In April 2026, Anthropic gave a small number of tech companies, banks, and security companies restricted access to Claude Mythos Preview — an AI model so effective at finding vulnerabilities that Anthropic wouldn’t release it publicly. It found vulnerabilities that years of traditional scanning had missed. Since then, other LLM models are also proving to have similar capabilities. Word got to boardrooms fast, and concerned boards are asking their CEOs, CTOs, and CISOs the same question: What are we doing about this security challenge?
The urgency is real. At Fortune 50 companies, AI-assisted developers now write code three to four times faster than their peers — but introduce security findings 10 times as often, according to a 2026 Cloud Security Alliance report. More code means more vulnerabilities, and the same AI acceleration has been a win for attackers too, collapsing the time between flaw discovery and active exploit.
So, what can boards do to keep their organizations both building and secure in a post-Mythos world? Focus on their firm’s security posture and whether the right mechanisms are in place to provide a comprehensive view of risk, prioritize what to fix first, and remediate vulnerabilities faster than they can be exploited.
How We Got Here
AI coding assistants have supercharged how much code gets written. But more code isn’t the issue — it’s that AI-generated code carries more security vulnerabilities than human-generated code. A July 2026 study by Ilya Kabanov of The Weather Report tested how today’s frontier models handle realistic, repository-scale coding tasks. The models were good at producing code that worked. They were far worse at producing code that was also secure — most of the code that worked still shipped with security flaws.
That’s compounding a problem years in the making, though it didn’t start with AI.
For much of my career, AppSec sat well below infrastructure on the chief security officer’s priority list, while a decade of tool sprawl and regulation kept raising the stakes. Security teams ended up with more tools and more data than ever, but still lacked a unified assessment of risk, and the tools to address them at speed.
Fixing every vulnerability was never realistic without slowing delivery to a crawl, so teams did the reasonable thing: scanned broadly, then invested a lot of human labor in triaging them so they could focus their limited fix capacity on vulnerabilities most likely to be exploited. The problem is that what was reasonable before isn’t enough anymore with the development of the Mythos class of AI models.
AI vulnerability reports have nearly tripled since 2024, according to a 2026 HackerOne report. Discovery has outpaced remediation by an order of magnitude — most teams still patch one bug at a time, built for a world finding a critical flaw a week, not one an hour.
AI cuts both ways. The same reasoning that lets AI models find what security tools missed also lets attackers weaponize those models — lowering the skill and cost it takes to exploit a flaw. Vulnerabilities that used to be safe because they were hard to reach no longer are. That’s collapsed the gap between a vulnerability becoming public and an attacker exploiting it, from months to days. In fact, today, the share of exploitations occurring on or before the day of disclosure has risen to nearly 80%, accourding to a report by J.P. Morgan Chase Private Bank. Fixing the most obvious flaws first was a safe bet when reaching the rest required real sophistication. That bet no longer pays off.
Triage capacity isn’t the whole fix. The backlog needs to stop growing — which means finding vulnerabilities accurately enough, and fast enough, to remediate at machine speed.
AI Is Part of the Problem. It’s Also Part of the Fix.
As a security scanner, AI models can reason through code, which lets them uncover novel threats no rule-based scanner would catch. But that mechanism also makes them inconsistent. They can hallucinate findings that aren’t real, which only adds to the noise — and the backlog. And because they lack the rigor of a rule-based scanner, a large number of vulnerabilities slip through.
Deterministic scanning, on the other hand, runs on well-tested, security-knowledge-based rules, which means no hallucinations. When you add AI reasoning on top of that foundation, you get a much more comprehensive view of risk.
But finding everything — through both deterministic and AI scans — is only the first step. Security teams also need to trust what they find. By applying a third, independent analysis layer that checks AI and deterministic findings against each other, we can get an accurate view of exploitable or attackable risk.
Independence here is essential: the same system that generated the code or flagged a flaw can’t also be the sole judge of whether the flaw is real — no more than a student should grade their own exam. Organizations also need to trust that the tools’ findings are complete, leaving nothing behind that an adversary might find and exploit.
When you can trust what surfaces, it drives faster remediation, credible governance, and a real answer for the board.
The Path Forward
So what should boards actually be focused on? Not a single number, but three things: a comprehensive assessment of the exploitable risk, manageable processes to prioritize and fix the vulnerabilities, and auditable proof that they are actually fixed.
Getting there is a matter of order, not speed. The full picture comes first — not a partial scan, not one tool’s slice of the codebase, but everything connected to it. Only then does prioritization mean anything: which vulnerabilities are reachable and exploitable, not just which ones a scanner labeled critical. And once a vulnerability is prioritized, there needs to be a mechanism that gets it fixed fast, and with proof it happened, not just a ticket marked closed. That discipline has to hold across every team and every tool — comprehensive, prioritized, auditable — because one gap is a door left open, and in a post-Mythos world, nothing will stay hidden for long.
Your next board update should sound like this: here’s the full picture, here’s what we’re fixing first, and here’s the proof that the backlog is reducing.
Leave a comment