Executive summary
The Anthropic Claude Mythos model holds the promise of great power. It has demonstrated that AI could be used to discover and exploit cybersecurity vulnerabilities much faster than before, reducing the level of effort and time for threat actors launching cyberattacks. Enterprises must now adopt continuous exposure management and strengthen governance. They must also improve visibility, speed and coordination across cybersecurity, technology and risk functions. Ultimately, organizations must protect against the cyber threats that AI is accelerating by using AI to enhance cyber resilience.
What does Mythos change?
AI-driven threats have changed the nature of cybersecurity — and the Anthropic Claude Mythos model has changed it again.
Mythos accelerates the capacity of AI to find, understand and act upon information. It’s powerful enough that Anthropic formed a consortium of security leaders, Project Glasswing, to analyze it before releasing its capabilities more broadly.
What will change for cybersecurity? The most important change is the collapse of the time between vulnerability discovery and exploitation. Mythos has demonstrated the ability to identify and exploit vulnerabilities in minutes. To defend your organization, cybersecurity cannot simply accelerate — it must change.
Cybersecurity responses
The processes in many cybersecurity teams are built around episodic patching cycles that are measured in weeks or months. Now that exploitation can occur in minutes, exposure is constant rather than episodic. Attack scale and depth can grow simultaneously, expanding beyond what traditional tools can manage alone.
- Shift to continuous exposure management
Assume there is little to no delay between vulnerability discovery and exploitation, moving away from periodic scanning and toward continuous monitoring and testing of exposure across systems, applications and infrastructure. - Enhance vulnerability remediation
Prioritize vulnerability remediation based on exploitability. Expect vendors to accelerate patch releases. Automate processes that validate the fixes and patch effectiveness. - Strengthen vendor and third-party risk management
Third-party software and open-source components can introduce hidden dependencies, so expand due diligence to include how vendors use advanced AI for code analysis, security testing and automation. Review service-level agreements to reflect faster vulnerability cycles and evolving risk scenarios. - Accelerate decision-making and response speed
Expand beyond traditional policy and governance to act with speed and coordination that includes more efficient triage, clear escalation protocols and aligned decision rights across executive leadership. - Reinforce security fundamentals
The pace of attacks has increased, but core security disciplines remain highly effective. Organizational resilience continues to depend on defense in depth and Zero Trust, with strong identity controls, network segmentation, timely patching and continuous monitoring. The difference is that gaps in these fundamentals are now exposed more quickly. Configurations that were once considered lower priority, such as outdated systems or temporary access permissions, can now be identified and exploited almost immediately. - Use AI to enhance security operations
Use AI to enhance the vulnerability management process, accelerating the discovery, testing, prioritization and remediation of vulnerabilities.
How we can help you
SERVICES
SERVICES
To maintain business resilience against AI-accelerated attacks, organizations need to do more than simply accelerate their current processes. But they don’t need to start over.
“I don’t think organizations need to rebuild their cybersecurity programs,” said Grant Thornton Cybersecurity and Privacy Leader Derek Han. “The key is to shift security to the left, enhance your defense-in-depth and adopt Zero Trust principles. Use AI as part of your security operations to accelerate the speed of vulnerability discovery, prioritization and remediation.”
Contact:
Partner, Cybersecurity and Privacy Leader, Risk Advisory Services
Grant Thornton Advisors LLC
Content disclaimer
This Grant Thornton Advisors LLC content provides information and comments on current issues and developments. It is not a comprehensive analysis of the subject matter covered. It is not, and should not be construed as, accounting, legal, tax, or professional advice provided by Grant Thornton Advisors LLC. All relevant facts and circumstances, including the pertinent authoritative literature, need to be considered to arrive at conclusions that comply with matters addressed in this content.
Grant Thornton Advisors LLC and its subsidiary entities are not licensed CPA firms.
For additional information on topics covered in this content, contact a Grant Thornton Advisors LLC professional.
Share with your network
Share