Lean SuperIntelligence Debuts Self-Improving On-Prem Cybersecurity LLMs
Lean SuperIntelligence (LSI), a Palo Alto startup, has closed a pre-seed financing round and introduced two cybersecurity language models, LSI-Offense-1 and LSI-Defense-1, that train against each other and run inside a customer's own infrastructure. According to the company, the models outperform frontier systems on offense and defense benchmarks at a fraction of the cost.
- Lean SuperIntelligence closed a pre-seed round and launched LSI-Offense-1 and LSI-Defense-1, security LLMs that improve each other.
- The company claims LSI-Offense-1 beats Claude Mythos, GPT-6 and Gemini-3.8-Cyber on real-world offense benchmarks.
- LSI says LSI-Defense-1 outperforms frontier models on defense benchmarks at a fraction of the cost, with fewer false positives.
- The models run air-gapped or on-prem and are available now to a limited group of design partners.
- Round size and pricing were not disclosed in the announcement.
Two models that train each other
LSI describes itself as the first AI lab to build self-improving offense and defense security LLMs. LSI-Offense-1 finds, exploits and validates vulnerabilities. LSI-Defense-1 detects, investigates and responds to threats, which the company says it does within minutes rather than days or weeks.
The two models work inside what LSI calls Cyber World Models. According to the company, every attack the offense model finds becomes a lesson for the defense model, and every defense that holds forces the offense model to find a new path. LSI says both models keep improving on the customer's own data.
The company says the models can be customized and air-gapped, and that they are lean enough to run continuously, including scanning every check-in that software developers make.
Benchmark claims against frontier models
LSI says that on independent, real-world offense security benchmarks, LSI-Offense-1 significantly outperforms frontier models including Claude Mythos, GPT-6 and Gemini-3.8-Cyber at autonomously discovering, exploiting and validating vulnerabilities. The company adds that the model has already uncovered previously unknown vulnerabilities.
On public defense benchmarks covering multi-step threat detection, investigation and response, LSI says LSI-Defense-1 significantly outperforms frontier models from the same labs at a fraction of their cost. It describes the model as triaging alerts, correlating telemetry and returning verdicts in seconds with far fewer false positives. The source gives no specific scores, and these results are the company's own claims.
The case for owning the model
LSI argues that attacks move fast, noting that a rumoured vulnerability can become a working exploit in under 10 minutes. It also says enterprises currently send code and telemetry to frontier labs, pay hundreds of millions in inference and own nothing they learn.
To support the shift toward private deployment, the company cites a June 2026 survey of 1,500 enterprise architects in which 66% of enterprises repatriated AI workloads from public cloud. It also cites a February 2026 forecast that worldwide sovereign cloud IaaS spending will total $80 billion in 2026.
Chandra Khatri, LSI's founder and CEO, put the pitch this way: "Frontier labs give everyone the same model. We provide each enterprise its own customizable model, running on-premise and trained on its own private data."
Team, backers and availability
Khatri was Founding Head of AI at Krutrim, where he built India's first sovereign LLM in 2023. He also co-founded Got It AI, which built ELMAR and TruthChecker, a hallucination guardrails model that was acquired. He previously led AI initiatives at Uber AI, Amazon Alexa AI and eBay Research. LSI says its founding security team has discovered hundreds of critical CVEs for major organizations and national intelligence agencies.
The pre-seed round is backed by investors and angels who have led AI and security at OpenAI, CrowdStrike, SentinelOne, Zscaler, Commvault and Gruve AI. Lu Zhang, Founder and Managing Partner of Fusion Fund, called LSI "the natural next step" in Khatri's career.
LSI-Offense-1 and LSI-Defense-1 are available now to a limited number of design partners, including security vendors, MSSPs and certain Fortune 500 enterprises. Deployment options are air-gapped, on-prem, sovereign or managed. Access can be requested at lsi.inc. The source does not disclose the size of the funding round or pricing.
