Cyber incidents can be reported in many formats: structured threat indicator lists, social media posts, or full investigative reports. Narrative reports add valuable context, but they also tend to contain personal data and operational details that limit how freely they can be shared. De-identifying this kind of unstructured text is not straightforward.
Traditional text anonymisation typically works in two stages. First, a Named Entity Recognition (NER) model reads the text and identifies mentions of sensitive categories: person names, organisations, dates, locations, products. Second, a replacement module substitutes each detected mention with a pseudonym, a mask, or a hash. If the NER model misses a name, that name passes through unprotected. Everything downstream depends on that first detection step.
This is very important in cybersecurity where sharing these reports is a cornerstone of coordinated threat detection. Unfortunately, organisations may hesitate to do so because of confidentiality risks. A working text pseudonymisation pipeline could provide a path for letting incident data be exchanged and reused without exposing the people and organisations involved.
However, this pipeline assumes that all cyber incidents are documented in the same language. Cybersecurity terminology is coined almost exclusively in English. When it is applied to other languages, the translation is uneven: some terms are borrowed directly (“phishing”), others are paraphrased descriptively, and a single English term can have multiple equivalents. This makes it unrealistic to take an NER model trained on English cybersecurity text and expect it to work on Spanish reports out of the box.
To test this, researchers at Universidad de León, working within the EOSC SIESTA text anonymisation use case, built two annotated datasets under a shared entity scheme: BITÁCORA (1,007 Spanish cyber incidents, 9,052 entity spans) and CECILIA-NER-BILOU (880 English incidents, 10,692 spans). Three models were then evaluated: two multilingual generalists (mBERT and XLM-RoBERTa) and one cybersecurity-specific model (SecureBERT 2.0), pretrained on over 13.6 billion tokens of English security text [1].
Two results stand out. First, the multilingual model XLM-RoBERTa performed best across both languages (micro-F1 of 0.82 on Spanish, 0.78 on English). SecureBERT 2.0, despite its cybersecurity knowledge, collapsed to 0.53 on Spanish, scoring below even the non-specialised mBERT. This could mean that pretraining on English cybersecurity data alone does not just fail to help with Spanish; it appears to actively hurt performance in other languages.
Second, our experiments showed that cross-lingual transfer is lopsided: Training on English and testing on Spanish costs about 20% performance, in contrast to the other way, from Spanish to English, which costs 62%. This difference is partly because Spanish cybersecurity texts borrow a lot of English vocabulary, while Spanish syntactic patterns and paraphrases simply have no equivalent in English incident text.
For cybersecurity organisations working in Spanish, substituting Spanish-trained models with off-the-shelf English NER tools may not be a reliable alternative. Multilingual models are a better alternative, but the best results come from models that have been trained on annotated cyber incident reports in the target language. BITACORA is a first step toward filling that gap for Spanish, and it is being integrated into the text anonymisation pipeline developed within EOSC SIESTA. With over 600 million Spanish speakers worldwide, closing this resource gap is urgent.
[1] Haughton et al., “Breadth Over Depth: Why Domain Specialisation Without Multilingual Pretraining Fails for Bilingual Cybersecurity NER,” in Proc. XI JNIC, 2025.