Having done a fair bit of infra attribution work, the thing I'd want to know is how it handles stale data. Pivoting on certs and WHOIS is easy, knowing a host moved three months ago is the hard part.
better local performance from a fine tuned model, don't need to use a cloud instance? Avoids guardrails on cloud instances? and yes, you can plug the model into your own harness?