The Mythos Effect on Cybersecurity and Board Engagement

New AI models are becoming amazingly fast at finding and exploiting digital and human vulnerabilities. It's called the Methos Effect, and it's disrupting cybersecurity in drastic ways that CISOs and boards must understand and address. Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, cybersecurity strategist, and industry advisor. And today we are going to talk about how the mythos effect is creating fundamental challenges for protecting digital technology and how the industry needs to respond. And I'll be talking with Edna Conway. Edna is a legend in the community and has likely forgotten more about cybersecurity than most of the experts will ever learn. She was the Chief Security Officer at Cisco, VP Chief Security and Risk Officer for Microsoft Cloud, sits on multiple boards of directors, and actively advises boards and C-suites on cybersecurity leadership and oversight. Welcome, Edna, always a pleasure.

Delighted to be here with you, Matthew.

So let's dive into this, right? We've got these new models like Anthropic's Mythos, And they are outstanding at identifying and even creating exploits for vulnerabilities in mind-boggling speeds. Now, operationally, how do you see these tools impacting both products, right, software and so forth that are out there, as well as infrastructure security?

Yeah, there's been a lot of talk about it, right? And so there's this balance of, You know, some days I want to tell everybody, just calm down. Um, but I also want them to be calm and cognizant, and those often don't get juxtaposed together. So we, we wave our hands and say, ooh, ooh, there's something new. And the reality is we knew this capacity was coming. I, for one, I'm really excited about it. The the transition that we have to make is from bright shiny object, I want to use it with wild abandon, ooh, I'm afraid of what it may do, good grief, it looks like the actual innovators who put this capacity out are unto themselves limiting its availability because they are striking fear in the hearts of everyone, which is a statement about, I think, their responsibility, but not intended to be creating a fearful environment. So at the end of the day, it's about speed. We can do things faster. We've been watching this happen. And thanks for the introduction. I think legends is a euphemism for old, but I so appreciate that, Matthew Rosenquist. What a gift. And so, I do think that we have an opportunity to figure out a way to deploy something new with wisdom, with the right speed, and with the right members of the community at the table. And we could discuss who those members of the community are, 'cause it's complex.

Well, we're seeing Mythos and the partners expand, right? They're gonna involve 150. And the first 50 found over 10,000 high and critical vulnerabilities in just a couple of weeks. And we're seeing the shift from vulnerability discovery to exploit go from months down to days. And we're expecting it based on this trend to even go down to minutes. And that disrupts a lot of business cycles, right? I mean, if we look at Microsoft's Patch Tuesday, everybody loves Microsoft Patch Tuesday, right? Second Tuesday of the month, and they're going to push out patches. And that is predicated on the previous windows of exploitability that were more than a month. It took more than a month for an attacker to find a vulnerability, create an exploit, and get it out in the wild. And so that allows that Microsoft Patch Tuesday to work for several years now to get ahead of the exploit. But when Mythos and the other models, it's not just Mythos, right? We're seeing, seeing OpenAI models be able to do the same thing now. When they're able to shrink that window from months down to days or even potentially minutes by the end of the year, that seems like a huge disruption, a huge elevation of potential risk, both to the infrastructure and products. Do you believe that is a, board-level discussion that has to happen between the CISO and the C-suite with the board?

Yeah, the question is, is it with the CISO? Is it with a larger set of the executive suite? And here's why, because I think we sometimes talk about security in isolation. And what I would rather be talking about, and there was a reason why I always had risk in my title, is resilience. Because this is the language of business. And unless you're, you know, in a clandestine environment doing classified work, you don't live and breathe for the purpose of security. Now, there are plenty of companies that have wonderful security products and solutions, and that is the core of their business. But at the end of the day, they're in business the same way that you and I are. Pick your currency of choice. We're in business to make money, serve our customers, If it's a government, your mission and citizens. If it's a nonprofit, your mission. In any which way you look at it, that's what we're trying to do. And we have all kinds of altruistic efforts that go around that. I'm not saying it's evil. I'm a great capitalist. I love capitalism. I like open, free societies. But step back. Every time we've had a revolution of some sort of a new capability. Let's go back to the Industrial Revolution, right? The steam engine, the printing press, same kinds of concepts of there's new things that are going to happen more quickly. Are they going to hurt us or are they going to help us? Number 1. Number 2, what are the downsides to using them? And 3, how can we use them for good? The same kinds of questions. Are being asked. And there's a debate, and I, we should talk about it, which is I've been watching this debate of the way to effectively deal with the speed that this kind of AI can identify vulnerabilities is using AI to find them. There's a whole nother camp that says, hmm, not sure AI is the path to fixing AI. And I'm like, well, I'm not sure it needs to be fixed. A, I don't know of any other technology that can move in this same way and at that speed. And stay tuned, we'll have to have another talk about quantum because everybody seems to have forgotten it for a bit, huh? Uh, it's still out there and it's coming faster than anybody thinks. But the combination of utilizing the technology with the people is the kind of question that needs to be at the board table. So 5 or 6 questions, right? What are we doing for the resilience of our business? And there could be a whole host of things that are out there. One could be, we just had a fire in location X, or there's been a coup in location Y. How are we going to continue production? Or, or we lost a huge contract, which was, God help you if this is your circumstance, 50% of our business. And you and I know there are many companies that are out there that have that kind of concentration risk. This needs to be right at the table. But looking at it in the context of resilience overall is how we solve it and how we don't overemphasize it and how we make it part of our routine, everyday governance processes. So CISO at the table. You bet. Legal at the table? Absolutely. You know, we've talked about this, you and I, Michael. You know what? I think the worst software that I've ever seen out there has always been the HRMS system. After 80+ mergers and acquisitions, I see an HRMS system and I almost break out in hives before I've even clicked, right? Because, my God, only knows what I'm going to find. And the reality is we need to move at a new pace. But we need to move with human ingenuity on how we drive it. And more importantly, when do we step in to say, yep, nope, maybe, let's do a little more. There's really only 3 choices, and that's what resilience is.

So I love what you're talking about, right? Because you're emphasizing the fact that boards and CEOs, they talk business, they talk business value. They're, You know, they're not experts on cyber risk. They're experts on business risk. And so from a CISO perspective, right, how should they be translating these cyber risks? Because yes, adaptation is going to be required. And if that's the case, then probably budget or justification or spending or, you know, a little more latitude in, in who knows, training, whatever it is. But something's going to be needed. There are going to be asks from the CISO. And if they're coming at it from that fear, right? Oh, I'm just going to create fear, right? That's not very productive, right? And that isn't speaking in business value terms. How should CISOs start positioning their organization to be able to tie in and communicate that business value and how this puts it at risk and how cybersecurity is going to help preserve or elevate that business value moving forward. Any recommendations there?

Yeah, I think, I think you walk in, look, we've gone way past the yellow, green, red, and this is how many things I found and this is how many things I closed and here's how fast I did them. That this just completely eliminated is how fast I did that. It doesn't matter. Um, what it is, is what has been discovered, who has discovered it, and how are we rallying around addressing it holistically? There's always a finger in the dike approach, and sometimes you need to do that. But for me, at a board level, I always ask, you know, how are we balancing the speed with understanding the full spectrum of the risk? Did you go talk to the supply chain and the production people? Number one, right? Is this going to impact our ability to push out code? Is it if we are in an environment where we actually have, dare I say it, a three-dimensional product that is actually not software? How is it going to impact that? What can we do to mitigate that? And that's going to be a presentation. That's almost a panel. So the old school thinking of the board was the CIO got up, the CFO got up, the CISO got up, and you all talked about things to the board members in isolation. And I can always tell when I have an integrated executive team if they riffed off one another or if they had a plan. So for me, we have entered the day and age where something that I had the privilege of leading and working on at both Microsoft and Cisco, and certainly still think about, is call it what you want. I called it a, because everybody has to have an acronym, right? The RROC, the Risk and Resiliency Operating Committee. That's what it's all about. And everybody sits at the table, even the HR people who, quite frankly, without them, we wouldn't have people, we wouldn't have a business. So everybody gets an equal stake. Everybody gets equal respect. But then you have the CFO sitting there and I, and I asked a question recently about, we need to move more of this to the desktop. What about like Dell's doing it, right? They've got the, the desk side, uh, Agentic AI model. Brilliant. Because I'm, I'm sitting here thinking risk and resiliency. I can do a tremendous amount if I pay the AI providers and the beautiful cloud providers who are doing it. An enormous amount of money for storage capacity, compute, tokens. That's fabulous. What is that going to do to my margin? Just out of curiosity, will I have a margin when I'm done? And so for me, what we need to do is understand who our peers are. And I mean peers in business, not peers in title. Because you and I know 9 times out of 10, I always laugh because people are like, well, you were a CISO. I'm like, nope. I was never a CISO. I was always a chief security officer. CISOs rarely report to the CEO. Doesn't mean what they're doing isn't absolutely critical, right? But the reality is different pieces of a business work in a different way. And a board looks at it as one beautiful quilt. And if one of the patches is not moving as fast, or is missing, it becomes glaringly obvious if you start to ask the question about how are we operating across, and you have to have your enterprise risk model, your risk and operating model. One, two, the one that I always get to, because as you know, I live and die by third-party risk. Um, this is my favorite thing on the planet, without a doubt. Um, what are we asking? Of the third-party ecosystem. Like, do we ever ask people, will your product create non-human identities or service accounts or API users or agents or bots or tokens or machine credentials in my environment? That's a simple question when you say it out loud. If you poll people, ask how many of them are asking that specific question. Are you using AI? Sure, they ask that. How are you using it? Maybe. How is your utilization of it impacting me and what you provide to me? The number starts to drop dramatically. When you start to say, will it create any of these? Then you get to almost, you know, 0.X%. That's where we have to go.

So I'm hearing a couple of great nuggets here. One, that it is not only a CISO's perspective, it's a team perspective, right? It's the CISO and it's the finance from the business viability and impacts. It's the legal questions and it's, it's all of these together. So it's not just the CISO story that's important when we're talking at this kind of scale. That's, that's one. Two, it sounds like that a well-informed board is going to be asking some tough questions, as they should. And the CISO should be anticipating those and, you know, reaching out to the other C-suite partners as well as third parties to gather some of that pertinent information so that they can properly inform the board, who is going to ultimately make decisions about certain things, right, from an oversight perspective. But they shouldn't be coming in with a couple of slides or with a canned story. They need to be prepared. They need to be ready to have a discussion. They need to be ready to talk about it from business perspectives, third-party risk compliance, things of that sort coming into the conversation. Would you agree that that would be a strong recommendation to all those CISOs out there to—

I don't think it's a strong recommendation. I think it's a must, period. And if you have board members who aren't reading, I mean, we all get read-aheads. We should be reading them. We should be familiar with them. I have a beautiful, you know, technique of writing my notes digitally right next to the presentations that I get. So I can ask meaningful questions because at the end of the day, right, you will, you know, We've all heard it, right? The nose in, fingers out rule of board service. I personally think that's changing. It doesn't mean you're operating. That we all have this wonderful tendency as former operating executives to want to dig in. And you can do that. You can do that on the side and say, show me how you're doing that. That was really exciting. I'd love to see a demo of that. But that's not what the board meeting is for, right? And the reality then becomes, if I'm maybe nose and upper body in, because I'm just showing the love, then you ought to understand what that is. And if you really want to be a great board member, you should be talking to those executives in advance. If you don't know who the CISO is and you've never had a conversation with them outside of the board meeting or You haven't looked at somebody and said, I'd love a demo of that. I just got a call from somebody who is, I'm on a UK board who said you reacted. Um, and Matthew, this is a classic Edna reaction that I will share with you and you can, you can hoot and holler all you want, but I was so excited when this person showed, it was the CTO, what he was doing. I got up. And I went over to him and I kissed the top of his head and hugged him and said, thank you. This is fabulous. May I know more at some point in time, which you can imagine the reaction of traditional, let me say again, I was in the UK. Um, so, but that kind of joy and reveling in what they're doing. In a positive way and also saying, yikes, I'm thinking about something. How do we deal with this? And there's a very important part of this. How do we deal with this? Not what are you doing? Report it to me, and I want to see it within the next 20 days. If you're doing that, please don't serve on the board. Please be a partner.

You bring up such a great point. So, I mean, you know, the Mythos Effect, it is causing lots of fear, lots of concern, lots of worry. It's a big challenge, no doubt about it. But you're identifying the fact that even when there are big challenges like this, there are always opportunities for positive change. And if that's the relationship that we have with, um, between CISO and board, between cybersecurity and executive leadership, um, better relationships with our third-party risk partners, um, better understanding or maybe even a rework of how we look and quantify and show risk, or maybe a spur of innovation that helps us cross some boundaries and get better from an operational efficiency and effectiveness perspective. But even in the darkest hour, right, of our concerns and our fears, there is positive opportunities. So I love the way you're showing these examples. So last question for you then, for the security practitioners out there, for the security leaders, the CISOs, the directors out there, right? Facing these kinds of concerns, how should they act right now to address these issues or take advantage of these opportunities? What is the one thing that you would say, hey, go off and do this just as a starting point? Point, right, to start building momentum? What would you say?

Yeah, I would say understand the new model of offensive security, which, I mean, and there are— it's not just Mythos and it's not just OpenAI. There are some companies that have been very security focused that already had this capacity and were embedding it in their platforms to provide capabilities to their customers. Um, and there are some governments that are looking at this from the perspective of I've been working on this for quite a number of years and now it's going mainstream. So how are we going to do it together? Number one question, but two, show me what you're going to protect. Show me the revenue you're going to protect because sometimes you can't do everything. And I would argue almost always you can't do everything. Many. And so we are throwing our arms up in the air and saying, oh my goodness, we're never going to keep up with the pace. And you're right, if it's a zero day, the reality is it has a ramification. How critical is it? How vast is the blast radius? How narrow is the blast radius? We all have the capacity to accept risk. And I'm not saying sit back on your laurels, but I'm saying go back to the basics. You know this. The security community is not like security community when I started. We have amazing talent that's deep and rich in their bench strength. And we can sit there and look at them and say, how are you deploying it here? How are you deploying it there? What could we bring together? What could we do more efficient? And for Pete's sake, do not come to me, for one, and ever say, this is the number of people I'm going to be able to get rid of and the money I'm going to save. That is not what this is about. It is about, here's how I'm going to enable greater human ingenuity and never ever forget that it was humans who created this. And I, for one, am going down putting my cryptocurrency on the sentient beings.

That is amazing, right? You know, focus on the basics. Understand the adversary, not just your environment, but also understand your environment from, again, a blast radius, right? What kind of controls we have to manage that. It's never about eliminating risk. It's about managing to it. So, we wanna make sure that the board and the executive leadership have Good information to find those trade-offs. Fantastic advice. Thank you, Edna, for sharing. It is always a pleasure to gain your strategic cybersecurity insights. Thank you very much.

My privilege. Thank you for taking all of my ranting and raving and turning it into 3 salient points. Always a gift to be with you, Matthew.

And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders like Edna here to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time.