xtools-at/Qwensploit-V2-9B-CyberSecurity-Qwen3.5

🛡️ Qwensploit V2 9B - Cybersecurity & Red Team

The next iteration of the Qwensploit series. More data, better data selection, and a much stronger emphasis on consistency.

Qwensploit V2 9B is a cybersecurity-focused fine-tune built on top of xtools-at/Qwen3.5-9B-Claude-3xMerge-UNCENSORED-heretic.

It continues the original Qwensploit project, bringing together cybersecurity domain knowledge, offensive security expertise, structured reasoning, and general technical problem-solving in a relatively compact model.

The primary goal is to create a capable everyday assistant for cybersecurity professionals, penetration testers, red-team operators, vulnerability researchers, and security enthusiasts.

All variations: 27B | 9B | 4B | 2B | 0.8B

Looking for GGUFs or other Quants? Click here

✨ What's new in V2?

One of the main lessons from the original Qwensploit release was that model quality is only as good as the data used to train it.

V1 showed some noticeable inconsistencies in its responses. After investigating these issues, we traced a significant portion of them back to the training data itself. Dataset quality, source composition, and the suitability of individual examples turned out to matter considerably more than simply increasing the number of training samples.

For V2, we decided to take a much more deliberate approach:

Every selected dataset was manually split, inspected, cleaned, and rigorously filtered before being included in the training mixture. We focused on substantial, established cybersecurity repositories on Hugging Face, but deliberately avoided treating dataset size as a substitute for quality.

We also became more selective about what kind of information belongs in fine-tuning data. For example, large collections of raw CVE records and exploit references can be useful knowledge sources, but are often better suited to retrieval-augmented generation (RAG) than directly teaching a model how to reason through security problems.

The result is a considerably expanded training mixture with a stronger emphasis on useful instructions, technical explanations, security reasoning, and practical knowledge.

🎯 Intended use

Qwensploit V2 is intended to assist with:

• Authorized penetration testing and red-team exercises.
• Vulnerability research, analysis, and triage.
• Web application and infrastructure security.
• Secure coding, code review, and debugging.
• CTF challenges and security education.
• Defensive security, threat analysis, and incident response.
• Technical cybersecurity discussions and structured problem-solving.

It is designed as an assistant for research and analysis, not as an autonomous penetration-testing agent. Generated commands, code, and security recommendations should always be reviewed before being used in a real environment.

📚 Training data

The training mixture combines two broad categories: cybersecurity domain knowledge and general reasoning data.

The selected sources were chosen for their relevance, diversity, and potential to improve practical cybersecurity assistance.

🔐 Cybersecurity domain knowledge

Dataset	Samples	Description
PentesterFlow/OffsecCyber	2,000	Primarily the Elite V2 and HackerOne subsets, providing offensive web-security knowledge, vulnerability analysis, and bug-bounty-oriented examples.
ChaoticNeutrals/Cybersecurity-ShareGPT	2,000	A sampled collection of cybersecurity conversations in ShareGPT format, providing varied technical questions and answers.
Voidreaper2026/cybersec-master-dataset	1,000	Exclusively sampled from the Kali and Vulners subsets, focusing on security tools and vulnerability intelligence.
Trendyol/Trendyol-Cybersecurity-Instruction-Tuning-Dataset	2,500	A broad defensive-security instruction dataset covering security operations, threat intelligence, incident response, and specialized security domains.
saidutta69/CyberSec-Reasoning-Premium	1,600	Carefully selected examples from the dpevzner, Kimi cyber-reasoning, and vulnerability diagrammatic reasoning subsets, with individual entries thoroughly inspected and cleaned.
Internal synthetic cybersecurity dataset	2,300	Custom Gemini 3.5 Pro-generated examples spanning 16 cybersecurity domains, featuring extensive synthetic reasoning traces and additional domain-specific coverage.

Large collections of CVE, ExploitDB, advisory, and other vulnerability-related records, have been intentionally excluded for this fine-tuning mixture. For large, continuously updated factual repositories such as CVE and ExploitDB, RAG is generally a more suitable approach than attempting to teach the model to memorize the underlying records via SFT.

🧠 Reasoning and general intelligence

Cybersecurity expertise alone is not enough. A useful security assistant also needs to understand complicated instructions, break down unfamiliar problems, and communicate technical conclusions coherently.

We therefore included a smaller selection of general reasoning datasets:

Dataset	Samples	Description
saidutta69/qwen3.8-max-distillation-50k-clean	1,500	A cleaned reasoning and instruction-following distillation dataset originating from Qwen3.8-Max outputs, used to strengthen general analytical and problem-solving capabilities.
xtools-at/Claude-Haiku-5.5-High-Reasoning-TraceInversion-3000x	1,500	A reasoning-distillation dataset combining Claude Haiku 5.5 responses with synthetic reasoning traces reconstructed through trace inversion.

📊 Dataset overview

Category	Selected samples
Cybersecurity domain knowledge	11,400
General reasoning	3,000
Total training samples	14,400
Additional evaluation data	5% proportional holdout

The dataset selection represents 14.4K+ training examples, with a separate evaluation set reserved for monitoring generalization. The evaluation set was sampled proportionally from the same source mixture and kept separate from the training data.

⚙️ Training configuration

Parameter	Value
Training method	16bit LoRA SFT
Epochs	1
Training samples	14,400+
Evaluation split	+5% proportional holdout
Maximum context tokens	8,192
Learning rate	2e-4
Micro-batch size	4
Gradient accumulation	8
LoRA rank	16
LoRA alpha	32
LoRA dropout	0.02
Optimizer	AdamW 8-bit
LR scheduler	Linear
Weight decay	0.01
Warmup	5%

📈 Training results

Training loss	Evaluation loss
0.835	0.875

Loss alone does not establish cybersecurity accuracy, practical effectiveness, or safety; independent task-based evaluations are necessary.

⚠️ Limitations and responsible use

Qwensploit V2 is an experimental cybersecurity fine-tune and should not be treated as an authoritative security reference.

• It may produce incorrect vulnerability assessments, commands, code, or remediation advice.
• Synthetic training data and reasoning distillation can introduce inaccuracies or biases.
• Security knowledge can become outdated as tools, vulnerabilities, and defensive practices evolve.
• Generated code and commands should be reviewed and tested in controlled environments.
• Offensive-security capabilities should only be used against systems for which explicit authorization has been granted.

The model is intended for legitimate cybersecurity research, education, defensive security, and authorized red-team activity. It is not intended to facilitate unauthorized system access, credential theft, malware deployment, or destructive activity.

📜 Licensing

The training mixture incorporates datasets with varying licensing terms and usage restrictions.

• Cybersecurity-ShareGPT: Listed as other on Hugging Face; no specific license or explicit redistribution terms are provided in its dataset card.
• Reasoning datasets and internal synthetic data: May be subject to competitive-training restrictions under their respective source or provider terms.

Users should review the original dataset licenses and applicable terms before commercial use or redistribution. The base model's license does not automatically extend to third-party training data or grant unrestricted rights to the complete training mixture.

🙏 Acknowledgements

Thanks to the Qwen team, the creators of the models and datasets listed above, and the wider cybersecurity and open-source communities.

V2 follows the same basic idea that started the Qwensploit series: a compact model can be a genuinely useful cybersecurity companion when its domain knowledge, reasoning capabilities, and training data are carefully selected.

---

🛡️ Better selection. Better supervision. Better security reasoning.