Data

CyberQA

2026ResearchPublished: 2 September 2026Updated: 2 September 2026Published

Key innovation

Introduces trustworthy cybersecurity question-answering data via an answer-first strategy in which answers come only from verifiable sources (execution results, structural code facts, authoritative reports) rather than model generation.

How it works

1) Answer-first: an answer is first fixed from a trusted source — execution-derived results (crashes, tests), structure-derived code facts (changed functions, call graph), or text from authoritative reports. 2) The language model turns the remaining context into a question and rephrases the answer. 3) An LLM-based judge verifies each sample: whether the answer traces back to and matches the source, is not leaked in the question, and whether the question identifies a unique answer. 4) Ambiguous/invalid samples are regenerated once or discarded. The resulting QA pairs enter the common training pipeline for the OpenAegis model.

Problem solved

Language models answering cybersecurity questions frequently hallucinate or produce unverifiable claims. CyberQA addresses the lack of trustworthy, verifiable QA data by grounding every answer in a trusted, traceable source instead of relying on model generation.

Evolution

Original paper · 2026 · arXiv preprint (2026) · Jian Yang

CyberFactory: Scaling Cyber Security Capabilities with Instances from the Wild

Jian Yang, Haau-Sing Li, Shawn Guo, Zixi Zhao, Yibo Tan, Jiajun Wu, Aishan Liu, Zhoujun Li, Xianglong Liu, Tianyu Zheng, Bryan Dai, Chengran Yang, Weifeng Lv

2026

CyberQA introduced in the CyberFactory paper

Inflection point

CyberQA defined as one of CyberFactory's three task domains; QA data built answer-first and used to train OpenAegis.

Sources

CyberFactory: Scaling Cyber Security Capabilities with Instances from the Wild (arXiv)

Paper

arXiv

Paper defining CyberQA as a question-answering task domain.