The first part of our trilogy “Cybersecurity, AI and market transformation”. With the arrival of so-called “frontier” AI models, one question becomes central for security leaders: what happens to cybersecurity when the search for vulnerabilities can be accelerated, automated and multiplied by AI?
01The emergence of frontier models
For a long time, artificial intelligence was seen in cybersecurity as an assistance tool: it helped detect anomalies, triage alerts and speed up analysts’ work.
In 2026, Anthropic introduced Claude Mythos Preview, a model designed in particular for advanced cybersecurity use cases, and OpenAI followed suit with GPT-5.6 Sol. These so-called “frontier” AI models display emergent behaviors: their capabilities have grown sharply thanks to general progress in reasoning, programming and autonomy, rather than through narrow training for one specific use. They can reason over several steps, call on third-party tools, plan, and solve abstract problems across a wide range of domains. [1] [2]
Applied to cybersecurity, this shift marks an important change, because models like Mythos are no longer just better coding assistants. They can understand code, generate scripts, use tools, interpret their results, run an investigation through successive iterations, and even interact with users, forums or machines in order to move toward a set objective.
02The breakthrough is that AI is no longer just an assistant: it can now chain reasoning, action and reassessment on its own, in a real environment.
The disruptions
The functional disruption: from assistive AI to agentic AI
The first disruption concerns the level of autonomy reached in running operations. Recent models can understand a situation, form hypotheses, select tools, interpret their results and decide on the next step. This is the move from assistive AI to agentic AI, able to pursue an objective by adapting its behavior to the results it obtains.
AI does not necessarily replace existing tools. It orchestrates them, speeds up their use and links their results in a sequence of analysis and action. It thus turns a portfolio of tools into an operational chain, able to move from observation to hypothesis, then from hypothesis to action, reassessing its results at each iteration.
This shift brings as many risks as opportunities. The capabilities of these models can serve attackers as much as defenders: to identify vulnerabilities, including zero-day vulnerabilities for which no patch is yet available, to discover sophisticated exploit chains and attack paths by combining several weaknesses, to reproduce an attack, to verify a fix or to test how well a system holds up. For security leaders, the question becomes central: what happens to cybersecurity when the search for vulnerabilities can be accelerated, automated and multiplied by AI?
The time disruption: shrinking the gap between discovery and exploitation
The traditional vulnerability management cycle was already marked by an imbalance between the volume of findings and the capacity to fix them. If AI sharply increases discovery capacity, the backlog of potential vulnerabilities may grow faster than the capacity to handle it. For some vulnerabilities, the exploitation window can now be measured in hours, whereas it was historically often measured in days, which calls for near real-time detection and remediation of critical vulnerabilities. The challenge will therefore not only be to find more flaws, but to decide which ones must be dealt with immediately, which ones can be covered by compensating measures, and which ones carry limited risk in their specific context.
This acceleration also increases the risk of AI models supporting malicious operations. The European Union Agency for Cybersecurity (ENISA) points out that digital dependencies widen the attack surface and that emerging AI models can be used to support such operations. [4]
Cybersecurity is entering a race: the advantage will depend less on having the most powerful model than on the ability to build AI into a complete chain of detection, validation, remediation and oversight.
Delegation and governance of operations
What is certain is that the arrival of these new models imposes a new paradigm. Building AI into remediation processes, with a high level of delegation, may become necessary to stay in the race: delegating an exploration sequence to an agent, asking it to compare several hypotheses and obtaining a summary of the results, and sometimes even letting it act almost autonomously to deploy patches or compensating measures that reduce the risk.
The value of security teams is increasingly shifting toward defining the scope, choosing the permissions and being able to verify the conclusions. Bringing AI into cybersecurity processes also raises the question of governance and guardrails: the line between tool, operator and decision system becomes less clear. An agent with overly broad access can speed up an investigation, but it can also quickly spread an error or a misinterpretation. Organizations need to specify the objectives given to AI agents, the resources they can access, the actions they can carry out automatically, and the situations in which human approval remains necessary.
03The limits of automation and the continued role of human decision-making
AI does not erase technical and organizational complexity
It would be dangerous to conclude that every vulnerability fix will become easy to automate. Business logic flaws, vulnerabilities involving several application states and scenarios that depend on complex relationships between components remain hard to identify. The Center for Security and Emerging Technology notes that some vulnerabilities result from complex combinations of situations and actions. The number of possible scenarios can be so high that no method guarantees exhaustive coverage of every execution path. [3]
AI is effective when it can recognize patterns, produce variants, explore hypotheses quickly and interact with specialized tools. For now, it remains less reliable when the impact depends on business knowledge that is missing from the available data. A vulnerability in a test environment, a development application or a critical service does not carry the same risk. A technically serious flaw may be hard to exploit in a segmented architecture. Conversely, a less spectacular weakness can become a priority when it affects a core service or a shared dependency.
The role of human decision-making is changing
AI does not relieve organizations of the need to assess risk and decide on actions. It changes the speed and scale of operations, but decisions still rest on the technical, business and organizational context. This requires a reliable inventory, identified owners, a map of dependencies, knowledge of how critical each service is, and a view of operational constraints.
NIST (National Institute of Standards and Technology), which publishes reference frameworks and guidance on cybersecurity, points out that the technical and business characteristics of an asset must be taken into account to understand the scope of a vulnerability and guide remediation. [5] Patch management therefore means identifying, prioritizing, installing and verifying updates in a given context. A remediation decision must take into account the change windows allowed by business continuity constraints, service commitments and application interdependencies. AI can recommend an action and compare several scenarios, but it cannot, on its own, weigh all of these constraints. [5]
Human control does not disappear: it shifts from approving each action to defining policies, autonomy thresholds, exceptions and oversight mechanisms.
Remediation in production could gradually move toward self-remediation, provided there are guardrails suited to the operational risk. Critical vulnerabilities could also be handled in a way close to incident response, with contextual assessment, faster mobilization and tighter turnaround times.
The central challenge: organizing knowledge
After Mythos, the challenge will not only be to have new offensive or defensive tools, but to be able to use them in a reliable, contextualized and governed environment. Organizations already have scanners, vulnerability management solutions, application platforms and threat intelligence sources. Their difficulty lies in connecting this information, assessing its relevance and quickly bringing in the right teams.
A company that knows its assets, its dependencies and its processes will be better able to steer AI, check its results and turn its recommendations into operational decisions. Conversely, an organization that does not know which assets it owns, which services they support or which teams are responsible for them risks producing more vulnerability detection results without improving its actual security.
This knowledge is itself a sensitive asset. An accurate map helps direct the defense, but it can also give an attacker a usable picture of the information system. It must therefore be protected, with access controls, integrity safeguards and monitoring of how it is used.
In this context, a CMDB (Configuration Management Database) can provide the knowledge foundation needed to deal effectively with the vulnerabilities found by the latest generation of AI models. This database lists the main components of the information system, such as applications, servers and services, along with their relationships and owners. It makes it possible to link each vulnerability to the asset concerned, the services that depend on it, its criticality level and the teams in charge of fixing it.
The central question then becomes: how can we build a representation of the information system that is reliable and dynamic enough to let AI reason about real risk? The answer does not lie in automation alone, but in organizing the knowledge that makes it useful, controllable and actionable. This knowledge will need to stay up to date enough to keep pace with fast-changing infrastructure, yet governed enough to serve as the basis for auditable decisions.
Only on this condition will AI be able to go beyond simply producing more signals, hypotheses and actions that are hard to control, and become a true pillar of cybersecurity strategies and operations.
References
- Anthropic, “Assessing Claude Mythos Preview’s cybersecurity capabilities”, April 7, 2026, https://www.anthropic.com/research/mythos-preview
- OpenAI, “Previewing GPT-5.6 SOL: a next-generation model”, https://openai.com/index/previewing-gpt-5-6-sol/
- Center for Security and Emerging Technology, Chris Rohlf, “AI and the Software Vulnerability Lifecycle”, August 4, 2025, https://cset.georgetown.edu/article/ai-and-the-software-vulnerability-lifecycle/
- ENISA, “Threat Landscape”, 2026 edition, https://www.enisa.europa.eu/topics/cyber-threats/threat-landscape
- NIST, Special Publication 800-40 Revision 4, “Guide to Enterprise Patch Management Planning”, April 2022, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-40r4.pdf