Introducing Infracodebase Labs and Vesper

Today we're introducing Infracodebase Labs and giving a first look at Vesper, our family of specialized decision models for cloud infrastructure security and compliance.

We're building Vesper to advance the state of the art in verification over infrastructure code, with the speed and efficiency needed to evaluate every change at every commit.

Governance is falling behind

Code is getting faster to create, and governance is being left behind. Capable language models and agents can investigate configurations and assess requirements, but repeating that process across hundreds of requirements and repositories takes time and compute. Time multiplied by compute is money.

Those costs create pressure to check less often. As teams scale with AI, coverage is the first thing to slip.

Purpose-built models, not general-purpose LLMs

Vesper changes the approach. Instead of asking a general-purpose LLM to make every decision, Infracodebase will use models we built specifically for high-quality security judgements over infrastructure code.

Vesper's job is to:

• Interpret how a security or compliance requirement applies to a configuration
• Determine whether the requirement is satisfied
• Recognize when more evidence or human judgment is needed

Our goal is to make these judgements 100x cheaper and 150x faster for our customers, so that as they scale with AI they don't have to give up coverage. We're targeting millisecond-level verdicts.

Vesper is also designed to be fully private. The models are small enough to run in a dedicated Infracodebase tenant or inside a customer's own cloud infrastructure.

How it fits into Infracodebase

Infracodebase already runs deterministic policy checks that verify agent output in code. We're developing Vesper to augment those checks. Together, they support a workflow where every commit is evaluated, violations surface early, and unresolved questions reach a reviewer with the relevant context.

Early results

Early results show meaningful progress:

• 2B parameters: agreement with expected verdicts improved from 59% before fine-tuning to about 80%, across thousands of held-out evaluations covering requirements unseen during training.
• 4B parameters: approaching 90% in early checkpoint samples. The full evaluation is in progress.
• 9B parameters: what we're building toward, targeting over 95% agreement at launch.

Three lessons shaping the work

Our focus is on trust and safety, so getting this right matters.

Trust starts with the data. Requirements and expected decisions need careful validation. Models learn incorrect assumptions as readily as correct ones.

Missing evidence needs explicit treatment. Reliable verification has to distinguish a violation from a question the available code cannot answer.

Full assessments of real codebases determine readiness. Our initial test cases show that infrastructure projects with thousands of lines of code are harder for decision models to classify correctly. Closing those gaps in current state-of-the-art models is the work.

What's next

Vesper is a research preview and isn't available in Infracodebase yet. We're expanding our datasets across infrastructure languages and plan to publish a benchmark so others can evaluate the work.

Infracodebase Labs is investing in a future where thorough security and compliance verification runs continuously throughout cloud delivery, no matter which person or agent writes the code.

We couldn't be more excited about this launch, and there's much more to come. Learn more on the Labs page.