Anthropic has caused a stir in recent weeks with its AI model Mythos. In seven weeks,the model identified over 2,000 previously unknown security vulnerabilities, including a 27-year-old flaw in OpenBSD that had survived millions of automated tests. Governments, banks and tech companies are alarmed. But what does this really mean for businesses?
In short: we are in the midst of a paradigm shift in IT security – from defensive tools to resilient systems.
First, to put things into context: with Mythos, Anthropic has simply employed one security analysis method, code analysis. The 27-year-old BSD vulnerability that was discovered is no magic trick. It is a bug in the code that hasn’t been touched for decades. Hardly anyone has analysed it in recent years.
If a team of human experts had analysed the same code in a targeted manner, they would probably have found these vulnerabilities too. The difference lies less in the cost and more in speed, scalability and the availability of experts – of whom there are simply not enough. Even with AI support, IT security remains a significant investment.
A closer look at the technical System Card puts the headlines into perspective: Mythos’s actual proven strength is not in finding new vulnerabilities, but in the automated writing of exploits for known flaws.
I share the assessment of Linus Neumann, spokesperson for the Chaos Computer Club: Mythos is primarily an asset for defenders. Anyone who applies Mythos to their own source code can systematically close vulnerabilities before attackers find them. The most important publicly available open-source code has already been analysed and updated. For attackers, this is considerably more difficult: with proprietary software, they often cannot access the source code. And even where the code is publicly available, attackers simply lack the budget for such an operation (with the exception of state actors).
But now comes the uncomfortable truth:
The model will not only automate the discovery of vulnerabilities. It will also speed up the writing of exploits – that is, the code that actually exploits a vulnerability.
Zerodayclock documents just how dramatically the time between the disclosure of a vulnerability and the first attack has shortened:
The target today is 10 hours. Hardly any company can patch, test and roll out updates within this timeframe. Small and medium-sized enterprises (SMEs) in particular are overwhelmed by this, as they do not operate a 24/7 ‘follow-the-sun’ model.
This creates a new dilemma: simply patching straight away is not a secure solution either. Supply-chain attacks, in which attackers compromise an update themselves before it reaches the user, are now the norm. The recommendation to wait 24 hours so that a tampered update can be detected by the maintainer and withdrawn contradicts the imperative to act immediately.
A pragmatic approach to prioritisation might look like this: exposed systems on the perimeter – in other words, anything directly accessible from the internet – should be patched as quickly as possible. Internal systems can follow shortly afterwards to reduce supply-chain risks.
The implication is clear: we will be hacked. It is not a question of ‘if’, but of ‘when’.
For years, companies have invested primarily in prevention: in firewalls, antivirus software and perimeter protection. That is not wrong, but it is no longer enough. The paradigm shift we now need is from stability to resilience.
In concrete terms, this means:
I’m familiar with the resistance within decision-making bodies: initially, the costs are just there. Nobody can predict when it will actually be needed, and many companies lack the expertise. Ultimately, it’s simply difficult to calculate a business case for something that may never happen.
That’s only human, but it’s also dangerous.
My prediction: the pressure will increase massively over the coming months. Not because of regulation, not because of insurers, but because more and more companies are actually being hacked. That will be the decisive factor for CISOs.
The responsibility lies with senior management. No one else. I also hope the BSI will raise the profile of existing guidelines: frameworks such as IT-Grundschutz are a good starting point, but remain too abstract. What’s missing are specific technical recommendations: which technical architectures are suitable for companies of which sizes, and which are not. Small and medium-sized enterprises, in particular, lack this guidance.
Please don’t start by putting a major transformation project out to tender; instead, begin by asking:
When was the last time you actually restored your backup?
Not just documented in theory. Actually restored on a test machine, under real-world conditions. Because the backup is the difference between recovery and a ransom – and the majority of ransomware victims who end up having to pay fail precisely at this point, due to backups that either don’t work or have been encrypted.
If you don’t know or have never done this before: this is your first step. Today. Also, check whether there is an offline backup – one that an attacker cannot access, even if they are already on the network.
It sounds simple, and it is simple. Unfortunately, this is precisely where most companies fall short when things get serious.
Do you have any questions or need assistance?
You can find out more about the possibilities of IT security and resilience for your business on our website: