language:

• en
  license: apache-2.0
  size_categories:
• 100K<n<1M
  task_categories:
• text-generation
• question-answering
  tags:
• cybersecurity
• red-team
• penetration-testing
• offensive-security
• sft
• instruction-tuning
• mitre-attack
• cve
• owasp
• nist
• cis-benchmark
• cloud-security
• threat-intelligence
• vulnerability-analysis
• security-operations
• asvs
  pretty_name: CyberStrike SFT 120K
  dataset_info:
  features:
  • name: messages
    list:
    • name: role
      dtype: string
    • name: content
      dtype: string
  • name: metadata
    struct:
    • name: category
      dtype: string
    • name: generator
      dtype: string
    • name: scenario
      dtype: string
    • name: generated
      dtype: string
    • name: extra
      dtype: string
      splits:
  • name: train
    num_examples: 121422
    configs:
• config_name: default
  data_files:
  • split: train
    path: cyberstrike_sft_v2.jsonl

CyberStrike SFT 120K

The largest open-source offensive cybersecurity SFT dataset
121,422 expert-level red team instruction-response pairs across 15 security generators

Quick Start • Why CyberStrike • Domains • Data Format • Training Guide • Benchmarks • Contributing • License

Why CyberStrike?

Most LLMs refuse or give surface-level answers to offensive security questions. Security professionals — penetration testers, red teamers, bug bounty hunters — need models that can reason about real attack techniques with the same depth as a senior operator.

CyberStrike SFT 120K fills this gap:

• No refusals — Every response provides actionable technical depth
• Real-world grounded — Scenarios derived from MITRE ATT&CK, OWASP, NIST, CIS, NVD, and real CVEs
• Operator-level detail — Actual commands, payloads, scripts, and exploitation chains
• Defense-aware — Responses include detection indicators, OPSEC considerations, and blue team perspectives
• Framework-aligned — Mapped to industry-standard security frameworks

Use case: Fine-tune any base model (Qwen, Llama, Mistral, etc.) to create a cybersecurity-focused assistant that thinks like an APT operator and responds like a senior pentester.

Quick Start

from datasets import load_dataset

dataset = load_dataset("oyildirim/cyberstrike-sft-120k", split="train")

print(f"Total examples: {len(dataset):,}")
print(dataset[0]["messages"][1]["content"][:200])  # User prompt
print(dataset[0]["messages"][2]["content"][:200])  # Assistant response
print(dataset[0]["metadata"])                       # Metadata

Fine-tune with Unsloth (recommended)

from unsloth import FastModel
from datasets import load_dataset
from trl import SFTTrainer, SFTConfig

model, tokenizer = FastModel.from_pretrained(
    model_name="Qwen/Qwen3-32B",  # or any base model
    max_seq_length=8192,
    load_in_4bit=True,
)

model = FastModel.get_peft_model(
    model,
    r=64, lora_alpha=128,
    target_modules=["q_proj", "k_proj", "v_proj", "o_proj",
                     "gate_proj", "up_proj", "down_proj"],
)

dataset = load_dataset("oyildirim/cyberstrike-sft-120k", split="train")

trainer = SFTTrainer(
    model=model,
    tokenizer=tokenizer,
    train_dataset=dataset,
    args=SFTConfig(
        output_dir="./cyberstrike-finetuned",
        per_device_train_batch_size=2,
        gradient_accumulation_steps=8,
        num_train_epochs=1,
        learning_rate=2e-4,
        bf16=True,
        max_seq_length=8192,
    ),
)

trainer.train()

Fine-tune with Axolotl

# axolotl config
base_model: Qwen/Qwen3-32B
datasets:
  - path: oyildirim/cyberstrike-sft-120k
    type: sharegpt
sequence_len: 8192
adapter: qlora
lora_r: 64
lora_alpha: 128

Domains & Coverage

CyberStrike covers 11 distinct security domains, sourced from real-world frameworks and vulnerability databases:

Coverage Highlights

Frameworks:   MITRE ATT&CK  |  OWASP Top 10  |  OWASP ASVS  |  NIST CSF  |  CIS Benchmarks
Platforms:    Linux  |  Windows  |  macOS  |  AWS  |  Azure  |  GCP  |  Kubernetes  |  Docker
Techniques:   Recon  |  Initial Access  |  Execution  |  Persistence  |  Priv Esc  |  Lateral Movement
              Defense Evasion  |  Credential Access  |  Discovery  |  Collection  |  Exfiltration  |  C2
Tools:        Nmap  |  Burp Suite  |  Metasploit  |  Cobalt Strike  |  BloodHound  |  Impacket
              Nuclei  |  ffuf  |  sqlmap  |  Responder  |  CrackMapExec  |  Custom scripts

Data Format

Every example contains a messages array (ChatML/ShareGPT format) and a metadata object with provenance information:

{
  "messages": [
    {
      "role": "system",
      "content": "You are CyberStrike, an elite red team AI operator..."
    },
    {
      "role": "user",
      "content": "We have initial access to a Ubuntu 24.04 LTS host inside an air-gapped OT/SCADA network..."
    },
    {
      "role": "assistant",
      "content": "## T1212 - Exploitation for Credential Access\n\n### 1. PREREQUISITES\n..."
    }
  ],
  "metadata": {
    "category": "mitre_attack",
    "generator": "gen_mitre_attack",
    "scenario": "T1212_deep_dive",
    "generated": "2026-06-13T11:07:45.192374",
    "extra": "{\"technique_id\": \"T1212\", \"technique_name\": \"Exploitation for Credential Access\", \"framework\": \"ATT&CK Enterprise\", \"variant\": \"deep_dive\", \"tactics\": [\"credential-access\"]}"
  }
}

Message Roles

Metadata Fields

Extra Metadata Examples by Generator

MITRE ATT&CK (gen_mitre_attack):

{"technique_id": "T1059.001", "technique_name": "PowerShell", "framework": "ATT&CK Enterprise", "tactics": ["execution"]}

CVE Reasoning (gen_cve_reasoning):

{"cve_id": "CVE-2024-2756", "cvss_score": 9.8, "cwes": ["CWE-287"], "variant": "deep_dive"}

CIS Hardening (gen_cis_hardening):

{"cis_benchmark": "CIS_Docker_1.6.0", "platform": "Docker", "skill_id": "5.1.1", "skill_name": "Ensure AppArmor Profile is Enabled"}

Cloud Security (gen_cloud_security):

{"stack": "AWS", "perspective": "exploit_misconfiguration", "skill_id": "iam-1", "skill_name": "Overprivileged IAM Role"}

GitHub Advisories (gen_github_advisories):

{"ghsa_id": "GHSA-xxxx-yyyy", "cve_id": "CVE-2024-1234", "ecosystem": "npm", "package_name": "express", "severity": "critical"}

What Makes the Responses High-Quality

Each assistant response typically includes:

Dataset Statistics

Training Guide

Recommended Configurations

Hyperparameter Recommendations

# These settings were validated during our training runs
LORA_R = 64
LORA_ALPHA = 128
LEARNING_RATE = 2e-4
LR_SCHEDULER = "cosine"
WARMUP_RATIO = 0.05
WEIGHT_DECAY = 0.01
NEFTUNE_ALPHA = 5        # NEFTune noise for better generalization
OPTIMIZER = "adamw_8bit"
MAX_SEQ_LENGTH = 8192

Tips

• Packing: Most SFT frameworks support packing — shorter examples are concatenated to fill max_seq_length, reducing wasted compute. Note: some MoE models may skip packing.
• NEFTune: Adding small noise to embeddings (neftune_noise_alpha=5) consistently improves generalization on instruction-tuning datasets.
• Checkpoint resume: Save checkpoints every 500 steps. Training this dataset takes many hours — you don't want to lose progress.
• QLoRA vs LoRA: QLoRA (4-bit) is faster but may have quality differences on some model architectures. If VRAM allows, 16-bit LoRA is preferred.

Generation Pipeline

                    ┌──────────────────────────┐
                    │  Security Frameworks DB   │
                    │  MITRE ATT&CK, OWASP,    │
                    │  NIST, CIS, NVD, GHSA    │
                    └────────────┬─────────────┘
                                 │
                    ┌────────────▼─────────────┐
                    │   Scenario Generator     │
                    │   15 specialized modules  │
                    │   Parallel workers (×4)   │
                    └────────────┬─────────────┘
                                 │
                    ┌────────────▼─────────────┐
                    │   LLM Response Gen       │
                    │   Domain-specific prompts │
                    │   System prompt injection │
                    └────────────┬─────────────┘
                                 │
                    ┌────────────▼─────────────┐
                    │   Validation Pipeline    │
                    │   • Min 500 char check   │
                    │   • Refusal detection    │
                    │   • Structure validation │
                    │   • Code block check     │
                    └────────────┬─────────────┘
                                 │
                    ┌────────────▼─────────────┐
                    │   Cleaning & Dedup       │
                    │   • Double-wrap fix      │
                    │   • Code-fence unwrap    │
                    │   • System prompt norm   │
                    │   • MD5 deduplication    │
                    └────────────┬─────────────┘
                                 │
                    ┌────────────▼─────────────┐
                    │   cyberstrike-sft-120k   │
                    │   121,422 examples        │
                    │   946 MB JSONL            │
                    └──────────────────────────┘

Intended Use

Who is this for?

• Security researchers building AI-powered security tools
• Red team operators wanting a domain-specific AI assistant
• Bug bounty hunters automating reconnaissance and analysis
• Security educators creating training materials and CTF challenges
• AI/ML researchers exploring domain-specific fine-tuning

Example Applications

• Fine-tune a local model for offline penetration testing assistance
• Build a vulnerability analysis copilot that reasons about CVEs
• Create a red team planning assistant that maps to MITRE ATT&CK
• Train a security automation agent that writes and executes scripts
• Develop a threat modeling assistant aligned with NIST/CIS frameworks

Comparison with Other Datasets

CyberStrike provides 4-5x longer responses than typical instruction datasets, with domain-specific depth that general datasets cannot match.

Ethical Considerations & Responsible Use

This dataset contains offensive security content. It is created for authorized security testing and education.

You MUST:

• Only use fine-tuned models within authorized security assessments
• Comply with all applicable laws and regulations
• Follow responsible disclosure practices for any vulnerabilities discovered
• Respect scope and rules of engagement in any testing

You MUST NOT:

• Use this data to attack systems without authorization
• Create models for malicious purposes
• Distribute fine-tuned models without appropriate safety guardrails

Contributing

We welcome contributions to expand and improve the dataset:

• New domains — Submit examples covering emerging attack surfaces (AI/ML security, IoT, automotive, etc.)
• Quality improvements — Flag low-quality or inaccurate examples
• Translations — Help translate prompts to other languages for multilingual security training
• Evaluation — Help build benchmarks to measure model performance on security tasks

Open an issue or discussion on this repo, or reach out via GitHub.

Roadmap

• CyberStrike DPO Dataset — Preference pairs for persona alignment (Chain of Thought, tool usage, agentic behavior)
• CyberStrike Eval Benchmark — Standardized evaluation for cybersecurity LLMs
• Pre-trained Model Release — Fine-tuned model weights on Hugging Face
• Multi-language Support — Security scenarios in Turkish, German, Japanese, and more
• v2 Expansion — Additional domains: IoT security, mobile security, AI/ML adversarial attacks

Citation

If you use this dataset in your research or projects, please cite:

@dataset{cyberstrike_sft_2025,
  title     = {CyberStrike SFT 120K: Offensive Cybersecurity Training Dataset},
  author    = {Yildirim, Orhan},
  year      = {2025},
  publisher = {Hugging Face},
  url       = {https://huggingface.co/datasets/oyildirim/cyberstrike-sft-120k}
}

License

This dataset is released under the Apache License 2.0.

Built with persistence by Orhan Yildirim
_{If you find this dataset useful, consider giving it a like on Hugging Face.}