AuditBench - Lab Lateral Movement: leaderboard
AuditBench (2026) evaluates LLMs on security investigations over system audit logs read in 400-line chunks. This board is the F1 score (0 to 100) for finding the log lines of lateral movement in the 5 attack scenarios of the Lab data (Linux and Windows audit logs recorded by the benchmark authors). Higher is better.
Metric: F1 (0-100) for lateral-movement identification on the Lab data (Linux and Windows audit logs recorded by the authors) (5 attack scenarios): the model reads the scenario's edge-representation (provenance-graph edges, 400-line chunks) audit logs in chunks with prompt v2 and flags the log lines of the lateral movement; recall counts the attack scenarios found and precision counts false-positive log lines; temperature 0 where available (GPT-5 models at the default medium reasoning effort); higher is better. Source: arxiv.org. Saturation forecast: Not forecast. 5 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Llama 4 Maverick | 62 | #1099 |
| 2 | GPT-5 Mini | 57 | #348 |
| 3 | Gemini 2.5 Flash | 48 | #453 |
| 4 | Gemini 2.5 Pro | 45 | #266 |
| 5 | GPT-5 | 33 | #167 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=auditbench-lab-lateral-movement · How It Works · Data refreshed daily, snapshot 2026-11-13.