
Claude Mythos: what an AI model that finds software flaws means for your security
What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.
Comparison
This comparison is for management boards, CFOs and IT managers who have to decide where AI should run in their company. We explain what really happens to data in cloud AI services and when your own servers make sense. We also show what the cost of each option is made up of and what questions to ask the provider.

AI in the cloud means that the model runs on the provider’s servers, such as those of Microsoft, Google, OpenAI or Anthropic. The company sends a query, gets an answer and pays for usage or for a per-user licence. The provider takes care of hardware, updates and availability.
AI on your own servers, or on-premise, means that the model runs in the company’s server room or on hardware rented exclusively for it. Data does not leave infrastructure the company controls. In return, the company bears the full burden of the hardware and its maintenance.
On your own servers, you run open-weight models, i.e. models whose files the developer makes available for download. They include models from the Llama, Mistral, Qwen and gpt-oss families. The most powerful models from OpenAI, Anthropic or Google are available only in the cloud.
Between these two extremes there is an intermediate option: a dedicated cloud environment, for one company only, in a chosen region. Data in it is encrypted with keys managed by the company, not the provider. For many companies, this is a sensible compromise.
The most common fear is: “our data will be used to train the model and end up with our competitors”. In the business versions of the major providers, the terms differ from those of free consumer apps. However, it is worth checking them in the documentation rather than assuming.
For example, Microsoft states that in the Microsoft Foundry service, prompts and responses do not go to OpenAI and are not used to train models without the customer’s consent. In the Data Zone option for a service deployed in an EU country, processing takes place only in EU member states.
You also need to know the exceptions. Microsoft retains some prompts for a period of time to detect abuse. Customers have the right to apply for these rules to be changed. So the cloud is neither automatically safe nor automatically off-limits.
GDPR does not require data to be processed only in the EU. It allows transfers outside the European Economic Area with appropriate safeguards, described in Chapter V. The basis is a data processing agreement with the provider and checking where the data is processed.

The table below compares the three options on the criteria that most often drive the choice. No option wins on every criterion – there is always a trade-off.
Note the last row. Your own servers are easier to show to an auditor, but they do not ensure regulatory compliance on their own. A poorly secured server in the company can be more dangerous than a well-configured cloud service.
| Criterion | Business cloud service | Dedicated cloud environment | Own servers (on-premise) |
|---|---|---|---|
| Where the data is | With the provider, in a chosen region, e.g. the EU | With the provider, in the company’s dedicated environment | Only in the company’s infrastructure |
| Time to launch | Days or weeks | Weeks | Months: buying hardware, configuration, testing |
| Upfront cost | Low, no hardware purchase | Medium | High: servers, graphics cards, cooling |
| Running cost | Grows with the number of queries | Fixed fee for resources plus usage | Mainly fixed: energy, people, servicing |
| Access to the best models | Full | Usually broad | Open-weight models only |
| Skills needed | Configuration, security, integrations | As for the business cloud, plus managing your own cloud environment | Maintaining servers and graphics cards, model updates, on-call duty |
| Dependence on the provider | High: prices, model retirement | Medium | Low, but the company is responsible for everything itself |
| Demonstrating control over data | Based on the provider’s contracts and certifications | Easier thanks to the separation | Easiest, provided the servers are well secured |
Your own AI infrastructure is a serious investment and an ongoing commitment. It makes sense when at least one of the conditions below is met and the company has people to maintain it.
If none of the conditions applies to you, your own servers usually mean higher costs and weaker models. In that case, it is better to invest in a good cloud configuration and well-ordered permissions.

The question is not “cloud or own servers”, but “which data can go where”. The answer usually points to the solution by itself.
The cloud wins when quick deployment and answer quality matter, and data may be processed by the provider under a contract. That is the situation of most mid-sized companies starting with an assistant for employees, enquiry handling or work with documents.
The second reason is uncertainty about scale. If you do not yet know in which processes AI will prove useful, buying servers “just in case” is an expensive bet. The cloud lets you measure actual usage and only then work out whether your own hardware would pay off.
The third is model quality. If a process involves long documents, multi-step reasoning or working with images, cloud-only models usually perform better. It is worth checking the difference on your own examples before deciding.
The most common mistake is comparing the price of a graphics card with the price of a query in the cloud. The full cost of your own servers includes many more items, and the cloud cost also has elements that are easy to overlook. You will find both lists below.
Hardware is sized to the model. A simple calculation: a model with 70 billion parameters stored in 16 bits, i.e. 2 bytes, needs about 140 GB of memory for the parameters alone. That is more than the 80 GB in a single NVIDIA H100 SXM card, so you need at least two cards or model compression, i.e. storing the parameters at lower precision.
For a monthly comparison, set the cloud bill against the sum of hardware depreciation, energy, cooling and staff time for maintenance. AI hardware is best depreciated over a short period, because models and cards age quickly. Your own servers only pay off when this sum is consistently lower than the cloud bill.
Many companies do not choose one option but combine both. The most sensitive data is processed by a model on their own servers, while other tasks go to the cloud, where the best models are available.
Take a hypothetical advisory firm with 120 people. Analysis of client documents covered by professional secrecy runs on an open-weight model on a server in the firm. Writing marketing copy and searching public regulations takes place in the cloud.
Such a set-up requires discipline. Without clear rules on which data goes where, and without a shared log of queries, two separate worlds quickly emerge that nobody controls. The conditions that must be met are listed below.
Whichever option you choose, ask for written answers to the questions below. The lack of a clear answer to any of them is a sign that you need to dig deeper.
Put the answers for all offers in a single table. That makes it easier to see which one only looks cheaper because it leaves out some of the costs or risks.
Related topics in the knowledge base
FAQ
The questions management boards and IT departments ask most often when choosing where AI should run.
About this page
Sources
About the author
Kacper Włodarczyk
CEO of ALGORCOMP
Kacper specializes in implementing Microsoft 365 Copilot, Copilot Studio, Power Platform (Power Automate, Power Apps, SharePoint) and AI agents for mid-sized B2B companies in Poland. He leads dozens of projects covering AI strategy, Power Platform governance, document workflow automation and sales processes. In his writing he focuses on the practical side of AI adoption in organizations — from the first proof of concept to company-wide rollout — with particular attention to data security, compliance (GDPR, NIS2, the AI Act) and return on investment.
Meet the teamIn a free consultation, we will help you divide your data into classes and match each class to a place of processing, before any decisions on hardware or contracts are made.
Featured

What Claude Mythos is, who can use it, what the June suspension of access taught us and what a mid-sized company should change in its security.

What a vCISO does, what Poland’s new National Cybersecurity System Act requires of companies, when this model pays off, and when a full-time hire or a good IT provider is the better choice.

A comparison of an external and an in-house head of information security: what the Polish KSC Act says, how to calculate the cost of each model and when each one makes sense.