Refresh Security LLM performance matrix with September 2026 results

[dhru42]

Summary

Refreshes the Large language model performance matrix for {{elastic-sec}} with the September 2026 evaluation results.

This is a data-only change. Only the two :::{table} blocks (Proprietary models, Open-source models) are replaced. The intro, the {important} callout and its ≤ 5 "not recommended" threshold, "How the scores are calculated", the sub-capability definitions, the methodology link, and all section anchors are unchanged.

Closes #8548.

What changed

• Added (11 models):
  • Proprietary: Anthropic Claude Opus 5, Anthropic Claude Opus 4.8, Anthropic Claude Sonnet 5, OpenAI GPT-5.5, OpenAI GPT-5.6 Terra, OpenAI GPT-5.6 Sol, OpenAI GPT-5.6 Luna, Google Gemini 3.6 Flash, Google Gemini 3.5 Flash Lite
  • Open-source: Z.ai GLM 5.3, Qwen 3.8 2.4T A95B
• Removed (2 models): OpenAI GPT-4.1 and OpenAI GPT-4.1 Mini were not part of this run.
• Re-scored: every remaining model has new values, so both tables were replaced wholesale. Both stay sorted by Overall Score, descending.

Corrections relative to the tables in #8548

The pasted tables in the issue body had four mistranscribed rows. This PR uses the values from the source evaluation spreadsheet:

Model	Column	Issue body	This PR (source)
OpenAI GPT-5.5	Threat Hunting / Multi-Step Executions	8.00 / 7.00	7.00 / 8.00
OpenAI GPT-5.6 Sol	Attack Discovery / Automatic Migration	7.20 / 8.01	8.00 / 7.21
Google Gemini 3.5 Flash Lite	Detection Rules / Multi-Step Executions	6.00 / 8.00	7.00 / 7.00
Qwen 3.6 27B	Detection Rules / Multi-Step Executions	8.00 / 7.00	7.00 / 8.00

The Overall Agent Builder Score and Overall Score for these rows are the same in both versions, so the sort order does not change.

Verification

• Every row was checked against the source spreadsheet.
• For every row, Overall Agent Builder Score equals the mean of the seven sub-capabilities, and Overall Score equals the mean of Agent Builder, Attack Discovery, and Automatic Migration, to two decimals. The one exception is Kimi K2.6: its Overall Score computes to 6.06 from the displayed values, but the spreadsheet reports 6.05 because it averages unrounded sub-scores. We kept the spreadsheet value.
• "Gemini 3.5 Flash-Lite" in the source is written as Gemini 3.5 Flash Lite here, to match the existing Gemini 2.5 Flash Lite and Gemini 3.1 Flash Lite rows.

Test plan

• The preview build renders both :matrix: tables with 12 columns and no broken rows.
• Spot-check a few rows in the preview against [Internal]: Refresh the LLM Performance Matrix for Elastic Security with September 2026 results #8548 and the corrections table above.

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

2. If you answered "Yes" to the previous question, please specify the tool(s) and model(s) used (e.g., Google Gemini, OpenAI ChatGPT-4, etc.).

Tool(s) and model(s) used: Cursor (Claude Opus 5.5) to transcribe the spreadsheet into markdown and to check the averages.

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[github-actions]

🔍 Preview links for changed docs

• solutions/security/ai/large-language-model-performance-matrix.md

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 1 warning found

⚠️ Warnings (1): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
solutions/security/ai/large-language-model-performance-matrix.md	75	Elastic.Spelling	'Nano' is a possible misspelling.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[florent-leborgne]

LGTM. I wonder if we shouldn't put the date there for transparency with users. Because the list of models is "delayed" (we're just adding opus and sonnet 5 while 5.5 for both are out there - even if not in our tools yet - it could feel to users that the list, and the perf checks, are outdated)