How Frontier AI Models Are Reshaping Cyber Defense

There is significant activity going on in the world of AI and cybersecurity, and we're going to take a look at it right now. The latest news is the newest frontier models are being restricted by governments because they are too potentially dangerous. Is it true? Yes, yes it is. We're going to get into why. So let's get into the latest details of Anthropic's Mythos and how it's changing the rules of cybersecurity. First thing we need to understand Methos and these new models do 3 things really well. First off, they are able to identify vulnerabilities in software, firmware, hardware. The second thing is they're able to create exploits to take advantage of those vulnerabilities. Think of it as attack code that can go off and actually victimize people through the exploitation of vulnerabilities. The third thing it does is these models can string together vulnerabilities, including low and moderates, in a way that humans can't easily comprehend. Therefore, we don't really defend or think there's a problem, but they can chain the vulnerabilities together to create something that cumulatively speaking represents a high or critical vulnerability. So that's what these new models do. Now, when Metasploit Preview came out, they were able to identify lots of vulnerabilities. And when the first 50 partners, it was open to only 50, they were able to find over 10,000 high and critical vulnerabilities. And to keep that in mind, for all of 2025, we really only found about 50,000 vulnerabilities in totality, critical, high, moderate, low. So we only had 50,000, and the first 50 partners within a short period of time found 10,000 critical and high. Now, to what scale are we really talking about? Well, let's give an example here. Mozilla, the creator of Firefox browser, very popular browser, it used the older version of Opus 2.6, and it was able to find 22 vulnerabilities where it patched its software. When it got included into the 50 partners that had access to Mythos Preview, it again used Mythos to see if there were any vulnerabilities. Mythos detected 271 additional vulnerabilities. That's an order of magnitude more. And this is really what we're seeing. And if those numbers hold true, we may see 2025, less than 50,000, whereas the next 12 months, we may see half a million vulnerabilities discovered in software, operating systems, web browsers, you name it, including hardware and firmware. So the problem that we have is we've got attackers that are constantly trying to identify, discover vulnerabilities, and then they have to spend the time to create exploits to take advantage of those vulnerabilities. And once those are created and tested, then they can deploy or attack them using them. And that window typically has been a good amount of time, more than 30 days. And so if we look at how the industry has adopted managing patches over the years, we can take Microsoft as a great example. And they have what has been coined Microsoft Patch Tuesday. And this is a certain cadence. It's the second Tuesday of every month. And essentially, Microsoft identifies all the vulnerabilities, builds patches, tests for them, bundles it all together, and then on the second Tuesday of the month, pushes it out to users, which often causes a reboot or a restart. This cadence of once a month works perfectly well when the window of time that attackers need to identify the vulnerability, build the exploit, and attack is longer than that month. Essentially, Microsoft can get the patches in place before the attackers have the ability to actually go out and cause harm. And this works well. This is why we've had Microsoft Patch Tuesday for a long time. But when we look at the trend of data, and this is actually from zerodayclock.com, they've got a bunch of different charts out there that you can take a look at. When we look at 2024, the average time was 56 days from vulnerability to exploitation. And again, Microsoft patches within that 30-day timeline, we were fine. When we get into 2025 though, what we saw towards the end of the year is the attackers were able to get inside that 30-day window. And for 2025, it averaged 23 days. 3 days from vulnerability to exploit. Now, this forced Microsoft to patch at a different cadence, right? It still did its Microsoft Patch Tuesday, but what it would then do is it would patch additionally throughout the week or month as it needed. And this was important because people needed patches so that they would not get victimized. If we look at the bottom here, we can see this disturbing trend where back in, you know, 2025, it was about a month. But now as we're going into 2026, it's down to weeks, it's down to days, and very soon it will be down to hours. The expectation going into 2027 is by the end of 2027, it'll be down to minutes. So essentially vulnerabilities are being discovered and exploits are being created at essentially the same time. This collapses that entire patch window. And so what it does is for the product owners, right, or the maintainers of code, they have to go through a process where they have to find the vulnerabilities or be notified of it. They have to validate or verify it is actually a vulnerability. Then they have to develop a patch that closes it. Then they have to test the patch and they have to retroactively make sure it doesn't impact other features. And then they have to work with the development team to make sure that the patch isn't going to undermine future features. Then they can start their deployment. And that typically is done in phases in case there's something wrong, because these patches need a way to be reverted or backed out if something catastrophic happens. So all of that takes a lot of time. This is why Microsoft, with all its resources, takes about 30 days to do a lot of those patches. But this change based on Mithos and other frontier models that will also have this capability, it blows that out of the water because it's no longer you have a month to get this done. It may be hours or minutes. So Fundamentally, everything has to change and it affects everybody. Think about the developers, right, who are building tools. They own the code, they know the code. When a vulnerability comes in, they're the ones that have to validate it and find the bug or the issue and come up with the fix. This is going to affect the developers. They're going to be pressured to make sure that their code is more robust going out the door. And then if a vulnerability is later discovered post-release, that they move very quickly to validate it, come up with a fix, and push out a patch. But this is a lot of work. They're going to have to use the very tools like Mythos to detect those vulnerabilities ahead of time, and then it'll need to be continuous. So this is a big burden on developers. We know that the vulnerability management team who normally deal with post-release patches, right? They have to figure out the vulnerability. So their entire process of detecting it or getting a report from a responsible vulnerability researcher, validating it, and then working with the developers or the SecOps people to create patches and get it all, all of that has to be compressed much sooner. We know because of the rapid advance of the exploits being created based on the identification of new vulnerabilities, that we're gonna have a lot more zero days. And that means a lot more exploitation of vulnerabilities than we've ever seen before. This impacts security operations. This impacts crisis response, incident management, digital forensics, all of those kinds of groups that deal when things go sideways. So they're gonna be impacted and they're gonna be asked to move faster, handle multiple incidents at the same time, and then work with vulnerability management and developers to fix all these things. But this problem doesn't stop there because that's all internal. Most companies rely on a supply chain of vendors and partners. All these risks impact them as well. And we can't forget national critical infrastructures, which are also impacted by these vulnerability discover— discovery and exploitation attacks. So if you need electrical power, if you need water, if you need telecommunications, if you need any of those things that are part of the national critical infrastructure, that's also at risk. So all of these then begin to compound. And when we go back and look at those zero-day rates, again, we can see how zero-days, when we look at exploited vulnerabilities, the ratio is going up. We're seeing for 2026, it's already at 73%. By the end of the year, it might be in the high 90s that all exploits will be zero-days. And that's an absolute nightmare for security operations and responders. So defenders, they need to move to adopt AI to identify the vulnerabilities, remove them before release, or figure out a patch, test it, get it out. But they really need to use AI as well. And this is a challenge in the technical space. But it may not be the biggest challenge. So there was a survey that was recently done by Cobalt. It's a security company. And the data was published out by Cyentha, a cybersecurity research company. But essentially they asked security professionals, why don't you patch every vulnerability? Because believe it or not, we don't, right? We only patch the most important ones. Right? The highs and criticals are put up front. The moderates may be delayed for 6 months or a year. And the lows, well, the lows may be a year or 2-year cycle or maybe never. So professionals were asked, why didn't you patch? And the number one reason wasn't it's technically burdensome or it's technically impossible. It wasn't. The number one reason was business disruption. Now, let's go back to that Microsoft Patch Tuesday. Microsoft decided, right, to patch once a month. And they did that not because they didn't have the resources to patch all the time. It was because their customers didn't want to be impacted. Again, a lot of these patches require reboots or there's a performance hit while it's updating. Whatever it is, customers don't like that. And if customers don't like that, business executives and executive leaderships, they don't like it as well. So the business process may actually be one of the biggest burdens that we have to overcome. So security professionals need to be working with our executive leadership and properly communicate the ramifications of these new models And it's not just Anthropic's Mythos. All of the big AI companies are pushing their models to be able to achieve these kinds of capabilities and this speed and this scope as fast as they can. The US models are probably 2 or 3 weeks behind at this point, behind Mythos, but they're going to catch up. And we're seeing overseas models, especially the ones in China, They may be 2, 2.5 months behind, but eventually they're going to get there. And Mythos itself is not staying stagnant. We've seen increases in the performance and new models coming out. So this isn't a plateau. This is a curve going up. This is the new reality that we have to deal with. So let's give some, some kind of timelines here, right back in late May. Project Glasswing came out, which was Mythos Preview. And essentially Anthropic limited the number of people that were going to get access. They had already done some research. They had found 23,000 vulnerabilities and about a third of them were critical or high. But they found vulnerabilities in every major operating system, every web browser out there, and a huge number of open source and commercial products. It was very worrisome. So they actually restricted who would get access. They limited it to 50 organizations, including the United States government. After that, essentially a couple of weeks, those 50 partners then found 100, or found 10,000 critical and high vulnerabilities. Now let me remind you, in all of 2025, for low, moderate, high, and critical, we found less than 50,000 for all of 2025. And now in a couple of weeks, only 50 organizations. It didn't even go out to the vast numbers of vulnerability researchers, ethical and unethical, or to cybercriminals, or to a whole bunch of nation states, or big companies that have their own vulnerability research. This was just 50, and they found 10,000. Okay, so that's the scale we need to be thinking about. A few days later, Anthropic released Mythos-5 and Fable-5. Fable-5 was this engine, the same Mythos engine, but it had some protection mechanisms. You couldn't use it to do security vulnerability or exploit creation. There were limitations around nuclear research, you know, biohazards and chemical research and so forth to make sure that very malicious parties couldn't use it to develop weapons. The MITHOS5 was again, the next generation of MITHOS Preview, but it was intended for security professionals. It was intended for organizations that they could use against their enterprise products, software, and hardware. And it was more powerful than Mythos Preview. So the people and organizations that had access to Mythos 5 was gonna be limited, right? And they, Anthropic was gonna charge a good amount of money for it. Well, just a few days later, 3 days later in fact, the United States government came out. Very quickly and said, "Mythos 5 is too dangerous. People can weaponize it." And also within that timeframe, a creative hacker actually found a way to get around those controls of Mythos 5 so people could use it and get around Fable 5 and so forth and use it for bad things. So essentially the US government 3 days later came out and said, "Nope." This can be used to harm. We're going to put export control directives and told Anthropic, you cannot distribute this to anybody but US citizens and companies. Even to a US company, it can only be given access to US citizens. Well, Anthropic didn't have a way of limiting that. So they essentially pulled it off the shelves. And now nobody has access as of today. To Mythos 5 and Fable 5. But that isn't the end of the story because we have other AI creators, OpenAI, for example, who has said, we are very close and we're going to open it up to the world. We've got every major AI model creator out there striving and they will eventually attain this level of capability. It's just a matter of time. So the genie's out of the bottle. We can try and put some controls on it temporarily, but the reality is other countries, other organizations, criminal organizations, researchers are going to get their hands on this type of capability, whether it's Anthropic's model or somebody else's model. Okay, so what are we doing? So I'm advising my clients and I talk with boards, I talk with CEOs, C-suites, as well as CISOs. So I advise them there's really 4 things at a strategic level we want to start thinking about right now. Number 1, we can't ignore the basics. There are certain fundamentals in cybersecurity around identity and identifying and protecting certain critical data and, you know, managing attackers that get into the environments and their lateral movement. There's just some basic things. That we all should be doing. And we could go off and figure out something super creative. But if we don't have the basics done and done well consistently, it's really not going to matter. So the first thing is go back and make sure you're doing the basics very well, very effective, very efficient, and consistently. Okay, so start there. Number 2, security needs to use the exact same tools that the attackers are. So Mythos5, for example, was gonna give teams and security companies the same technology as the attackers so they could help identify the vulnerabilities either in the development stages or post-release to help companies and organizations get the alerts, figure it out, get their patches out to reduce the victimization of their users. So we need to be open to that now. And again, the models may not be available at this very moment, but we have to build the processes. We have to lay down the communication and support with executive leadership. We may need to secure budgets. We may need to change policies. There's many things that we need to do in a preparatory way to make sure that happens. And I would strongly advise working with your current cybersecurity vendors, whatever they are, whichever ones you trust, because they are working to integrate models like Mythos5 into their tools, and you want to be able to leverage that as fast as possible. So think about that as you're moving forward. The third thing is operationally, We have to be able to increase cadence. Just because the new latest tool or vendor tells us we have 50 vulnerabilities today doesn't mean we have the capacity to go figure out how to validate those, create patches, test them, and get them out, right? So we need to change the way we think, the way we were designed operationally to handle all of this. And we also need to be able to change how our security operations are going to be detecting attacks or exploits, our crisis response are going to be able to handle the impacts of it and get us back up and running, and how that intelligence feeds back into the cycle for continuous improvement over time. So there is a lot of operational adaptation that needs to happen, and we need to facilitate right now to get ahead of all of this. And lastly, and this is kind of an odd duck in talking about this, but our industry unfortunately has had blinders on by choice. We often pay very close attention to our own environments, what's inside our firewall, right? Our own apps, our own infrastructure, our zero trust or our networks, our applications. But we don't look beyond that to actually understand the attackers, the threats. There is a certain subset of people in organization that are targeting you. They have certain resources, certain go-to plans, certain targets that they're going after. The better you can understand your adversary, the more effectively you can organize your defense. We're not trying to defend everything equally. That just does not work. We have to put our greatest defenses and efforts where those attackers are coming in and around the objectives that they're trying to achieve. So we need to be thinking and including aspects of the enemy. And Sun Tzu, right, the author of "The Art of War," outlined this thousands of years ago. This is not a new concept. Every military school out there teaches that you have to understand your enemy and what they're capable of and what they're going to try and what are their go-to moves. Every professional sports organization does the same thing. They just don't look at the capabilities of their players and maybe the condition of the field. They're figuring out what the opposition, what are they good at? How are we gonna mitigate their strengths? How are we gonna take advantage of their weaknesses? We have to do the same thing in cybersecurity. We no longer have the latitude to simply be defensive and only look within our garden. We have to see and understand our adversaries and plan accordingly. And again, at the end of the day, we're not trying to eliminate risk. That's impossible. We're trying to achieve an optimal level of risk that balances the cost, the business friction, with the residual risk. And there's some balance in there. Cybersecurity professionals need to work with executive leadership to, again, communicate that this is changing that ratio, that— and the executive leaders need help in understanding, okay, do we want to invest more? Are we willing to accept the risk? Should we be changing the goals and what's acceptable? There need to be trade-offs and the executive leaders have to be part of that decision. And it's our job as security professionals to help educate them, to help walk them through the different options, and then to make sure and align our security controls to meet that acceptable level. Right. And if the executive branch doesn't understand that, yeah, there may be impacts if If you say there's a certain level of acceptable risk, if something outside of that falls, it isn't a failure of security. We're hitting a target, right, that you're setting based on your investment and your willingness to have business friction. If something happens beyond that, that's part of the plan. So again, there has to be acceptance for all of this when we look as part of prediction prevention, detection, and response, which is a continuously improving security capability and process. So please keep yourself caught up on this. You can follow me on LinkedIn or Substack or YouTube channel. Happy to discuss this. I've got tons of different articles and videos talking about this. And I know these conditions will change very soon. So stay up to date, stay informed, and start thinking strategically. You have to be planning and moving now to intersect these threats because they are just moving faster than we've ever seen. Be safe.