Cybersecurity

Why Mistral and Qwen are an answer to cybersecurity challenges

To defend a system, you must be able to simulate the attacker. Yet the major proprietary American models contractually prohibit much of that work — and can see everything your teams submit to them. Ministral and Qwen, operated with us or on your premises, have neither of those limits.

The problem — scissors in the toolbox

The acceptable use policies of proprietary models typically prohibit analysing malicious code, generating attack scenarios, assisted penetration testing or phishing simulation — even when it is your own system you are testing, with every authorisation in place. In practice, this translates into:

unpredictable refusals to respond in the middle of a defence exercise;
non-negotiable filters, defined by a foreign vendor according to its law and its priorities, not yours;
a risk of account suspension in the middle of a security audit;
and most seriously: your malware samples, incident reports and weaknesses pass through a third party’s servers — the exact map an adversary would dream of obtaining.

The comparison, side by side

Proprietary US API

Your security team
“analyse this ransomware”, “draft a phishing exercise”

↓ the request goes to the vendor, who reads it ↓

The vendor’s usage filter
a policy defined abroad, changeable without notice

↓ three possible outcomes ↓

Refusal to respond · account flagged or suspended · your defence scenarios archived with a third party

Ministral / Qwen, on-premise or at europeanGPU

Your security team
same exercises, same samples

↓ the request stays within your perimeter ↓

Ministral or Qwen on infrastructure you control
no filter imposed by a foreign vendor, no telemetry

↓ governed by YOUR rules ↓

Internal charter, European law, logging on your side: the exercise runs to completion, in total confidentiality

What your teams can finally do

Red team

Simulate the adversary

Generate realistic attack scenarios, exercise phishing campaigns and complete intrusion chains — with no refusal halfway through the exercise.

Blue team / SOC

Analyse the malicious

Dissect malware, obfuscated scripts and real phishing emails, and write detection rules — without exfiltrating your samples to a third party.

Governance

Keep hold of the rules

Your usage charter and European law govern the tool — not the revocable, extraterritorial terms and conditions of a foreign vendor.

Freedom does not mean the Wild West: these uses remain governed by the law and by your internal policies. The difference is that the referee is European — and you are the one holding the whistle.

“You cannot build a serious defence with a tool that refuses to talk about the attack — and reports your weaknesses to a third party.”

— Why cyber teams choose open-weights

A cyber use case to scope?

Shared endpoint, dedicated instance or on-premise deployment at your site: let’s discuss it with your CISO. And for the basics, see why Mistral and Qwen are champions of sovereignty →

Book a meeting