Infracodebase LabsResearch preview
Vesper
Purpose-built models for high-quality security and compliance judgements over infrastructure code. Designed to verify every change at every commit, privately.
Code is getting faster to create. Governance is falling behind.
Capable language models and agents can investigate configurations and assess requirements. Repeating that across hundreds of requirements and repositories takes time and compute, and that costs money.
Those costs create pressure to check less often. As teams scale with AI, coverage is the first thing to slip.
Vesper changes the approach. Instead of asking a general-purpose LLM to make every decision, Infracodebase uses models we built specifically for security judgements over infrastructure code. That makes thorough, frequent evaluation practical at enterprise scale.
What Vesper does
Vesper is being trained to advance the state of the art in verification over infrastructure code. Each evaluation comes down to three jobs.
Interpret the requirement
Work out how a security or compliance requirement applies to a specific configuration.
Decide if it is satisfied
Return a verdict on whether the configuration meets the requirement.
Know when to ask
Recognize when the code alone can't answer the question and more evidence or human judgment is needed.
Not a chat model. A decision model.
General-purpose models are built to talk about anything. Vesper is built to make one kind of decision: security and compliance judgments over cloud infrastructure code. That changes what it reads, what it returns, and how much you can trust the answer.
Built for one job
Vesper is designed for security and compliance decisions over cloud infrastructure code, and nothing else. That focus is what lets it be accurate, small, and fast.
Context in, verdict out
Vesper reads your rules, docs, and code and returns a structured verdict in a single pass. No prose to generate, nothing to parse.
Only five possible answers
Pass, fail, inconclusive, not applicable, or not code-verifiable. Vesper never invents an answer outside them, so software can act on every verdict.
Says how sure it is
Every verdict carries a probability, and Vesper says plainly when the code can't answer the question instead of guessing.
Fast calls, careful review
Vesper makes the quick judgment on every change. Deterministic checks and your reviewers take the cases that need more.
Small enough to run privately
A focused model doesn't need a frontier-sized footprint. Vesper is designed to run in a dedicated tenant or inside your own cloud.
Built to work alongside deterministic checks
Infracodebase already runs deterministic policy checks that verify agent output in code. Vesper is being developed to augment them. Together they support a workflow where every commit is evaluated, violations surface early, and open questions reach a reviewer with the relevant context.
100x cheaper
Our goal for the cost of each judgement compared with general-purpose LLMs: under a penny, so coverage doesn't shrink as your AI-written code grows.
150x faster
Our goal for verdict speed: tens of milliseconds per decision, so every requirement can run on every commit.
Fully private
Small enough to run in a dedicated Infracodebase tenant or inside your own cloud infrastructure. Your code never leaves the boundary you choose.
Early results
Verdict accuracy on IaC-Bench, our benchmark of infrastructure codebases the models never saw during training.
- VesperMeasured85%
Our current release candidate, small enough to run almost anywhere.
- Leading commercial decision modelComparison71%
Evaluated on the same judgements.
- Launch targetTargetabout 95%
The accuracy on real codebases we are building toward for launch.
What's shaping the work
Our focus is trust and safety, so getting this right matters. Three lessons guide how we build Vesper.
Trust starts with the data.
Requirements and expected decisions need careful validation. Models learn incorrect assumptions as readily as correct ones.
Missing evidence needs explicit treatment.
Reliable verification has to tell a violation apart from a question the available code cannot answer.
Full assessments of real codebases determine readiness.
Infrastructure projects with thousands of lines of code are harder for decision models to classify correctly. Closing that gap in current state-of-the-art models is the work.
Verification that runs continuously, no matter who writes the code.
Vesper is a research preview and isn't available in Infracodebase yet. We're expanding our datasets across infrastructure languages and plan to publish a benchmark so others can evaluate the work.
Want to follow along or talk about your verification needs? We'd like to hear from you.
Talk to us