May 2026

Faster Patching Won't Save You From Mythos. Knowing Your Network Will.

CISA is reportedly considering cutting the default federal patch deadline for known-exploited vulnerabilities from around two weeks to three days, in response to concerns about AI-assisted exploitation tools such as Mythos. Katie Moussouris's response to that proposal is the one defenders should be paying attention to. Changing the deadline doesn't change the problem.

The wrong lesson

Mythos is the headline. The instinct it has triggered is the wrong response.

The reflex says: AI is finding vulnerabilities faster, so we should patch faster. Shorter SLAs. Tighter deadlines. More pressure on whoever is on the hook for remediation.

Moussouris puts the counter-argument plainly: "Mythos, Spud and others aren't finding bugs that a human couldn't find. They are finding them faster and in parallel."

That sentence does a lot of work. It says the model isn't generating new physics. It's compressing time. The bugs were always there. Humans could have found them. Now they get found in batches, by something that doesn't sleep, doesn't have a backlog grooming session, and doesn't need a pentest contract to be in scope.

Compressing the time on the offence side doesn't create a new defensive task. It exposes the one we already had and were not doing well.

Tempo is the symptom, not the problem

Vulnerability management was built around a defender's calendar. Change windows, test environments, compliance reviews, two people who are on holiday. The attacker is no longer constrained by any of those. Mandating a three-day SLA against a sub-hour exploit chain is not a fix. It is a different number on the same broken process.

The actual problem is two layers down:

• Most organisations don't know with confidence what they have on their network.
• Most organisations don't know with confidence what those things are allowed to do.

Without those two answers, faster patching is faster work on the wrong list.

More determinism earlier

Moussouris's prescription is: more determinism earlier, not more non-determinism later.

This is the part most vendors are getting wrong. The pitch right now is the AI SOC layer. An LLM-flavoured copilot bolted on top of a stack that already doesn't agree on what's on the network. The premise is that the AI will reason its way to clarity from inputs that disagree.

It won't. The bolt-on can't be more accurate than its inputs. If your asset register, your IAM model, and your patch state already disagree, adding a probabilistic layer on top produces probabilistic alerts. At machine speed.

Determinism earlier means the boring layer:

• Inventory you can trust.
• Privilege boundaries that are written down and enforced.
• Blast-radius maps that someone has actually walked.

Then, and only then, do agents on top become useful. They reason over deterministic ground truth. They don't invent it.

What machine-speed defence actually looks like

Three things. None of them are new ideas. The Mythos era is what makes them load-bearing.

Know what is on your network

Many of the worst intrusions in recent memory have not needed an exotic 0-day. They have worked through accumulated tech debt. Forgotten devices, unpatched middleware, services nobody owned. The attacker enumerated. The defender hadn't.

You cannot red-team what you cannot enumerate. The first defensive task in the AI era is the same as it has always been: a working inventory. External footprint, internal devices, cloud accounts, third-party suppliers, plugins on developer workstations, agents with credentials. Anything that can be reached or that can reach.

This is not glamorous. It is the precondition for everything else.

Contain the privilege plane

The dangerous CVEs do not land evenly. Salt Typhoon and the Mythos-class disclosures both land on the privilege plane: identity, authentication, the systems that decide who can do what.

Moussouris is direct on this: "Disrupting privilege access is the only way to defend."

The defensive lever is not faster patching of the vulnerable component. It is making the privilege that a compromised component can reach narrow, time-bound, and reviewable.

If a service is compromised, what can it touch? If a credential leaks, how long is it useful for? If an agent goes off-script, what data is in reach? Those are the questions that matter when the offensive tempo is unbounded.

Red-team yourself, continuously

Point-in-time pentests were designed for a world where the attacker also operated in point-in-time engagements. That world has ended.

The most useful framing in Moussouris's thread is this: "Agentic systems on one's own network ought to be 24/7 red teaming that."

Your own Mythos, pointed inward. Continuous adversarial pressure on your own infrastructure, generating findings at the same tempo the offensive side now operates.

This is harder than it sounds and easier than the vendor pitch suggests. It does not require a research lab. It requires combining the inventory, the privilege map, and a feedback loop that keeps testing the assumptions in both.

Why SMEs are better placed than they think

Most of the AI defence pitch is aimed at organisations with SOCs, threat intel teams, and the budget to absorb another platform. SMEs read those pitches and reasonably conclude they are out of scope.

The good news is that the underlying work scales the other way. Knowing every device, plugin, cloud account, and privileged credential is achievable for a 50-person company in a way it is not for a Fortune 500. Your surface is smaller. Your inventory can be complete. Your privilege model can fit on a page.

The bad news is that very few SMEs have done that work. The reflex has been to buy a tool. The work to be done is older and quieter than that.

What to do this quarter

Five steps. None of them require an AI platform. All of them are things you can start on a Monday.

1. Build a working inventory. External footprint, internal devices, cloud, plugins, suppliers. If you do not know what is reachable, that is the first finding.
2. Map your privilege. Who has access to what, why, and for how long. Which credentials are still active for systems that no longer exist. Which agents and integrations have standing access.
3. Move from annual to continuous. External monitoring for change. Pre-CVE intelligence on the dependencies you actually use. Drift detection on cloud configuration. Annual scans were a budget decision, not a security decision.
4. Red-team the things that matter. Not everything. The systems that hold customer data, money, or trust. Adversarial testing on a cadence that reflects how often the threat changes, not how often the calendar turns.
5. Decide in advance. Containment plan, rotation list, recovery decisions. Made calmly on a Tuesday, not at 2am the day of an incident.

The order matters. Without 1 and 2, the rest produces noise.

Closing

The headline answer to Mythos is not another tool. It is a posture: deterministic inventory, contained privilege, continuous adversarial pressure on your own infrastructure.

The technology to do this exists. Most of it is unglamorous. The vendors with the loudest AI-defence pitch are not selling it, because it does not look like a platform. It looks like discipline applied earlier.

The Mythos era is the prompt to do that work. The CISA SLA debate is a distraction from it.

ThreatControl helps organisations understand their attack surface, contain their privilege plane, and build resilience they can actually achieve. Our free Flash Briefing is the five-minute starting point on the inventory. Our Security Suite maps what's exposed and what an attacker can actually use. Our Fractional CTO service builds the privilege boundaries and recovery decisions before you need them. Get in touch.

← Back to blog