Your AI Strategy Has a Readiness Problem

Since Mythos dropped on April 7th, the security community has had plenty to say. CISOs are on high alert. Vulnerability teams are rewriting their threat models. Boards are asking questions.

What I haven’t seen is anyone talking about what this means for your engineering investment.

Most of the coverage frames this as a security problem. It isn’t only that. It’s an organisational readiness problem. And the distinction matters enormously if you’re a CIO in a regulated financial services or insurance firm trying to figure out what to do next.

What Mythos actually did

Anthropic’s most capable model to date autonomously scanned complex codebases, chained weaknesses together, and produced working exploits without meaningful human involvement. A 17-year-old FreeBSD kernel vulnerability, one that had survived decades of expert review, was identified and fully exploited in a single session. A 16-year-old Firefox flaw. Hundreds of vulnerabilities across major operating systems that had passed continuous fuzzing for years.

This isn’t a research curiosity. It’s a signal that the cost of finding and weaponising vulnerabilities has dropped dramatically, and that it will keep dropping.

The asymmetry nobody is talking about

Here’s what the security coverage has mostly missed: this is not a symmetric shift.

When a Mythos-class capability exists, whether in Anthropic’s hands, a state actor’s, or eventually a criminal organisation’s, attackers get the benefit automatically. They don’t need to have invested in anything. The capability does the work.

Defenders are different. The same AI that collapses the attacker’s timeline also exists on your side of the board. Agentic engineering can compress the window from “we know about this vulnerability” to “the fix is tested, reviewed, and deployed” from weeks to hours. But only if you’ve built that capability before the clock starts.

The defender’s advantage is real. It is not free.

What the clock actually looks like

When a zero-day drops in a system your firm depends on, you have a window. Historically that window was measured in days or weeks, time to understand the vulnerability, develop a fix, test it, get it through change control, deploy it. Uncomfortable, but manageable.

That window is compressing. Mandiant’s M-Trends 2026 research found that cybercriminals have collapsed the window for defenders to intervene from hours down to seconds in some cases. The patch cycle your firm runs today was designed for a different threat tempo.

AI-powered engineering changes the defender’s side of that equation. A team with mature agentic engineering practice, the tooling, the pipelines, the governance to run AI-assisted changes safely in a regulated environment, can move at a fundamentally different speed than one that doesn’t.

The firms building that capability now are not doing it for productivity. They’re doing it for readiness.

What this means practically

Strategic awareness of Mythos is not enough. The question is whether your organisation is structured to act on it. Four things matter here.

Engineering capability, not just engineering tools. Most firms have individuals experimenting with AI-assisted development. Very few have an organisational capability: consistent tooling, shared practices, the institutional knowledge of how to use AI at pace under pressure rather than just in calm productivity mode. That gap is where the defender’s advantage gets lost.

The architecture that lets you move fast safely. Speed without structure is just risk, and in a regulated environment that risk has a name. The pipelines, test coverage, deployment automation, and change governance that let your team ship a critical fix in hours without bypassing the controls that protect you, that’s an architecture investment, not a tooling decision.

Engineers who can work under pressure with AI, not just alongside it. There is a difference between using AI tools day-to-day and being able to direct them effectively when the stakes are high and the clock is running. That’s a practice problem. It develops through deliberate repetition, not just access to the tools.

Decision-making at speed, with business stakeholders in the room. This is the dimension that rarely appears in engineering or security conversations, but it’s where the real bottleneck often lives. When you have hours instead of weeks, the questions that land on business people are not comfortable ones. Who can authorise an emergency change outside normal governance? Who decides whether a system goes offline while a fix is prepared? Who signs off on a patch that bypasses standard release controls? If your organisation hasn’t rehearsed those decisions, the constraint won’t be the code. It will be the room. Compressed response windows are an organisational readiness problem as much as a technical one, and the business stakeholders who share that responsibility need to know it before the pressure arrives, not during it.

The regulated firm dimension

For financial services and insurance firms, this has a specific shape.

DORA requires you to demonstrate operational resilience, including the ability to respond to ICT incidents within defined timelines. If your patch velocity can’t keep pace with the new threat tempo, that’s not just a security problem. It’s a resilience obligation you may not be meeting.

The EU AI Act adds a layer. If you’re running AI systems in high-risk functions, credit decisions, underwriting, fraud detection, you have continuous monitoring obligations. The architecture that lets you govern those systems is the same architecture that needs to respond fast when something in that stack is exposed.

The question isn’t whether your security team knows about Mythos. Most do. The question is whether your engineering organisation, and the business stakeholders alongside them, have the capability to act on what the security team finds, at the speed the new threat environment demands.

The question that matters

If a critical vulnerability in a system your firm depends on was disclosed tomorrow morning, how long would it take your engineering team to have a fix in production? And how long would it take the right people in your organisation to make the call to act?

If the honest answer to either question is weeks, the problem isn’t awareness. It’s readiness.

The firms that will navigate the Mythos era well aren’t the ones with the best threat intelligence. They’re the ones who invested in engineering capability and decision-making architecture before they needed it.