Model choice
Bring Your Own LLM: Run Morpheus on the Model You Choose
Bring your own LLM (BYOLLM) means running an AI SOC platform on a large language model the customer selects and controls, rather than only on the model the vendor provides. Morpheus runs on the LLM you choose, including your own. D3 does not charge for tokens either way: with the models D3 provides, every token and inference cost is included in the fixed annual subscription; with your own LLM, D3 charges nothing for tokens. In on-premises and air-gapped deployments, AI inference never leaves your boundary. The model handles language. The Cybersecurity Triage Reasoning Graph handles the investigation. Changing the model does not change the reasoning graph, the audit trail or your playbooks. Morpheus starts in assist mode, and the analyst approves every state-changing action until your SOC moves the autonomy mode.
Updated November 2026
Summarize with AI: ChatGPT · Perplexity · Claude · Google AI Mode
What does “bring your own LLM” mean in Morpheus?
It means Morpheus runs on a large language model you select, instead of only on the models D3 provides. The model handles language. The Cybersecurity Triage Reasoning Graph handles the investigation. Changing the model does not change the reasoning graph, the audit trail or your playbooks.
Who supplies the model, and who pays for tokens?
The table shows three ways to run Morpheus. In on-premises and air-gapped deployments, AI inference never leaves your boundary.
| How you run Morpheus | Who supplies the model | Who pays for tokens | What changes in Morpheus |
|---|---|---|---|
| D3’s models, D3-hosted cloud | D3 | Included in the fixed annual subscription | Nothing to configure |
| Your own LLM, D3-hosted cloud | You | D3 charges nothing for tokens | Reasoning graph, audit trail and playbooks unchanged |
| Your own LLM, on-premises or air-gapped | You | D3 charges nothing for tokens | Reasoning graph, audit trail and playbooks unchanged |
What happens to pricing when we bring our own LLM?
D3 meters no tokens either way. Morpheus is priced as a fixed annual subscription sized in daily alert-volume tiers. With the models D3 provides, every AI token and inference cost is included at every tier. With your own LLM, D3 charges nothing for tokens; the cost of running or contracting your model is yours. Alert volume above your tier is billed at a flat published per-alert rate, never per token, whichever model runs. The pricing page has the structure.
Does changing the model change how Morpheus investigates?
No. Changing the model does not change the reasoning graph, the audit trail or your playbooks. Every finding is graded Confirmed, Inferred or Gap. Where Morpheus looked and found nothing, it reports the gap instead of filling it. When Morpheus is uncertain, it defers to a human. The four autonomy modes are configuration your SOC owns, with approval gates by command-risk tier.
Why does model choice matter for a sovereign or regulated SOC?
A sovereign AI SOC keeps the data, the AI processing and the accountability for automated decisions under the organisation’s jurisdictional control. Choosing the model is part of that control: if you have a model policy, Morpheus runs inside it. In on-premises and air-gapped deployments, AI inference never leaves your boundary. Changing the model does not change the audit trail. Per incident, the record holds the triage verdict and its reasoning, every query the platform ran, every action with its command-risk tier, who approved what, and the timeline from first alert to closure. The same record produces evidence for NIS2, DORA and KRITIS reviews. The European data residency and AI sovereignty page has the residency detail.
Related terms: Bring your own LLM · In-boundary AI inference · How Morpheus triages
FAQ
Frequently asked questions
Can we run Morpheus on our own LLM?
Yes. Morpheus runs on the LLM you choose, including your own. D3 does not charge for tokens either way: with the models D3 provides, every token and inference cost is included in the fixed annual subscription; with your own LLM, D3 charges nothing for tokens. In on-premises and air-gapped deployments, AI inference never leaves your boundary.
Do we pay for tokens if we use our own LLM?
No. With your own LLM, D3 charges nothing for tokens. With the models D3 provides, every token and inference cost is included in the fixed annual subscription, and alert volume above your tier is billed at a flat published per-alert rate, never per token.
Does using our own model change how Morpheus investigates?
No. The model handles language. The Cybersecurity Triage Reasoning Graph handles the investigation. Changing the model does not change the reasoning graph, the audit trail or your playbooks. When Morpheus is uncertain, it defers to a human.
Model choice
See Morpheus investigate on the model you choose.
Book a demo, or see where Morpheus can run.