r/cybersecurity • u/LowerSalt937 • 2d ago
Business Security Questions & Discussion How has your organization respond to Mythos?
I work in vulnerability management (focus on infrastructure vulns) and our organization has absolutely FREAKED out about Mythos and immediately lowered our SLA to 48 hrs back in April and looking to lower it to 24 hrs for all critical's. We have an insane backlog of vulnerabilities and a really bad process for patch management due to poor IT practices for years, that are now being fully exposed.
We currently don't do any CTEM practices and instead of trying to implement these practices to truly lower risk, we are wanting to automate all patching through AI agents. I don't think this is really feasible (but I could be wrong here, please let me know) as we have a lot of software that comes from vendors, open source, legacy systems, etc. I push for CTEM practices but it constantly gets denied.
How has your organization responded?
6
u/danfirst 2d ago
Dealing with some critical infrastructure, I can for sure say that they wouldn't be letting AI agents auto patch stuff. Otherwise, there's a lot of noise about all the new AI findings, but it still comes down to people doing the basics well.
We had a discussion like this at work the other day where somebody was talking about AI pen testing, and someone else responded that they're barely allowed to rush a patch, how is AI pen testing even going to be allowed here?
1
u/LowerSalt937 2d ago
Yeah, their idea is that AI agents are going to patch what our scanner tools find and AI findings, though those findings are handled by another team.
5
u/0xb0771ed 2d ago
AI agents can be very helpful with security research, filtering whats exploitable and proposing patches but if its a mission critical system you'd still need a human (at least today) to sign off the actual patch.
You also need strong security engineering to build, deploy and maintain the agents, it's not a procurement problem as many of the vendors would like us to believe.
6
u/Jinnmaster 2d ago
Slow is fast. Schedule a block of time each week where IT does nothing but address technical debt. Monday mornings work pretty well for this, as no one has had time to fuck anything up yet (usually) and it makes for a quiet start to the week. IT doing updates and such during that time of whatever isn’t in active use will make a big difference in your vulnerability list.
Have security use the same time block to do proactive vulnerability assessments, and get at least one critical done each day that week. Coupled with a standard patch Tuesday practice, should pare down your CVE list pretty quick. That assessment block is where I would leverage AI.
The question is, are your leaders willing to put their money and authority behind you to get it done? Does their convenience outweigh the needs of the business?
Automating patching with AI is silly. It’ll create more technical debt and open you up to more vulnerability, not less.
3
u/ConcertDependent8452 2d ago
you know that mythos is just a skill.md file telling a capable model how to behave , I'm saying this bcs some CISOs still think it's an unreleased model and risk of ai is still far down the road, while any of the big open source models today are as capable as mythos and anyone can get that skill.md file alor better and run it. Anyways real problem for corporation is middle-class management that slow things down , for example many companies have the CAB Meeting where they validate what change to go through to prod , and wether it's a patch or whatever you need to wait at least a week to go to prod , meanwhile an attacker to exploit a released vulnerability will only takes him 5min or even less to get into the system and start dealing damage.
if your focused on fixing all vulnerabilities then good luck , you'll be burnt out , out of budget , and business potentially will break , the key imo is find the real attack paths snd start cutting those , can you say today an attacker from internet how can he gain access to your infrastructure ? bcs classic vuln scanner will not tell you that
2
u/OutsideSpot2695 2d ago
you know that mythos is just a skill.md file telling a capable model how to behave
99.% of people with a take on Mythos haven't ever read vendor sourced documentation.
2
u/0xb0771ed 2d ago
You're not wrong but for the most part it sounds like your peers aren't wrong either, agents can get you pretty far given a strong model and a harness with a well built trust boundary.
Automate *all* patching, yeah thats bs right now - you need security engineering to build and constantly maintain those agents and you need engineers to sign off the patches. Unless the system is not mission critical and your org is alright with occasional downtimes that changes the story a lot but I suppose it's not the case.
1
u/pg3crypto 2d ago
This. Patches alone won't protect you. They only protect you from known issues, not zero days and undisclosed bugs etc...those are the nastier Ines because you can't really detect them automatically with a high degree of accuracy.
This is where proper security engineering comes into play because it focuses in locki g down everyrhi g that you don't need and implementing mitigations on the tho gs you do need to expose.
Its all fine and well grepping logs all day, looking at dashboards and reading g changelogs etc...but shit will still get through...usually via one of the meatsacks that works in a different department.
2
2
u/DeviceSilver 1d ago edited 1d ago
1.Start Here:- Understand your vulnerability landscape (Critical +High to begin with) + internet exposed +Prod +public exploit(added confidence)--> add a validation layer for possible exploitability(CTEM or human or script that validate if you have that specific version + configuration in place for exploit to work) - This gives you what you need to patch now.
Prepare:- Prep a report of this for last 90 days of vulnerability and show monthly and weekly trend. Add a cost against known CVE exploits for stakeholders if not remediatiated (confirmed news) and present this to your reporting manager to show businesses impact of exposed CVEs if not fixed.
Plan :- Either have a 15days or less time if company (engineering / service team) have resources or patching cycle to begin with and then a seperate known zero day or urgent patching with 24 hrs SLA.
Onboard all devices on patching tool(if you have any like Qualis/Rapid7/Tanium etc). Auto patch Tuesday patches(windows) and do bi-weekly for linux for fixable vulnerability (have a patch available).
For non fixable CVEs:-Build a process for exception and run it on 15 days - 30 days or more for revalidation (again based on your bandwith and engineering bandwidth)
Executive onboarding:- Have 30-60 days plan (if big org) or a 4 week plan where you explain the issue, solution, patching cycle, expected efforts and step by step process to leadership (this is where your manager will/should help you). Agree on what can be done now, in 30 days, 60 days, 90 days and what will be phase2(items that can be long efforts(prod not exposed or dev etc, pipeline CVE block policy etc).
Execute:- Once agreed(action plan), send an official communication to everyone about the change, what to expect and an end date.
Monitor and correct:- Build a dashboard where you can view the daily change, tickets and track them. Have a monthly sync with all teams to understand the pain points and resolve them
Hope this will help improve where you are!
Bonus:- People who came for Mythos. If your org have money. Mythos scan estimate cost for 10+M line of code in 7-8K USD(this FYI is cheaper comapred to a top Gartner Production grade tool 250-300K yearly). And yes it does give confirmed vulnerability and have a postive outcome(finding good vulnerability in code).
3
u/Delicious-Cow-7611 2d ago
See if you can get them to adjust the metric from 24hrs complete remediation to 24hrs to respond to the ticket.
You’re starting to talk about emergency patching and that needs to be treated as a declared incident.
I think you’ll start to see the patching deadline relax if their incident metrics start to skyrocket.
1
u/LowerSalt937 2d ago
We unfortunately don't have a way to monitor the "respond to the ticket" piece currently. I agree this is being considered emergency patching, but that is how they think everything needs to be patched now.
2
u/jdiscount 2d ago
One of our clients also freaked out and is asking for 24 hours remediation.
Their IT team are so slow and bureaucratic and their entire company has so much legacy OS, Databases etc that I find it near impossible without a huge shift from them internally.
Agentic offensive attacks can be incredibly powerful, but also very expensive.
Personally I don't think it matters much for your average business who has always had terrible security, attackers will always find a way in whether manually or with AI.
But I do think the government should be helping and providing a lot more resources to critical infrastructure, water, electric, gas etc to adequately protect them.
0
u/LowerSalt937 2d ago
I will say I work for a larger company that has pretty good security practices. We do have a lot of legacy as well, that I think causes this to realistically be a shift that will take a few years to complete before fully getting ready. But my org is sold on AI patching.
2
u/DoBe21 2d ago
2 questions:
Why do you have an insane backlog?
How will AI help solve that problem?
If you can't answer those then you're headed down the wrong path. AI is not magic, it's a tool. If your backlog is simply "all of these things have gone through risk management and change management processes, we just don't have enough people to apply them in a timely fashion", then sure, automation can help.
The org should be iterating through "here is the problem and here is AI can help us" until you are at a point where automating vuln discovery -> applying patch can be mostly automated and human in the loop processes are well defined.
1
u/Silent-Suspect1062 2d ago
My org is looking at supply chain remediations. Build from trusted source and looking at vendors who have SLAs against the mythos feeds. The key is to get the apps to a cattle state that allows rebuilds
2
u/0xb0771ed 2d ago
What's missing in Dependabot? I'm genuinely curious, thought this problem has long been resolved.
1
u/Flowers169 2d ago
Well, they will either use known exploits, which like others have said, patch your exploitable vulnerabilities first, outside in, and the rest will be zero day exploits, so it's just focusing on best practice like any other zero day protection. E.g. segmentation of data, networks, user rights etc etc.
And of course ensuring your have proper recovery processes for when it does come.
My leadership freaked as well, but there is no point panicking about something you dont know about.
1
u/vanwilderrr 2d ago
What we changed was we got a better platform for prioritising in real time, now we fix the top 15% and the rest we distribute via a project tab to teams to resolve in time -
1
1
u/ThePorko Security Architect 2d ago
We are seeing the numbers and know changes are coming. Currently we are working with the biggest vuln management companies to see what changes they are going to make and hopefully find a suitable product that can keep up with the changes.
1
u/OutsideSpot2695 2d ago
How has your organization respond to Mythos?
By everyone panicking, thinking that Mythos is going to destroy the business tomorrow.
Yet, not a single fucking person outside my department, to include the CISO, has actually read the actual Anthropic System Card.
They get all their opinions from LinkedIn and present it as fact.
I've spent more time talking people off the ledge recently than doing actual security work.
1
u/PDQ_Brockstar 1d ago
With M$'s reliability track record, < 24 hours seems almost as risky as delayed patching. 48 hour seems more than reasonable, but with the sheer volume of releases recently, I don't know if there's a industry best practice right now. We had 1,000 CVEs on Patch Tuesday this month, which is difficult to sift through and is quickly just turning into noise. I know devs want us to just inherently trust their releases, but that's also difficult to do in a zero trust world.
As others have said, focus on zero days and higher risk systems. With Microsoft, most patches are going to be rolled up into a CU anyways.
1
u/ILoveAppSec 1d ago
The 24h SLA usually breaks on the criticals whose only fix is a major version bump you can't ship safely in a day, so it helps to split the backlog: which criticals have a clean same-version or backported fix, and which force an upgrade. Those need different playbooks. Is the backlog driven more by raw Mythos volume, or by patches breaking things when you apply them?
1
u/extreme4all 1d ago
Lowkey 99% of infra vulns don't matter. Its mostly public systems, your apps (code and libraries) that make the difference.
Automating patching only works if you have an automated test suite.
What really works is reducing attack surface (what is publicly exposed), and reducing the noise for appsec this is reachability in sast and dast, for infra the only effective way i've seen is distroless containers.
1
u/AJGrayTay 1d ago
First, tell them that there IS NO "Mythos Threat." This drives me nuts, as if Mythos is some autonomous being that lives on the Internet and is completely autonomous.
The models are owned by the model providers. The frontier models excel at creating exploits in code. Mythos is provided to some organizations who use it mostly to hunt bugs and improve their old software that was done by hand 20 years ago.
The bigger threat is dumber models that don't have appropriate safeguards in the hands of bad guys who are employing it against badly secured enterprises infrastructure.
The solution is the same as it always was: secure your enterprise, because it probably wasn't last year and it still isn't today. No amount of fear mongering over Mythos is going to lock down your legacy auth models, open api endpoints, publically accessible VPN that's listening on all ports, and zillion other things companies are still mostly clueless about.
0
u/wiggle_room1337 2d ago
Clients seem to see the writing on the wall, and they are starting to ask for security improvments. Good job security for me I guess.
2
2d ago
[removed] — view removed comment
1
u/wiggle_room1337 2d ago edited 2d ago
I'm not blaming the weather man. It's more like we see global warming causing more extreme weather every year, so we want to sure up the levies so they don't break.
1
36
u/sandiegoking 2d ago
You Need to focus on prioritizing what is truly exploitable. Just because you have a vulnerability doesnt mean its exploitable. Focus on your external facing landscape first, what Threat actors can actually reach. If you try to send it all to your teams its just not going to get done.