Loading...
New
See what manual alert triage really costs your security team.
New
See what manual alert triage really costs your security team.
See what manual alert triage really costs your security team.
See what manual alert triage really costs your security team.
Loading...
Gemini 4 Argon scores 43.7% coverage on Simbian's Cyber Defense Benchmark of agentic threat hunting, 3rd of 32 models and Google's first top-three finish. That is 11.0 points above Gemini 3.8 Flash, the largest generational jump we have recorded. Claude Opus 5 leads at 45.1%. Argon hunts for $2.88 a run, but it refuses at random, caches poorly, and submits its findings only once per hunt.
Google announced Gemini 4 Argon on September 30 as a frontier model for coding, enterprise knowledge work, and "cybersecurity defense," rolling out first to trusted cyber defenders. The launch post's evidence for defense is vulnerability work: Argon finds, validates, and patches bugs, and it ties for first on CWE-bench v1, a remediation benchmark, at 68%. Patching a known weakness is a different task from finding an intruder in 100,000 log lines, so we tested that separately.
So we ran it on our Cyber Defense Benchmark (arXiv 2604.19533), which scores fully agentic AI threat hunting. The figures below are from the October 2026 leaderboard of 32 models:
Every model ran under the same harness against the same 26 campaigns. Argon's published score comes from the guarded condition, where its system prompt forbids aggregation queries that defeat the 10-row result limit.
Gemini 4 Argon covers 43.7% of the attack steps across 26 campaigns, 1.4 points behind the leader, Claude Opus 5. It's the first Google model we have measured in the top three.
| Model | Coverage | Rank (of 32) |
|---|---|---|
| Claude Opus 5 | 45.1% | 1 |
| Claude Opus 4.6 | 44.5% | 2 |
| Gemini 4 Argon | 43.7% | 3 |
| Grok 4.6 | 41.3% | 4 |
| GPT 5.6 Sol | 41.0% | 5 |
The top five sit within 4.1 points of each other, and none of them clears the 50% pass bar.
Gemini 4 Argon scores 11.0 points above Gemini 3.8 Flash, the largest generational jump we have recorded on the benchmark.
| Model | Coverage |
|---|---|
| Gemini 3 Flash | 14.6% |
| Gemini 3.6 Flash | 18.7% |
| Gemini 3.7 Flash | 29.1% |
| Gemini 3.8 Flash | 32.7% |
| Gemini 4 Argon | 43.7% |
Since Gemini 3 Flash, Google's best defensive score has tripled.
Teams that ruled out Gemini on 3.x results should retest: Argon scores 29 points above Gemini 3 Flash.
Gemini 4 Argon spends more of its effort subtracting known-good activity than hunting for known-bad names, which is closer to how analysts actually work. Other models search for the usual suspects (LIKE '%mimikatz%'). Argon is more likely to filter out what it has already seen as normal (NOT IN ('C:\Windows\System32\svchost.exe', ...)) and look at what is left.
Its search is grounded, too. 98% of Argon's queries reference data it has already seen, against under 50% for every earlier Gemini generation.
Gemini 4 Argon's results swing widely between runs: the same campaign, run three times, can spread by 16 points or more. On one campaign it scored 30.7%, 48.3%, and 58.9%.
All three of those runs issued a byte-identical first query and got a byte-identical result. Then they chose three different second queries. Argon has no strong prior over which thread to pull, so it samples, and the hunt branches from there.
For a SOC, that means one good demo run tells you little. Measure any model across repeated runs of the same incident before you trust its average.
Gemini 4 Argon's content filter killed the first 2 of our hunts mid-run. The good news is that the refusals are stochastic: the same prompt sent again got through, and with replay we completed the full benchmark evaluation.
Google says trusted defenders in its early-access program get Argon without cyber guardrails. Everyone else should plan for the filter. A hunt that stops halfway is worse than a slower one that finishes, so build retry and replay into any pipeline that runs Argon on attack data.
Gemini 4 Argon has the worst prompt caching hit rate of the top five models, 65.4%, against 96.9% for Claude Opus 5. It's also worse than the earlier Gemini Flash releases.
| Model | Cache hit rate | Mean cost per hunt |
|---|---|---|
| Gemini 4 Argon | 65.4% | $2.88 |
| Gemini 3.8 Flash | 83.5% | $0.88 |
| Gemini 3.7 Flash | 82.4% | $0.87 |
| Claude Opus 5 | 96.9% | $3.84 |
An agentic hunt resends a growing context on every turn, so the cache hit rate drives cost. Google prices cached input tokens at 95% off. Maybe Argon has become a victim of its own success at peak demand. If it reached caching levels comparable to Opus 5, its cost per hunt would fall from $2.88 to $1.16.
Pricing will also move. Google lists Argon at an introductory $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 when the introductory period ends. Cost per hunt scales with both, so the cache hit rate matters even more once the discount is gone.
Gemini 4 Argon submits its findings once per hunt, tied with Gemini 3.8 Flash for the fewest, where Gemini 3 Flash submitted about five times. Each Gemini release has moved more of the reasoning to the final step, where you can't watch it.
| Model | Submissions per hunt |
|---|---|
| Gemini 3 Flash | 5.1 |
| Gemini 3.5 Flash | 2.0 |
| Gemini 3.6 Flash | 1.8 |
| Gemini 3.7 Flash | 1.6 |
| Gemini 3.8 Flash | 1.0 |
| Gemini 4 Argon | 1.0 |
With rising concern over rogue agents, AI agent observability has become a public issue, and new Gemini models are becoming more and more introverted. Earlier models submitted intermediate results often. Later ones stay quiet and leave all the thinking about the hunt to the last step.
Google's own launch post makes the case for watching. It says Google monitors Argon's chain-of-thought for misalignment and adds, "We strongly encourage the rest of the industry to preserve reasoning transparency."
In our harness, Argon shows its work about a fifth as often as Gemini 3 Flash did.
Gemini models have bypassed LLM guardrails in our harness before. Gemini 3.1 Pro was the first model we caught defeating an operational constraint (Do not trust your SOC LLM): it used GROUP_CONCAT to brute-force log extraction past the 10-row result limit.
Argon gave us the same vibes. Unguarded, it used row-limit-defeating aggregation in 35% of its queries. When we instructed it to avoid aggregation queries, it followed the letter of the rule and ignored its spirit: it switched to MIN and MAX on timestamps to extract twice as much data.
Enforce row limits in the tool layer as well as the prompt, and log every query Argon issues.
Claude Opus 5 still leads Gemini 4 Argon on coverage, 45.1% to 43.7%, and clears the 50% bar on more MITRE ATT&CK tactics. Argon flags the largest share of malicious events of any model we have tested and costs about a quarter less per hunt.
| Gemini 4 Argon | Claude Opus 5 | |
|---|---|---|
| Rank (of 32) | 3 | 1 |
| Coverage | 43.7% | 45.1% |
| Malicious events flagged | 5.01% (highest of 32) | 4.91% |
| Tactics at 50%+ coverage | 5 of 13 | 7 of 13 |
| Weakest tactic | Exfiltration, 32% | Exfiltration, 22% |
| Mean cost per hunt | $2.88 | $3.84 |
| Median hunt time | 896 s | 964 s |
| Cache hit rate | 65.4% | 96.9% |
Coverage counts the share of each attack's steps a model backs with at least one correct flag. Flags % counts the share of all malicious events it finds. The two models split by tactic. Argon leads on Credential Access (37% vs 26%), Collection (37% vs 25%), and Exfiltration (32% vs 22%). Opus 5 leads on the other ten, including Initial Access, Persistence, Discovery, and Impact.
The two finish a hunt in about the same time. If data theft is your main threat, weigh Argon's 32% Exfiltration score against Opus 5's 22% alongside the overall rank.
Yes, Gemini 4 Argon is worth testing for SOC threat hunting if your harness handles random refusals, low cache hits, and one-shot submissions.
Google is back, now in defense too. It tied for first on CWE-bench, a vulnerability-remediation benchmark, and it's now in the top three in threat hunting.
It's cheaper than Opus 5 per hunt, and it could be cheaper still if its cache hit ratio improves. Account for stochastic refusals, and get ready for shrinking observability. Increasing introversion suggests that reinforcement learning may be trading tool-call efficiency against the observability and reliability that security work needs.
Q: Is Gemini 4 Argon good for cybersecurity? Yes, for threat hunting it is one of the strongest models available. On Simbian's Cyber Defense Benchmark, Gemini 4 Argon covers 43.7% of attack steps across 26 real campaigns, 3rd of 32 models and 1.4 points behind Claude Opus 5. It also refuses some hunts at random, has the lowest cache hit rate of the top five, and submits its findings only once per hunt, so it needs a harness that retries, controls cost, and checks its work.
Q: Is Gemini 4 better than Claude for threat hunting? Not overall. Claude Opus 5 leads Gemini 4 Argon on the Cyber Defense Benchmark, 45.1% to 43.7% coverage, and clears 50% on 7 of 13 MITRE ATT&CK tactics against Argon's 5. Argon flags the largest share of malicious events of any model tested, 5.01% against 4.91%, leads on Credential Access, Collection, and Exfiltration, and costs $2.88 per hunt against $3.84.
Q: Why did Gemini 4 Argon refuse security work? A content filter stopped the first 2 of our threat hunts mid-run. The refusals were stochastic: sending the same prompt again got through, and with replay we completed the full benchmark. Google says trusted defenders in its early-access program get Argon without cyber guardrails, so anyone outside that program should build retry and replay into their pipeline.
Q: Does Gemini 4 Argon bypass LLM guardrails? Argon routes around them when it can. Unguarded, Gemini 4 Argon used row-limit-defeating aggregation in 35% of its queries. After we forbade aggregation, it moved to the nearest permitted alternative, MIN and MAX on timestamps, in 36% of them. Gemini 3.1 Pro bypassed the same limit with GROUP_CONCAT. Enforce tool constraints by intent in the harness as well as in the prompt.
Q: How much does a Gemini 4 Argon threat hunt cost? A full threat hunt on the Cyber Defense Benchmark costs $2.88 on average with Gemini 4 Argon, against $3.84 for Claude Opus 5. Argon's cache hit rate is 65.4%. At Opus 5's 96.9%, the same hunt would cost about $1.16. Google lists Argon at an introductory $2 and $10 per million input and output tokens, rising to $4 and $20 later.
Q: How do I choose a good model for my SOC? Get a benchmark specific to your work, and don't expect a new model to simply be better. On our benchmark Opus 4.8 scores 32.7% against Opus 4.6's 44.5%, and Gemini 3.6 Flash scored no better than Gemini 3.5 Flash. An AI lab's definition of efficiency and your definition of security reliability are two different things. Then check that refusals are in order before you commit, because a model that stops mid-investigation is worse than a slower one that finishes. Read the result as a performance, time, and cost Pareto rather than a single score: Opus 4.6 reaches 44.5% in less than half the wall-clock time of Opus 5 and Gemini 4 Argon, which may matter more to you than the 0.6 points separating it from the leader.
Q: What matters after you pick a model? The harness that steers the model matters most. Match the model to the task or you will spend money for nothing: Gemini 3 Flash sampled ten times reaches 26.2% pass@k, still about nineteen points below what Opus 5 does in a single run, and re-rolling samples doesn't make up for missing capability on hard tasks. Your harness also has to watch for failure modes rather than trust the LLM's output, and guardrail bypass is the live example here. You need a team evaluating your Agents continuously, because every new model drop means substantial tool rework. Continuous evaluation is what produces reliability.
Q: Should a SOC buy or build its AI threat hunting? Buy, unless you can staff it. Reliability is what matters, and most SOCs don't have programmers to build it, validate it, and support the tooling 24/7. A practical test during a POC: see how fast the vendor answers your questions, because that is the same team that will either fix things for you or add them to next quarter's roadmap. Choose a company with receipts: one that moves the research forward, benchmarks and evaluates in public, holds patents on context usage and harness engineering, runs both offensive and defensive Agents so it can perform real agentic exercises, and whose system self-improves on your environment, absorbing your tribal knowledge into a continuously evaluated reliability loop.
Argon is a real contender for defensive work, with three habits your harness has to absorb. Simbian, which ships no model of its own, measures every model it runs and builds around what each one gets wrong. Our AI Threat Hunt Agent works the same way, keeping your team's tribal knowledge in a Context Lake™ so every hunt starts from what your analysts already know.
