AI assistants. Expanded from 21K to 53K rows with comprehensive coverage of modern security challenges including cloud-native threats, AI/ML security, quantum computing risks… See the full description on the dataset page: https://huggingface.co/datasets/Trendyol/Trendyol-Cybersecurity-Instruction-Tuning-Dataset.Cybersecurity-Dataset-Fenrir-v2.1
Cybersecurity Defense Instruction-Tuning Dataset (v2.1)
Created by Alican Kiraz
TL;DR
A ready-to-train dataset of 99,870 high-quality system / user / assistant triples for defensive, alignment-safe cybersecurity SFT training.
Apache-2.0 licensed and production-ready.
Scope: OWASP Top 10, MITRE ATT&CK, NIST CSF, CIS Controls, ASD Essential 8, modern authentication (OAuth 2 / OIDC / SAML), SSL / TLS, Cloud & DevSecOps, Cryptography, and AI Security.
1 What’s… See the full description on the dataset page: https://huggingface.co/datasets/AlicanKiraz0/Cybersecurity-Dataset-Fenrir-v2.1.cybersecurity-qa-v2
Cybersecurity Q&A Dataset v2 — 2.6M Examples
A large-scale cybersecurity Q&A dataset for fine-tuning LLMs on security topics.
2,621,468 examples covering vulnerabilities, attack techniques, weaknesses, and defensive strategies.
Statistics
Source
Examples
Description
NIST NVD CVE Database
~1,954,225
All CVEs (2002–2025): overview, severity, detection, remediation
AlicanKiraz0/All-CVE-Records-Training-Dataset
~297,441
Detailed CVE analysis with markdown… See the full description on the dataset page: https://huggingface.co/datasets/rezaduty/cybersecurity-qa-v2.cyber-security
Cybersecurity AI Knowledge Base — PhD-Level Dataset
Overview
This is the most comprehensive cybersecurity knowledge base ever assembled for AI training. It covers all domains of cybersecurity at PhD-level depth — from offensive red teaming and bug bounty exploitation to defensive SOC operations, digital forensics, and cutting-edge AI/LLM security.
Size: 16 GB | Files: 507 | Domains: 30+ | Sources: 15+ platforms
Purpose
Train the world's most… See the full description on the dataset page: https://huggingface.co/datasets/Vyber07/cyber-security.cyberseceval3-visual-prompt-injection
Dataset Card for CyberSecEval 3 - Visual Prompt Injection Benchmark
Dataset Details
Dataset Description
This dataset provides a multimodal benchmark for visual prompt injection, with text/image inputs. It is part of CyberSecEval 3, the third edition of Meta's flagship suite of security benchmarks for LLMs to measure cybersecurity risks and capabilities across multiple domains.
Language(s): English
License: MIT
Dataset Sources
Repository: Link… See the full description on the dataset page: https://huggingface.co/datasets/facebook/cyberseceval3-visual-prompt-injection.cybersecurityAs found on https://raw.githubusercontent.com/aptnotes/data/master/APTnotes.json
nist-cybersecurity-training
NIST Cybersecurity Training Dataset v1.1
The largest open-source NIST cybersecurity training dataset for fine-tuning LLMs
Version 1.1 Highlights
What's New in v1.1:
✅ Added CSWP (Cybersecurity White Papers) series - 23 new documents
✅ Fixed 6,150 broken DOI links via format normalization
✅ Removed 202 malformed DOIs (double URL prefixes)
✅ Validated and fixed 124,946 total links
✅ Cataloged 72,698 broken links for future recovery
✅ 0 broken link markers remaining in… See the full description on the dataset page: https://huggingface.co/datasets/ethanolivertroy/nist-cybersecurity-training.cybersecurity-classification-benchmark
TorchSight Cybersecurity Classification Benchmark
A two-tier benchmark dataset for evaluating cybersecurity document
classifiers, released with the TorchSight system. Used in:
Dobrovolskyi, I. Security Document Classification with a Fine-Tuned Local
Large Language Model: Benchmark Data and an Open-Source System. Journal of
Information Security and Applications, 2026.
Canonical per-model numbers live in BENCHMARK_NUMBERS.md,
auto-generated from the per-prediction result JSONs… See the full description on the dataset page: https://huggingface.co/datasets/torchsight/cybersecurity-classification-benchmark.cybersecurity_32k_instruction_input_output
Dataset Card
The dataset Q&As are focused on identification of cyber threats, and text classification under the NIST taxonomy and ITC EBA IT risk classes
Dataset Details
Dataset Description
This dataset includes a mix of public reports and news and aims to be used for cyber security risk model training.
It includes 32k examples with instruction, input and output. The latter is the output from GPT.
Curated by: [Vanessa Lopes]
Language [EN]
Dataset… See the full description on the dataset page: https://huggingface.co/datasets/Vanessasml/cybersecurity_32k_instruction_input_output.cybersecurity-master-dataset
Cybersecurity Master Dataset
Unified and deduplicated cybersecurity SFT dataset containing CTF solutions, CVE analyses, vulnerability patches, and Python coding instructions.
Cybersecurity_Reasoning_Dataset
Cybersecurity Reasoning Dataset (Model-Agnostic)
A model-agnostic re-architecture of the Cybersecurity Reasoning Dataset. The original
corpus was format-bound to the Mistral/Llama ### Instruction: / ### Response: template;
this dataset losslessly separates reasoning content from format, providing one
neutral canonical corpus plus four per-family rendered training variants
(Mistral/Llama, DeepSeek, ChatML, Gemma).
Why this exists. Identical content scored 88.1 on a… See the full description on the dataset page: https://huggingface.co/datasets/dpevzner/Cybersecurity_Reasoning_Dataset.precinct6-cybersecurity
WitFoo Precinct6 Cybersecurity Dataset
Version 2.1.0 (built 2026-09-22). Regenerated to address feedback from the University of Canterbury
PIDS evaluation: attacks and normal traffic now share a timeline, usernames are wired into the provenance graph,
mis-parsed timestamps are repaired, and every number in this card is generated from the uploaded data.
Overview
A large-scale, labeled cybersecurity dataset derived from production Security Operations Center (SOC)… See the full description on the dataset page: https://huggingface.co/datasets/witfoo/precinct6-cybersecurity.CyberSecurity_OWASP-sft-dataset
CyberSecurity_OWASP SFT Dataset
This dataset contains verifier-gated supervised fine-tuning examples for the
CyberSecurity_OWASP OpenEnv environment. Each row teaches one step of the
defensive local AppSec workflow: inspect policy/code, reproduce a local
authorization failure, submit a policy-tied diagnosis, patch the generated app,
run visible tests, and submit the fix.
Every kept trajectory is executed against the real local environment and must
pass the deterministic reward… See the full description on the dataset page: https://huggingface.co/datasets/Humanlearning/CyberSecurity_OWASP-sft-dataset.CyberSecurityEvalCyberNative AI for CyberSecurity Q/A Evaluation | NOT FOR TRAINING
This is an evaluation dataset, please do not use for training.
Tested models:
CyberNative-AI/Colibri_8b_v0.1 | SCORE: 74/100 | Comments & code
cognitivecomputations/dolphin-2.9-llama3-8b | SCORE: 67/100
Hermes-2-Pro-Llama-3-8B | SCORE: 65/100
segolilylabs/Lily-Cybersecurity-7B-v0.2 | SCORE: 63/100 | Comments & code
cognitivecomputations/dolphin-2.9.1-llama-3-8b | FAILED TESTING (Gibberish)
precinct6-cybersecurity-100m
WitFoo Precinct6 Cybersecurity Dataset (large)
Version 2.1.0 (built 2026-09-22). Regenerated to address feedback from the University of Canterbury
PIDS evaluation: attacks and normal traffic now share a timeline, usernames are wired into the provenance graph,
mis-parsed timestamps are repaired, and every number in this card is generated from the uploaded data.
Overview
A large-scale, labeled cybersecurity dataset derived from production Security Operations Center… See the full description on the dataset page: https://huggingface.co/datasets/witfoo/precinct6-cybersecurity-100m.CybersecurityQAA
Dataset Card for Cybersecurity Question-Answer-Assertion (QAA) Dataset
Dataset Summary
The Cybersecurity QAA dataset is designed to evaluate the capabilities of large language models (LLMs) in delivering cybersecurity advice and information, particularly for UK small and medium-sized enterprises (SMEs). The dataset comprises 1,563 question-answer-assertion triples across various cybersecurity topics, such as network security, data protection, and user access management.… See the full description on the dataset page: https://huggingface.co/datasets/Rowden/CybersecurityQAA.CyberSecurity-1M
CyberSecurity-1M
A large-scale, multi-source cybersecurity knowledge dataset containing 1.19M records across 16 categories, collected exclusively for academic, non-commercial research purposes. Last updated: 2026-05-27.
Disclaimer: This dataset is provided for academic research only. All content is aggregated from publicly available sources. The views, opinions, and information expressed in the dataset content do not represent the views or positions of the research team. The… See the full description on the dataset page: https://huggingface.co/datasets/WhitzardAgent/CyberSecurity-1M.cyber-security
Cybersecurity Instruction-Tuning Dataset
A large, cleaned, multi-domain cybersecurity chat dataset for LLM finetuning,
built from 198 distinct sources spanning offensive security, blue-team
operations, vulnerability intelligence, cloud/AWS security, malware analysis,
digital forensics, and more. Every record is normalized to the standard
messages chat format and deduplicated at both file and record level.
⚠️ Research use only. This dataset is provided exclusively for… See the full description on the dataset page: https://huggingface.co/datasets/oi-uae/cyber-security.cybersecurity-instruction-datasetomnimcp_cybersecurity_secops_teaser
🚀 OmniMCP CyberDefense SecOps Cloud Armor (Evaluation Teaser + Turnkey MCP Server)
⚡ Official Free Community Teaser (50 Verified Scenarios + Executable MCP Server)🏆 Production Master Package on Gumroad:👉 Purchase Full Enterprise Package on Gumroad🏷️ Use coupon code LAUNCH20 for €20 off at checkout! (Starting at €249)
⚡ Activate in Cursor IDE & Claude Desktop in 30 Seconds
This repository now contains a zero-dependency, turnkey Model Context Protocol (MCP)… See the full description on the dataset page: https://huggingface.co/datasets/emgena/omnimcp_cybersecurity_secops_teaser.cybersecurity_full_question_answersprecinct6-cybersecurity-100m
WitFoo Precinct6 Cybersecurity Dataset (large)
Overview
A large-scale, labeled cybersecurity dataset derived from production Security Operations Center (SOC) data processed by WitFoo Precinct version 6.x. This dataset contains 114,234,041 sanitized security events (signal logs) across 5 organizations and 12,361 incident provenance graphs (47,632 nodes, 32,086,552 edges).
Available in two sizes:
witfoo/precinct6-cybersecurity — 2.1M signals (smaller, faster to… See the full description on the dataset page: https://huggingface.co/datasets/artham123/precinct6-cybersecurity-100m.cybersecurity-theory-sft-gemma12b
Cybersecurity Theory SFT (Gemma 12B pack)
Curated 21,265-row cybersecurity theory instruction pack for LoRA supervised fine-tuning. Each example is a single-turn user → assistant pair covering offensive/defensive concepts, frameworks, CTF reasoning, vulnerability catalogs, and security tooling literacy — without agent tool traces or multi-turn harness data.
Paired MLX LoRA adapter trained on this pack (Nemotron 3 Super… See the full description on the dataset page: https://huggingface.co/datasets/True2456/cybersecurity-theory-sft-gemma12b.cybersecurity-sft-datasetCyberSecEval
CyberSecEval
The dataset source can be found here.
(CyberSecEval2 Version)
Abstract
Large language models (LLMs) introduce new security risks, but there are few comprehensive evaluation suites to measure and reduce these risks. We present CYBERSECEVAL 2, a novel benchmark to quantify LLM security risks and capabilities. We introduce two new areas for testing: prompt injection and code interpreter abuse. We evaluated multiple state of the art (SOTA) LLMs, including GPT-4… See the full description on the dataset page: https://huggingface.co/datasets/walledai/CyberSecEval.Cybersecurity-Dataset-Heimdall-v1.1
Cybersecurity Defense Instruction-Tuning Dataset (v1.1)
TL;DR
21 258 high‑quality system / user / assistant triples for training alignment‑safe, defensive‑cybersecurity LLMs. Curated from 100 000 + technical sources, rigorously cleaned and filtered to enforce strict ethical boundaries. Apache‑2.0 licensed.
1 What’s new in v1.1 (2025‑06‑21)
Change
v1.0
v1.1
Rows
2 500
21 258 (+760 %)
Covered frameworks
OWASP Top 10, NIST CSF
+ MITRE ATT&CK, ASD… See the full description on the dataset page: https://huggingface.co/datasets/AlicanKiraz0/Cybersecurity-Dataset-Heimdall-v1.1.Generated_Injected_PDFs_HARMLESS
Generated Injected PDFs — HARMLESS
A synthetic dataset of 1,100 PDF files built for training and evaluating structural PDF-malware detectors. It pairs benign PDFs with PDFs into which safe, non-executable "malware-shaped" objects have been injected, so a model can learn to separate the two from byte-level structure alone.
⚠️ Safety notice — read first
Nothing in this dataset is real malware. Every injected payload is built from industry-standard, non-executable… See the full description on the dataset page: https://huggingface.co/datasets/Cyber-security-final-project/Generated_Injected_PDFs_HARMLESS.cyber-security-100m
WitFoo Precinct6 Cybersecurity Dataset (large)
Overview
A large-scale, labeled cybersecurity dataset derived from production Security Operations Center (SOC) data processed by WitFoo Precinct version 6.x. This dataset contains 114,234,041 sanitized security events (signal logs) across 5 organizations and 12,361 incident provenance graphs (47,632 nodes, 32,086,552 edges).
Available in two sizes:
witfoo/precinct6-cybersecurity — 2.1M signals (smaller, faster to… See the full description on the dataset page: https://huggingface.co/datasets/Manusagents/cyber-security-100m.Cybersecurity-ShareGPTConverted, deslopped, min-hash deduplicated, rejection filtered, grammar corrected using: https://github.com/The-Chaotic-Neutrals/ShareGPT-Formaxxing
cybersecurity-soc-threat-hunting-sft-dpo-2026
🛡️ Enterprise Cybersecurity AI, SOC Tier-3 & Threat Hunting SFT/DPO Dataset (2026)
High-precision multi-turn instruction tuning and preference optimization dataset with step-by-step SOC Tier-3 Chain-of-Thought (<thought>) kill-chain diagnostic trees for fine-tuning LLMs (Llama-3.3, Qwen-2.5-Coder, DeepSeek-R1-Distill, Mistral) into Senior SOC Threat Hunters, Incident Responders, and Red-Team Defense Architects.
📊 Dataset Architecture & Highlights… See the full description on the dataset page: https://huggingface.co/datasets/beatsprom/cybersecurity-soc-threat-hunting-sft-dpo-2026.