Open, reproducible evaluations for security-focused foundation models, from vulnerability localization to agentic cyber-capability testing.