A Mythos-Ready Security Program
Apr 2026
Orignally posted on the Security Brutalist blog.
Most of the advice coming out of the recent CSA, SANS, and OWASP briefing on Mythos-ready security programs reads like a checklist, but the order in which you tackle it changes the outcome. Skip the committee talk and start with the controls that actually reduce exposure.
Prepare for continuous patching first, building the triage and deployment capacity to handle a surge of new patches as Project Glasswing puts Mythos-class findings in vendors' hands. Stand up a permanent VulnOps function alongside that, staffed and automated the way DevOps is, so continuous vulnerability discovery and remediation across the entire software estate has a real owner instead of living as a side project.
Update risk models and reporting next, replacing pre-AI assumptions about exploit timelines with ones that reflect how fast a disclosed vulnerability now turns into an attack. Inventory what you have and reduce the attack surface at the same time, starting with a consequence map for internal critical systems and internet facing systems, and building toward full coverage, generating real access paths, segments, identity information, SBOMs, and ways to contain them, and shutting down anything unmaintained.
Harden your environment with egress filtering, deep segmentation, zero trust, and phishing-resistant MFA for privileged accounts, since these fundamentals still block a large share of real attacks. Build an automated response capability on top of that, so pre-authorized containment actions and playbooks can execute at machine speed once something is caught, and add a deception capability with canaries, honey tokens, and behavioral monitoring that catch attackers by their tactics instead of waiting for a known signature to match.
Only after these controls are running does it make sense to point AI agents at your own systems, code, and pipelines. Ask an agent for a security review of any code this week, then build toward a full audit inside CI/CD and the most critial systems on the consequence map. Require AI agent adoption across all security functions rather than leaving it optional, because optional programs haven't overcome the cultural resistance that slows everything else on this list. And defend the agents themselves: set scope boundaries, blast radius limits, and human override mechanisms before deploying them anywhere near production, since an agent with unchecked privilege is just a new attack surface wearing a helpful face.
There is an important governance step that sits underneath all of this rather than ahead of it. A small cross functional group across security, legal, and engineering whose only job is to clear approval friction so the controls above can move at the speed the threat now requires. It's not a task force for its own sake, it exists to get security what it needs faster.
That's it. The basics we should have been doing already, now needed more than ever.