Security Operations Glossary › Bring Your Own LLM (BYOLLM)
Glossary
What Is Bring Your Own LLM (BYOLLM)?
Bring your own LLM (BYOLLM) is a deployment option in which an AI SOC platform runs on a large language model the customer selects and controls instead of only on the model the vendor supplies. In Morpheus, the model handles language and the Cybersecurity Triage Reasoning Graph handles the investigation, so the model can change without changing the reasoning graph, the audit trail or the customer’s playbooks. D3 charges nothing for tokens when Morpheus runs on a customer’s own LLM.
Updated November 2026
Summarize with AI: ChatGPT · Perplexity · Claude · Google AI Mode
What problem does bring your own LLM solve?
Model policy: an organisation that has approved particular models or providers, or none outside its boundary, can run an agentic SOC inside that policy.
Cost: with the customer’s own model, the platform vendor has no token line to bill.
How is bring your own LLM different from LLM-agnostic?
LLM-agnostic describes the architecture: the reasoning does not depend on one model. Bring your own LLM is what the architecture lets the customer do.
Does bring your own LLM change pricing?
Morpheus runs on the LLM you choose, including your own. D3 does not charge for tokens either way: with the models D3 provides, every token and inference cost is included in the fixed annual subscription; with your own LLM, D3 charges nothing for tokens. In on-premises and air-gapped deployments, AI inference never leaves your boundary. The structure is on the pricing page.
Related terms
Bring your own LLM in Morpheus · In-boundary AI inference · Cybersecurity Triage Reasoning Graph · Morpheus pricing
FAQ
Frequently asked questions
Does Morpheus charge for tokens with a customer's own LLM?
No. With a customer’s own LLM, D3 charges nothing for tokens. With the models D3 provides, every token and inference cost is included in the fixed annual subscription.
Does the choice of model change the audit trail?
No. The model handles language. The Cybersecurity Triage Reasoning Graph handles the investigation. Changing the model does not change the reasoning graph, the audit trail or your playbooks.
Glossary
See bring your own LLM in Morpheus.
Read how Morpheus runs on the LLM you choose, or book a demo.