The Paradox

Cybersecurity has a jobs problem, and it isn’t the one the industry keeps telling you about.

Open LinkedIn on any given week and you’ll see two stories running side by side, as if they have nothing to do with each other. One says the field is short 4.8 million people and begging for talent. The other is a layoff announcement. Sometimes they’re posted by the same company, in the same quarter. I’ve stopped being surprised by it. I’ve started being angry about it.

I do this research because I think the people trying to build a career in this field deserve better than what they’re currently getting, which is a mix of recycled statistics, vendor talking points, and advice from people who have something to sell them. I have no course to sell. No certification bootcamp, no “10x your resume in 30 days” program, no affiliate link waiting at the bottom of this piece. What I have is a degree I paid for, a research background I actually enjoy using, and a low tolerance for organizations that say one thing publicly while their own numbers say another. If that makes this piece less comfortable for a few well-known names in this industry, so be it. I’d rather be useful to the person reading this than popular with the people I’m writing about.

Here’s the paradox in the numbers everyone already cites. Indeed’s Hiring Lab has security postings sitting at 113% of their pre-pandemic baseline. It’s the only major tech category still above where it was in February 2020 [1]. CyberSeek tracks over half a million open cybersecurity roles in the U.S. alone [2]. The Bureau of Labor Statistics projects 29% growth for information security analysts through 2034, with a median salary north of $124,000 [3]. Read those three numbers on their own, and cybersecurity looks like the last stable island in a tech industry that’s otherwise cutting headcount everywhere you look.

Now read the same industry’s own workforce data. ISC2’s 2025 Cybersecurity Workforce Study surveyed over 16,000 practitioners. It found that 32% of large organizations reported layoffs in the past year. 46% reported budget cuts. 49% reported hiring freezes. 41% froze promotions [4]. That’s nearly half the field’s largest employers pulling back at the exact moment the industry’s own marketing insists they’re desperate to hire.

Both of those pictures can’t true at the same time. I get that the answer is more nuanced and complicated than cherry-picked stats. But complicated isn’t the same thing as unknowable. I think a lot of the confusion here originates with the people who benefit from it staying confusing. I’m here to call out who has spent years telling us a version of the truth that happens to boost their bottom line, ie. the organizations who profit off the fantasy.

None of this is a case against working in cybersecurity. It’s a case against believing what you’re told about working in cybersecurity without asking who’s telling you, and what they get out of it if you believe them.

The Number That Wasn’t What It Said It Was

Every cybersecurity recruitment page you’ve seen probably cites the same number: “4.8 million unfilled jobs, global, and growing.” It comes from ISC2’s Cybersecurity Workforce Study, the largest and most frequently cited survey of the profession. It’s also a gross misrepresentation of reality.

That number is the result of ISC2 researchers asking survey respondents, mostly hiring managers and security leaders, how many additional people their organization would need to feel fully secure. The response gets aggregated against an estimate of the existing workforce, and the difference becomes “the gap.” It’s a measure of aspiration, not a count of open job requisitions. ISC2’s own CISO, Jon France, said as much on the record in Dark Reading: “For clarity, that doesn’t mean there is 4.8 million jobs out there” [5]. He described it instead as an estimate of how much the profession would need to grow to reach the security level respondents believe is necessary.

That distinction sat mostly unchallenged for years. It started to crack in October 2024, when Ira Winkler, CISO at CYE, wrote an open letter to ISC2’s board. Winkler had spent time talking with unemployed cybersecurity professionals frustrated by headlines promising abundant work they couldn’t find. His letter accused ISC2 of knowingly pushing a false narrative of a plentiful job market [6]. Ben Rothke, a senior information security manager at Experian, made a related point publicly. He tied the criticism directly to the marketing that fuels get-rich-in-cybersecurity training programs [7]. Jon Brandt at ISACA added the practical rebuttal. People can respond to any survey and say they need twenty more people, he said, but unless an organization is actively hiring, that isn’t a data point worth weighing [8].

ISC2 heard the criticism. The 2025 Cybersecurity Workforce Study, based on a record 16,029 respondents, dropped the workforce gap estimate entirely. The organization reframed the conversation around critical skills needs instead of headcount [9]. Read plainly, that’s a walk-back. A body with real influence over how tens of thousands of career decisions get made quietly retired its most quoted statistic after practitioners called it out in public.

This doesn’t mean cybersecurity teams are fully staffed, or that hiring is easy. StationX’s breakdown of the available data separates what’s actually being measured into three different problems that keep getting collapsed into one number. A skills gap exists in specific technical areas. A staffing gap is driven mostly by budget rather than a lack of candidates. And a hiring gap shows up wherever employers demand years of experience for roles labeled entry-level [10]. Those are three distinct issues with three distinct solutions. None of them get solved by more people earning a degree or a cert on the promise of a shortage that isn’t quite what it claims to be.

The Center for Strategic and International Studies raised a version of this same concern years before Winkler’s letter went public. Their analysis questioned whether cybersecurity workforce development programs and education pipelines were preparing people for the roles the field claims to need [11]. The pattern isn’t new. What changed is that practitioners finally pushed back enough that the organization behind the number had to answer for it.

“AI Did It,” Cybersecurity’s Version of a Bigger Story

Cybersecurity isn’t running its own show here. It’s playing a smaller part in a much bigger production, and the script was written well before anyone in this industry picked up a copy.

Between January and June 2026, Challenger, Gray & Christmas tracked U.S. tech employers announcing 139,156 job cuts, an 83% jump over the same period in 2025. AI was named as the reason for four consecutive months, a streak the outplacement firm says has no precedent in its data [12]. Read those layoff announcements and you’d think artificial intelligence had suddenly become capable of doing the work of six-figure engineers and analysts overnight. Read the people who study labor markets for a living, and a different story shows up.

Sam Altman called it “AI washing.” He’s acknowledged that almost every company doing layoffs blames AI whether AI is actually the reason or not [14]. Marc Andreessen was more blunt about the mechanism. He argued companies are using AI as a “silver bullet excuse” for correcting pandemic-era overhiring, staffing he estimates left large tech firms 25 to 75 percent overstaffed [13]. Wharton’s Peter Cappelli explained that companies say AI will cover the work, but most of them haven’t confirmed that it will. They’re hoping it does [15]. Deutsche Bank saw this coming in January 2026, predicting that “AI redundancy washing” would define the year [16].

The receipts back up the skeptics more than the headlines do. Gartner surveyed 350 executives at companies actively deploying AI in May 2026 and found that the firms cutting headcount the most showed no better financial returns than the firms cutting the least. Some of the companies that cut the least actually outperformed the heaviest cutters [17]. Meta is a clean example of the underlying math. The company grew from 48,000 employees in the first quarter of 2020 to more than 87,000 by the third quarter of 2022, hiring aggressively through the zero-interest-rate years before the cuts started. That overhiring needed correcting whether or not a single AI model ever entered the building [18].

None of this is abstract for the people losing their footing in cybersecurity specifically. Marketplace’s reporting followed Megan Osteen, a career-changer who did the coursework, earned a certification, and still couldn’t find an opening. It also followed JVS, a Bay Area job training nonprofit that pivoted into cybersecurity training when entry-level IT work dried up and is now questioning whether to keep the program running at all [19].

Go back to what ISC2’s own 2025 workforce data showed. Budget cuts overtook talent scarcity as the leading cause of staffing shortages for the first time the study has tracked it [4]. That’s the same story playing out inside cybersecurity’s own numbers, just with a security badge pinned to it instead of a general tech one. Companies aren’t cutting security analysts because a model learned to do their job. They’re cutting them because the same budget pressure hitting every other tech function is hitting this one too, and “AI” is a more comfortable line to put in a press release than “we hired too many people and now we’re fixing it.”

The On-Ramp is What’s Actually Collapsing

Here’s where I think a lot of the panic gets aimed at the wrong target. The question people keep asking is whether AI will replace cybersecurity. The better question is what happens to the bottom rung of the ladder once AI can do most of what used to live there?

Let’s start with what’s shrinking. Entry-level cybersecurity postings, the ones asking for under a year of experience, fell from 25% of listings in 2022 to 17% today. Only 15% of new cybersecurity hires are people starting their careers for the first time. More than half, 52%, come from inside the existing talent pool, people already working in cybersecurity moving to a new role. Another 28% convert in from adjacent, non-cyber jobs [20]. Add those together and new entrants are competing for a sliver of a sliver.

Practitioners see it happening too. In one survey, 52% of cybersecurity professionals said they expect AI to reduce demand specifically for entry-level roles like Tier 1 SOC analysts, the job most people use as their first foothold in the field. Only 2% think AI will eliminate the cybersecurity profession outright [21]. That gap is the difference between a field contracting and a field reshaping itself at the bottom while staying intact everywhere else.

There’s a more optimistic read of the same data. An ISC2-linked workforce survey found that 44% of organizations are reconsidering roles and skill requirements because of AI tool adoption, but 31% think AI adoption could create new entry-level roles rather than eliminate them, work adjacent to monitoring and validating AI tools that didn’t exist before those tools did [22]. This shift is happening in real time and the dust has not settled. No one can be certain right now what the AI-powered workforce will look like, let alone how it will be reflected in job titles.

Job postings are a harder thing to argue with than survey sentiment, though. InterviewStack analyzed 5,379 active cybersecurity engineer postings in June 2026 and found that AI-skill requirements show up in 17% of senior and staff-level postings, compared to 9.3% of entry-level ones [23]. If AI skills were genuinely opening a new front door for beginners, you’d expect that ratio to run the other way. Instead, the people being asked to bring AI fluency to the job are mostly the people who already have the job.

Cybersecurity isn’t disappearing. The on-ramp into it is.

Nobody Is Tracking Whether the Pipeline Actually Works

The “on-ramp” to a career in cyber is often linked to achieving a degree in the discipline. Which begs the question, of everyone who’s earned a cybersecurity degree in the last several years, how many are actually working in cybersecurity? I went looking for a real answer. What I found instead is that nobody appears to have built the instrumentation to know.

The closest thing to an authoritative source is a federal report from NCSES, the National Center for Science and Engineering Statistics, produced through RTI International. It’s the kind of unglamorous government research that doesn’t get cited in recruitment marketing, and reading it, it’s easy to see why. The report states plainly that only 46% of people working in cybersecurity core occupations hold a degree closely related to their field of work [24]. More than half of the people currently doing this job didn’t get there through a cybersecurity degree at all.

The same report goes further. Its authors warn that counting cybersecurity graduates as a measure of workforce supply likely overestimates the actual pipeline, because completing a cybersecurity degree doesn’t mean that person ever works in cybersecurity [24]. The federal government’s own researchers are telling us that the numbers schools and certification bodies use to justify the shortage narrative don’t hold up under their own methodology.

Meanwhile, more people are enrolling than ever. Program completions across all cybersecurity award levels grew from 10,013 in 2016 to 23,746 in 2021, a roughly 19% average annual growth rate that outpaces general degree program growth by a wide margin [25]. More students are walking in the front door of these programs every year. Nobody is tracking, in any rigorous public way, how many of them walk out the other side into an actual cybersecurity job.

I’ll put myself in this data, because I have a cybersecurity degree, circa 2022, but I never became a SOC analyst, a penetration tester, or an incident responder. Instead I landed in technical marketing for a cybersecurity vendor, work I genuinely love and I’m good at, but not what most people enrolling in these programs picture when they sign up. I got lucky, and I found a lane that used what I learned without requiring me to compete for the shrinking entry-level technical roles. Most people don’t get that lane handed to them. What they get instead is a degree, a stack of student loans, and a job search that never quite lands where the brochure said it would.

This is structural failure in a broken system, and it’s the missing piece in every conversation about the cybersecurity shortage. The industry has spent years measuring how many people it needs. It has never bothered measuring what happens to the people who show up.

The Schools Selling the Credential Won’t Publish Their Own Results

There are a handful of schools that show up constantly in cybersecurity career search results and ads when someone searches “cybersecurity degree online.” Top of my mind are University of Maryland Global Campus, University of Phoenix, Southern New Hampshire University, and Western Governors University. UMGC is my alma mater. I paid for that degree, and I still believe it was worth doing. But, I’m not willing to look away from what these schools do and don’t tell prospective students about what their money actually buys them. Spoiler: it’s not likely an entry-level role in cybersecurity.

Three of the four use nearly identical language to avoid saying anything specific. University of Phoenix’s cybersecurity careers page states that its cited salary ranges are not specific to students or graduates, and that the university offers no guarantee of “employment, salary level or career advancement” [27]. UMGC doesn’t publish a placement rate or a starting-salary figure for its cybersecurity programs at all. Its marketing leans instead on its NSA-designated Center of Academic Excellence status and an EC-Council partner-of-the-year award [28]. SNHU repeats a nearly identical line across at least four separate program pages, stating that its cited projections aren’t based on SNHU graduate outcomes and don’t guarantee actual salary or job growth [29]. That kind of identical, boilerplate language across a school’s entire site usually isn’t a voluntary transparency choice. It reads like standardized compliance language, the minimum a school has to say to satisfy federal disclosure rules, dressed up next to national growth statistics that have nothing to do with anyone who actually attended.

WGU is the more interesting case, because WGU does publish something. Its retention and graduation page cites a 2024 Harris Poll finding that 87% of graduates report being employed in their degree field, along with a 94% employer satisfaction figure and a 97% rehire-willingness figure [30]. On the surface, that looks like real disclosure, more than the other three schools combined. Then you find the footnote on WGU’s own cybersecurity program page, sitting right next to that same statistic. It cites a 2024 Harris Poll of 1,655 WGU graduates, and specifies that the survey was sent to “a representative sample of WGU graduates from all colleges” [35]. WGU is telling you, in its own words, on the cybersecurity page itself, that the number wasn’t measured for cybersecurity students. It’s an institution-wide figure covering business, nursing, teaching, and IT alike, borrowed and placed under a cybersecurity headline as if it belonged there.

The federal earnings data that does exist tells a partial story. College Scorecard-derived figures put UMGC’s Computer Information Systems bachelor’s graduates at a median of $75,619, above the $61,300 national median for that major. SNHU’s come in lower, $61,322 for a bachelor’s and $76,081 for a master’s. WGU’s sit highest of the four at $84,242 for the same bachelor’s category. University of Phoenix’s numbers vary so much by campus that some of them are built on cohorts of two graduates, which makes “median” a technically true but practically meaningless word here [31]. None of these figures isolate cybersecurity specifically. They’re Computer Information Systems numbers, a broader category that cybersecurity sits inside, because the federal government’s own data doesn’t cleanly separate out cybersecurity outcomes any better than these schools do.

The bottom line here is that four of the most heavily marketed cybersecurity degree programs in the country cannot show you verified data on what happens to their cybersecurity graduates specifically. Three hide behind a disclaimer. One borrows a number that was never about cybersecurity in the first place and lets you assume otherwise. My own degree came from one of these four schools, and even I can’t tell you, from anything they’ve published, how many people who sat in my classes ended up doing this work.

Who’s Selling the Gap

The schools aren’t the only ones with a stake in keeping the shortage story alive. I want to widen the lens here, because I’ve been citing one particular data source throughout this piece without saying who’s actually behind it. CyberSeek, the tool that tracks over half a million open U.S. cybersecurity jobs, the number I used back in Section 1, is a collaboration between Lightcast, NIST, and CompTIA [36]. CompTIA is a certification-selling trade association. The same organization co-producing the “neutral” job-opening count everyone cites, including me, also sells Security+, the certification most frequently recommended as the fix for that opening count. It’s worth knowing before you treat any single number in this space as disinterested.

EC-Council runs the same play from the education side. The organization named UMGC its Academic Partner of the Year in 2023 [37], the same year it was selling the Certified Ethical Hacker exam that UMGC’s curriculum is partly built around. ISC2, already covered in Section 2, deserves a second mention here. The organization that had to walk back its own 4.8 million figure is also the body behind the CISSP, the single most requested certification in cybersecurity job postings [38]. It’s diagnosing the shortage and selling the credential meant to fix it, twice over, from the same source.

Bootcamps follow the university playbook almost exactly, just with shorter timelines and better marketing copy. Industry-wide figures circulated by Course Report and the NACE Early Career Salary Survey claim 70 to 80 percent job placement within six months, with median starting salaries between $50,000 and $65,000 [39]. Those numbers come from the bootcamps themselves. Nobody outside the industry audits them. It’s the identical structural problem from Section 6, just wearing a hoodie instead of a cap and gown.

That pattern shows up at the individual level too. Evan Lutz built a following in the early 2020s teaching people a specific roadmap: get a Security+ certification in a couple of months, walk in with zero experience, land sixty thousand dollars a year. He’s said publicly that the roadmap he built his name on no longer works [40]. I respect that he corrected course when faced with current reality. Most of the people still selling variations of that same roadmap haven’t.

Search “how to break into cybersecurity” and most of what comes back reads like career advice. Read it closely and a lot of it is course marketing wearing blog post clothing [41]. The incentive is the same one running through every section of this piece so far. Convince someone the door is narrower than it is, or wider than it is, whichever version sells more seats.

The most expensive bet in the industry.

One of these certification factories has been pawning courses at outrageous prices and getting away with it for a very long time. I’m looking at you, SANS.

A single SANS course bundled with its matching GIAC certification runs roughly $9,779, before renewals [42]. SANS’s own institute arm, SANS.edu, charges $41,650 for a two-year bachelor’s degree and up to $22,800 for a graduate certificate [43]. A full year of in-state tuition at most public universities costs less than a single SANS course. Plus, SANS doesn’t discount the way most training vendors do. One analysis of the pricing pointed out that this training is realistically priced for the person whose company pays for it, not the person paying for it themselves [44]. That’s a telling admission. This isn’t a product built for the job seeker paying out of pocket. It’s a product built for corporate training budgets, marketed as though an individual could reasonably afford it.

In 2026, SANS’s own workforce report named skills gaps, not headcount, as the industry’s biggest challenge for the first time in the report’s three-year history [45]. Read that next to the price tag. The organization sounding the loudest alarm about a widening skills gap sells one of the most expensive fixes for it in the entire industry.

None of this means certifications are worthless or that bootcamps never work. Some of them do, for some people. What it means is that almost every voice telling you how urgent this shortage is, and how fast you need to move to close it, has a seat to sell you. That makes them a source you should read the same way you’d read a car salesman’s opinion on whether you need a new car.

Still Want a Job in Cyber? Here’s How.

If you’ve read this far, you might reasonably ask whether I think anyone should still try to break into cybersecurity right now. My honest answer is, not without a backup plan. Don’t treat it as your only bet. The entry-level door is narrower than the marketing says, and pretending otherwise doesn’t help anyone walk through it faster. What I can tell you is what actually seems to move the needle for the people who are getting hired in this market, based on who’s saying it and how they’re saying it.

Start with the bar itself, because it moved. Matthew Hartman at Merlin Group put it well when he told Dice that the bar for entry has risen. Employers now want candidates who can show hands-on experience and apply AI tools in practical ways, not just recite what a certification taught them [46]. That’s a real shift, and it’s a fair one to be frustrated by. It’s also not optional to ignore.

Evan Lutz, the coach I mentioned earlier who’s walked back his own old roadmap, is proof that the people closest to this market are recalibrating in public. Take that as a signal, not a discouragement.

Dr. Gerald Auger, who’s spent over twenty years in this field, gives advice that I wholly agree with based on my own experience. Hands-on work and genuine community presence beat chasing another certification. Common mistakes he warns against are relying too heavily on job boards, and underinvesting in personal brand and networking [47]. I’d add one more, based on everything I’ve learned. Don’t assume a degree alone is the credential that opens doors. It’s one input among several, not the whole plan.

There’s a portfolio argument worth taking seriously too. The strongest candidates aren’t the ones with the most certifications stacked on a resume. They’re the ones who can produce bounded, specific technical work that another practitioner could review and trust: a documented detection, a real authorization test, a clean technical write-up [48]. That’s harder to fake than a cert, and it’s harder to automate away than a checklist.

Here’s where I’ll say something as a marketer, because it’s the truth and I live it every day. The job search method that works right now isn’t throwing applications into an AI-flooded hiring pipeline and hoping volume wins. You have to show up consistently in the rooms where people in this field talk to each other, online and off, and let your work speak before you ever ask anyone for anything. Warm introductions get read. Cold applications get filtered by a system built to filter them. What we marketers call “personal brand” is really your professional reputation and you build that by engaging with people in the community, contributing to the conversations, and yes, once in a while giving yourself a public pat on the back for your achievements. It’s the mechanism that still works when everything else in this market is working against you.

None of that is a guarantee. Nothing in this piece has been. But if you’re going to bet real time and real money on breaking into this field, bet on the things that are still true. Hands-on proof over credentials. Relationships over resumes. A backup income plan while you build both.

The Moral of The Story

Every organization named in this piece would tell you they value evidence over hype. That’s the entire professional identity cybersecurity has built for itself. Read the data, follow the threat, don’t trust a claim you can’t verify. I’m holding them to their own standard.

I’m not the first person to say any of this out loud. Ira Winkler wrote an open letter to ISC2’s board, and the organization walked back its own headline number within a year. Ben Rothke put his name on a public critique of the training-marketing machine and kept his job at Experian. Neither of them got run out of the industry for saying what a lot of people were already thinking.

I know some people reading this are afraid to say any of it themselves. Their employer might be a partner of one of the organizations named here. Their own credentials might come from the certification body they’d be criticizing. The conference that pays their travel budget every year might stop inviting them to speak. Cybersecurity is a smaller industry than it looks from the outside, and burning a bridge with a group like ISC2 or SANS can follow you for years.

I get it. I’m just not going to let that fear be the reason nobody writes this down, with the sources attached.

If you’re building a career in cybersecurity, or thinking about starting one, you deserve the real picture and not the one that happens to be good for enrollment numbers or certification revenue. Now you have a fuller view and can make informed career decisions of your own.

References

[1] StationX, “Cybersecurity Job Market Statistics and Trends [2026],” StationX, 2026. [Online]. Available: https://app.stationx.net/articles/cybersecurity-job-market-statistics

[2] CyberSeek data, cited in Programs.com, “How Many Cybersecurity Job Openings Are There? (2026),” 2026. [Online]. Available: https://programs.com/resources/open-cybersecurity-jobs/

[3] U.S. Bureau of Labor Statistics, “Information Security Analysts,” Occupational Outlook Handbook, 2026. [Online]. Available: https://www.bls.gov/ooh/computer-and-information-technology/information-security-analysts.htm

[4] ISC2, “2025 Cybersecurity Workforce Study,” Dec. 2025. [Online]. Available: https://www.isc2.org/Insights/2025/12/2025-ISC2-Cybersecurity-Workforce-Study

[5] Dark Reading, “Has the Cybersecurity Workforce Peaked?” Nov. 2024. [Online]. Available: https://www.darkreading.com/vulnerabilities-threats/cybersecurity-workforce-peaked

[6] Infosecurity Magazine, “ISC2 Survey Reveals Critical Gaps in Cybersecurity Leadership Skills,” Dec. 2025. [Online]. Available: https://www.infosecurity-magazine.com/news/isc2-gaps-cybersecurity-leadership/

[7] Dark Reading, op. cit. [5] (B. Rothke commentary).

[8] Dark Reading, op. cit. [5] (J. Brandt, ISACA, commentary).

[9] ISC2, op. cit. [4].

[10] StationX, “Cybersecurity Skills Gap Statistics [2026]: The Real Data,” 2026. [Online]. Available: https://app.stationx.net/articles/cybersecurity-skills-gap-statistics

[11] Center for Strategic and International Studies, “The Cybersecurity Workforce Gap.” [Online]. Available: https://www.csis.org/analysis/cybersecurity-workforce-gap

[12] TechTimes, “AI Leads US Job Cuts for Record 4th Month as Tech Claims 31% of H1 Layoffs,” Jul. 2026. [Online]. Available: https://www.techtimes.com/articles/319588/20260703/ai-leads-us-job-cuts-record-4th-month-tech-claims-31-h1-layoffs.htm

[13] TechTimes, op. cit. [12] (M. Andreessen commentary).

[14] TechTimes, op. cit. [12] (S. Altman commentary).

[15] TechTimes, op. cit. [12] (P. Cappelli commentary).

[16] TechTimes, op. cit. [12] (Deutsche Bank analyst commentary).

[17] TechTimes, “Tech Layoffs Hit 1,115 a Day in 2026: Companies Cite AI but Cuts Fail to Boost Returns,” Jun. 2026. [Online]. Available: https://www.techtimes.com/articles/318466/20260616/tech-layoffs-hit-1115-day-2026-companies-cite-ai-cuts-fail-boost-returns.htm

[18] TechTimes, op. cit. [17] (Meta headcount data).

[19] Marketplace, “It’s a tough time to break into cybersecurity,” May 2026. [Online]. Available: https://www.marketplace.org/story/2026/05/18/ai-is-making-it-harder-to-get-a-cybersecurity-job

[20] Programs.com, “Cybersecurity Graduate Unemployment & Skills Mismatch Statistics (2026),” 2026. [Online]. Available: https://programs.com/resources/cybersecurity-graduate-unemployment/

[21] AnalyticsInsight, “How AI is Transforming Cybersecurity Hiring in 2026,” May 2026. [Online]. Available: https://www.analyticsinsight.net/artificial-intelligence/how-ai-is-transforming-cybersecurity-hiring-in-2026

[22] Dark Reading, “AI Won’t Wipe-Out Entry-Level Cybersecurity Jobs,” Jun. 2026. [Online]. Available: https://www.darkreading.com/cybersecurity-operations/ai-wont-wipe-out-entry-level-cybersecurity-jobs

[23] InterviewStack, “Cybersecurity Engineer AI Skills in 2026: Agents Lead, Defense Lags,” Jun. 2026. [Online]. Available: https://interviewstack.io/blog/how-ai-is-changing-cybersecurity-engineer-2026

[24] National Center for Science and Engineering Statistics / RTI International, “Cybersecurity Workforce Supply and Demand Report.” [Online]. Available: https://ncses.nsf.gov/760/assets/0/files/ncses-cwdi-supply-demand-report.pdf

[25] Gray DI, “Cyber Breaches Drive Demand For Cybersecurity,” Dec. 2024. [Online]. Available: https://www.graydi.us/blog/graydata/when-bad-news-is-good-news-cyber-breaches-drive-demand-for-cybersecurity-programs

[27] University of Phoenix, “The Complete Guide to Careers in Cybersecurity and Information Systems.” [Online]. Available: https://www.phoenix.edu/blog/the-complete-guide-to-careers-in-cybersecurity-and-information-systems.html

[28] University of Maryland Global Campus, “Cybersecurity” program page. [Online]. Available: https://www.umgc.edu/cybersecurity

[29] Southern New Hampshire University, “Cybersecurity Degree Online Bachelor of Science (BS)” and “Is a Cybersecurity Degree Worth It?” [Online]. Available: https://www.snhu.edu/online-degrees/bachelors/cyber-security ; https://www.snhu.edu/about-us/newsroom/stem/is-a-cybersecurity-degree-worth-it

[30] Western Governors University, “Retention and Graduation Rates at WGU.” [Online]. Available: https://www.wgu.edu/about/measuring-impact/retention-graduation-rates.html

[31] College Factual (College Scorecard-derived earnings data), Computer Information Systems program pages for University of Maryland Global Campus, Southern New Hampshire University, Western Governors University, and University of Phoenix. [Online]. Available: https://www.collegefactual.com/colleges/university-of-maryland-university-college/academic-life/academic-majors/computer-information-sciences/computer-information-systems-cis/ ; https://www.collegefactual.com/colleges/southern-new-hampshire-university/academic-life/academic-majors/computer-information-sciences/computer-information-systems-cis/ ; https://collegefactual.com/colleges/western-governors-university/academic-life/academic-majors/computer-information-sciences/computer-information-systems-cis/bachelors/chart-average-salary.html ; https://www.collegefactual.com/colleges/university-of-phoenix-florida/academic-life/academic-majors/computer-information-sciences/computer-information-systems-cis/

[35] Western Governors University, “Cybersecurity Courses Online – Bachelor’s Degree,” program page footnote citing 2024 Harris Poll methodology. [Online]. Available: https://www.wgu.edu/online-it-degrees/cybersecurity-information-assurance-bachelors-program.html

[36] Dark Reading, op. cit. [5] (CyberSeek / CompTIA / Lightcast / NIST collaboration).

[37] University of Maryland Global Campus, op. cit. [28] (EC-Council Academic Partner of the Year, 2023).

[38] ISC2, op. cit. [4] (CISSP certification data), cross-referenced with StationX, op. cit. [1] (CISSP as most-requested certification in postings).

[39] Research.com, “Cybersecurity Degree vs Bootcamp vs Certificate: Which Path Leads to Better Career Outcomes?” May 2026. [Online]. Available: https://research.com/advice/cybersecurity-degree-vs-bootcamp-vs-certificate-which-path-leads-to-better-career-outcomes

[40] Marketplace, op. cit. [19] (E. Lutz commentary).

[41] Pattern observed across vendor “how to break in” content, representative examples: FusionCyber (fusioncyber.co) and ITU Online (ituonline.com).

[42] Netguardia, “SANS GIAC Certifications: Which Ones Are Worth the $8K Price Tag?” Apr. 2026. [Online]. Available: https://netguardia.com/learning-development/certifications/sans-giac-certifications-which-ones-are-worth-the-8k-price-tag/

[43] SANS Technology Institute, “Tuition.” [Online]. Available: https://www.sans.edu/admissions/tuition

[44] Netguardia, op. cit. [42].

[45] Industrial Cyber, “SANS 2026 report flags cybersecurity skills crisis, putting critical infrastructure and OT sectors at measurable breach risk,” Apr. 2026. [Online]. Available: https://industrialcyber.co/reports/sans-2026-report-flags-cybersecurity-skills-crisis-putting-critical-infrastructure-and-ot-sectors-at-measurable-breach-risk/

[46] Dice.com, “Cybersecurity Careers: Advice for Grads Navigating an AI-Driven Job Market,” May 2026. [Online]. Available: https://www.dice.com/career-advice/cybersecurity-careers-advice-for-grads-navigating-an-ai-driven-job-market

[47] ClearanceJobs, “Breaking Into Cybersecurity and AI: Career Advice from the Expert,” Feb. 2026. [Online]. Available: https://news.clearancejobs.com/2026/02/09/breaking-into-cybersecurity-and-ai-career-advice-from-the-expert/

[48] Penligent, “Cybersecurity Jobs in 2026,” Apr. 2026. [Online]. Available: https://www.penligent.ai/hackinglabs/cybersecurity-jobs-in-2026/

I feel like I’m stating the obvious here, but stay with me.

The industry has spent years building elaborate systems to help organizations figure out which vulnerabilities to patch first. An entire market category worth billions is dedicated to helping teams manage a backlog that only grew faster than they could work through it.

Those tools exist precisely because everyone already knew patch-first defense wasn’t really working. You don’t build sophisticated triage systems for problems you’re keeping up with. The whole architecture of modern vulnerability management is, if you squint at it, an admission that we were always losing the race.

Mythos made that impossible to ignore. I go into depth in my previous article “Cybersecurity in a Post-Mythos World,” if you want more background. The bottom line is, we are never going to patch fast enough. But here’s what I want to talk about now, because I think a lot of the post-Mythos conversation is missing it.

Vulnerability discovery is not how most organizations get breached.

The way attackers get in has been evolving for years, and AI just turned up the dial on every vector simultaneously. So while the industry is busy processing the “vulnpocalypse,” I want to make sure we’re also looking at the five other doors attackers are walking through.

You Were Never Going to Patch Your Way Out of This

Of course we still need to patch and perform routine product updates, but more as an exercise in hygiene; not security. Proactive LLM-assisted discovery of vulnerabilities in your own code is probably the way forward here [1]. But, organizing your entire security posture around reactive patching of externally disclosed CVEs is a strategy that was already struggling before AI entered the picture, and now it’s functionally over.

IBM’s take on the Mythos moment is, “for the first time in the history of this field, response is now the binding constraint, not discovery.” [2] When the window between a vulnerability being disclosed and someone weaponizing it is down to hours, a patch cycle measured in days or weeks is not going to save you.

Stop treating patching as your primary line of defense. The attackers figured out a long time ago they don’t have to wait for you to miss one.

Five Other Doors

1. The Human Layer

The oldest attack surface there is, and it keeps working because humans are still humans.

Phishing. Vishing. Social engineering. Fake websites. Impersonation. AI didn’t invent any of these. What AI did was remove the friction that made them expensive to run at scale.

Before, convincing spear phishing required skilled operators with real time to invest. Deepfakes were nation-state territory. Building a convincing fake site took effort. That’s all gone now.

AI powers over 80% of social engineering activity today [3]. AI-generated phishing emails hit a 54% click-through rate compared to 12% for human-crafted ones. That’s a 4.5x multiplier at 95% lower cost [4]. Voice cloning from three seconds of audio is a commodity. In 2024, an engineering firm called Arup wired $25.6 million after a video call where everyone on screen except the victim was an AI-generated deepfake [5]. These are old tricks, now with super powers.

The fact remains, AI is not yet the root cause of most breaches [6]. The weaknesses AI exploits were already there. It just made the attacks cheaper and more convincing. The doors were already unlocked.

What to do: Phishing-resistant MFA based on FIDO2 or passkeys — not app-based TOTP, which is vulnerable to adversary-in-the-middle attacks. Strong identity verification at the help desk that goes beyond knowledge-based questions. Out-of-band verification for high-value financial transactions, because voice and video are no longer reliable identity signals. The defense exists and is underdeployed.

2. The Web, Content, and Prompt Injection Layer

This one is genuinely new, and the industry has not fully reckoned with it yet.

Your AI agents browse the web, read documents, process emails, and query databases on your behalf. Every piece of external content they touch is a potential injection vector. And they cannot tell the difference between legitimate content and content containing hidden instructions designed to make them do something they shouldn’t. The Five Eyes joint guidance called prompt injection the most persistent and difficult-to-fix threat in agentic AI stemming from a fundamental design constraint of language models [7]. This is just how these systems work.

MCP (Model Context Protocol) is the connective tissue of the agentic ecosystem. It enables agents to connect to tools, data sources, and external services. Anthropic introduced it in late 2024 as the standard for connecting AI agents to external tools and services. Google, Microsoft, and OpenAI adopted it quickly. Gartner projects 75% of API gateway vendors will have MCP features by end of 2026 [18]. It’s becoming the connective tissue of the agentic ecosystem faster than anyone expected.

A few specific flavors worth knowing:

• Tool poisoning is when malicious instructions get embedded in a tool’s description, the text an agent reads to understand what to do. The agent follows those instructions because it trusts the description.

• Rug pull attacks are when a tool behaves legitimately during review, then changes behavior afterward. Most governance processes evaluate tools once at onboarding.

• Cross-tool contamination is when one compromised MCP server influences the behavior of other legitimate tools through a shared reasoning context.

None of these are fixable with a patch because none of them are bugs. They’re properties of how agents process trust. The CSA’s MCP Security Crisis report documented a systemic architectural flaw affecting an estimated 200,000 vulnerable instances across a supply chain of 150 million package downloads, a design default in every official MCP SDK [9]. Most downstream developers don’t know it yet.

What to do: You can’t patch it, but you can architect for it. Sandbox your agents. Constrain what they’re architecturally capable of, not just what they’re permitted to do. Implement human review for high-stakes actions before they execute. Treat every external data source your agent touches as untrusted by default.

3. The Identity and Access Layer

AI agents are identities. They authenticate to your cloud environment through service accounts, IAM roles, and API keys, the same as any other non-human identity in your environment. And because an agent that can’t interact with your data and systems isn’t particularly useful, they get access. Often a lot of it.

92% of cloud identities with access to sensitive permissions have not used those permissions in over 90 days [10]. Those identities exist across your environment right now, loaded with access granted at setup and never revisited. AI agents inherit these same overpermissioned patterns because they’re added into environments where over-privilege is already the norm.

AI agents amplify the risk because they’re genuinely good at lateral movement. An agent with broad cloud permissions can enumerate what’s accessible, pivot across connected systems, query data stores, trigger downstream actions, and chain those operations autonomously. The problem is they may not use access paths in the ways you intended, with potentially harmful consequences.

There are documented kill chains from 2025 where the only “exploit” was a valid overprivileged credential combined with an agent that could act on it. No malware required. No sophisticated technique. Just an identity with too much access and a system designed to use it [10].

What to do: Constraining capability at the identity layer, not just the policy layer. Policies can be misconfigured, inherited, or quietly expanded. Architectural constraints on what an identity can structurally do are harder to bypass. Active blocking of permissions that aren’t being used. Just-in-time issuance for anything sensitive instead of standing elevated access. Gartner has named Non-Human Identity security as a foundational control layer for the agentic era [11]. The goal is a smaller blast radius when a credential is inevitably exposed.

4. The Software Supply Chain and Secrets Layer

This one has been around forever. It’s just gotten worse faster.

API keys committed to public repos. Database passwords in config files. AWS credentials that accidentally made it into version control. GitGuardian found 28.65 million new hardcoded secrets in public GitHub commits in 2025, a 34% year-over-year increase and the largest single-year jump they’ve ever recorded [12]. This happens because developers scaffold projects, wire integrations, test API calls, and commit working code before anyone has sorted out where credentials should live, who owns them, or how they rotate.

To make matters worse, AI-assisted commits leak secrets at 3.2% versus a 1.5% baseline, roughly double [12]. And 64% of valid secrets from 2022 are still active and exploitable today [12]. That’s four years of keys sitting in the wild, never rotated.

A leaked credential in 2020 required a human attacker to manually figure out what to do with it. In 2026, that same credential can set off an AI agent that autonomously enumerates access, exfiltrates data, pivots through SaaS integrations, and documents everything for the next phase of the attack, all before anyone notices something is wrong.

What to do: Secrets scanning in CI/CD before commit. Short-lived credentials everywhere that matters. MCP configuration files treated with the same care as production secrets. Git history audited, not just current code. Credential rotation as a standing practice, not an incident response step.

5. The Third-Party Integrations Layer

Most organizations don’t primarily run their own code anymore. They run SaaS. And their AI agents are doing work inside that SaaS, taking actions and moving data across platforms in ways that are genuinely difficult to monitor.

Most third-party AI tools entered organizations the same way SaaS always has, through browser-based apps, OAuth integrations, and user-driven adoption rather than centralized IT approval [13]. The governance infrastructure for SaaS was already stretched. Agents multiplied the connections, automated the actions, and made the data movement harder to track.

Breaches with third-party involvement increased 60% year over year [6]. One in three enterprises experienced a security incident involving AI agents in the past year [14]. 30.8% experienced unauthorized data exfiltration through SaaS-to-AI integrations, and 83.4% say their current tools can’t reliably distinguish between human and non-human behavioral patterns [14].

This is where credentials get used, where prompt injection arrives through documents and emails, where leaked secrets do real damage, and where the blast radius of any initial compromise expands through connected integrations. It connects back to every other layer. And most organizations haven’t extended their security thinking to cover it yet.

What to do: Start with inventory. The Five Eyes recommend enumerating all agentic deployments before anything else [7]. Build an allow-list of approved integrations to include MCP servers, OAuth connections, and SaaS tools, and treat non-listed connections as blocked by default. Use behavioral monitoring to understand what normal looks like for an agent and spot when something is off. The challenge here is applying enforcement. What this layer requires is the ability to intercept agent actions before they complete.

The Point

Stop initial compromise. We’re not going to win this battle by patching faster or scoring CVEs better. We need to stop the attacker from walking through the front door in the first place, as much as reasonably possible.

Patching vulnerabilities is, how do I say, like using mouthwash after brushing your teeth. It’s helpful. It’s good hygiene. It just isn’t the primary line of defense anymore. Admittedly, “defense” in this brave new world is feeling like a lot of spend with little worth. Still, layers. Defense in depth. You know the drill.

The next obvious move is to assume breach. Because, the fact is, vulns will be discovered and exploited. Credentials will be compromised. The question becomes what happens next. How do you reduce blast radius, limit what an attacker or a compromised agent can do once they’re in, and minimize the damage before anyone notices? That’s where I’m headed.

References

[1] Anthropic Red Team, “Mythos Preview: Technical Disclosure,” Anthropic, Apr. 2026. https://red.anthropic.com/2026/mythos-preview/

[2] IBM, “The Mythos Moment When Discovery Outpaces Defense,” IBM Think Insights, Apr. 2026. https://www.ibm.com/think/insights/the-mythos-moment-when-discovery-outpaces-defense

[3] Abnormal Security, cited in StationX, “Social Engineering Statistics 2026,” StationX, May 2026. https://app.stationx.net/articles/social-engineering-statistics

[4] Brightside AI, cited in Vectra AI, “AI Scams in 2026: How They Work and How to Detect Them,” Vectra AI, Mar. 2026. https://www.vectra.ai/topics/ai-scams

[5] Vectra AI, “Social Engineering Attacks: Types, Examples, and Defense,” Vectra AI, 2026. https://www.vectra.ai/topics/social-engineering

[6] Verizon, “2026 Data Breach Investigations Report,” Verizon, 2026. https://www.verizon.com/business/resources/reports/dbir/

[7] CISA, NSA, ASD ACSC, Canadian Centre for Cyber Security, NCSC-NZ, NCSC-UK, “Careful Adoption of Agentic AI Services,” Joint Guidance, Apr. 30, 2026. https://media.defense.gov/2026/Apr/30/2003922823/-1/-1/0/CAREFUL%20ADOPTION%20OF%20AGENTIC%20AI%20SERVICES_FINAL.PDF

[8] CSO Online, “MCP is Fueling Agentic AI -- and Introducing New Security Risks,” CSO Online, Sept. 11, 2025. https://www.csoonline.com/article/4015222/mcp-uses-and-risks.html

[9] Cloud Security Alliance, “MCP Security Crisis: Systemic Design Flaws in AI Agent Infrastructure,” CSA Labs, May 4, 2026. https://labs.cloudsecurityalliance.org/research/csa-research-note-mcp-security-crisis-20260504-csa-styled/

[10] Sonrai Security, “Cloud Access Risk Report: Overprivileged and Zombie Identities Data,” Sonrai Security, 2026. https://sonraisecurity.com/cloud-access-data-report/

[11] Gartner, Inc., “Gartner Identifies the Top Cybersecurity Trends for 2026,” Press Release, Feb. 5, 2026. https://www.gartner.com/en/newsroom/press-releases/2026-02-05-gartner-identifies-the-top-cybersecurity-trends-for-2026

[12] GitGuardian, “State of Secrets Sprawl 2026,” GitGuardian, Mar. 17, 2026. https://www.gitguardian.com/state-of-secrets-sprawl-report-2026

[13] Cloud Security Alliance, “Why SaaS and AI Security Will Look Very Different in 2026,” CSA Blog, Jan. 29, 2026. https://cloudsecurityalliance.org/blog/2026/01/29/why-saas-and-ai-security-will-look-very-different-in-2026

[14] K. Huang, “The Agentic Ecosystem Security Gap: What 500 CISOs Just Told Us About the Breach You Haven’t Had Yet,” Agentic AI (Substack), Apr. 14, 2026.

Agentic AI

The Agentic Ecosystem Security Gap: What 500 CISOs Just Told Us About the Breach You Haven’t Had Yet

Recently I read a very interesting article shared by Elias Terman from Vorlon…

Read more

3 months ago · 20 likes · 1 comment · Ken Huang

Since the idea of agentic-powered “sustained attrition” attacks hit me, it has literally kept me up at night. Not in a vague, ambient anxiety kind of way. In the specific, wide-awake-at-3-AM kind of way where you keep turning a problem over because you can’t find the answer and you’re not sure anyone else has found it either.

Understanding a problem can feel like progress, even when the solution isn’t obvious yet. I’ve spent weeks deep in research about cybersecurity in a post-Mythos world, specifically on backup, recovery, and business continuity, when this potential scenario surfaced in my mind. All the playing pieces are on the board. The game is being written as we speak.

I wish my investigation of this possibility resulted in finding a viable solution. I came up mostly empty. I think the security community needs eyes on this problem, before the scenario I’m about to describe starts to hit the news cycle at scale. I believe there are smart people working on problems just like this. I hope practitioners, researchers, insurers, regulators, and vendors will start building toward a response.

The Scenario That Woke Me Up

Let me describe what sustained attrition looks like in practice. I hope to be useful to defenders without being a how-to for attackers. The goal is to paint the picture clearly enough that security teams can start designing against it.

It is 2:47 AM on a Tuesday. An AI agent deployed by an external adversary identifies an entry point. The credential was a valid API key sitting in a public MCP configuration file on GitHub, active for over a year, never rotated. The agent gains a foothold and immediately does what agentic systems do. It enumerates what systems are reachable, what agents are running with what permissions, and where the backup infrastructure lives. It discovers paths that lead to your crown jewels. The reconnaissance happens continuously and automatically, not in a defined pre-attack phase.

Your monitoring detects anomalous behavior at 3:15 AM. The alert fires. An on-call engineer wakes up. Incident response begins. Containment. Isolation. The start of a recovery process that, even with best-in-class tooling, will take hours. For large environments with significant data volumes, days.

Here is what the agent is doing during your recovery.

It already mapped three alternative entry points during the initial enumeration. Two of those paths are still open because the isolation was incomplete in the chaos of 3 AM response. The agent isn’t waiting for a human decision to try the next one. It adapted, and it persisted.

Attack 2 lands at 6:30 AM. Your team hasn’t finished recovering from Attack 1. Now they are managing two simultaneous incidents. The first is in mid-restoration, and now another one is just beginning. A senior engineer is making prioritization decisions. Was the clean recovery point for the systems affected in Attack 1 verified, or did someone assume it was clean because the verification step got skipped in the pressure of a second active incident?

The agent doesn’t have this problem. It doesn’t get tired. It doesn’t skip verification steps. It doesn’t make the mistakes that humans make at hour six of a sustained response. The asymmetry is total, and it compounds with every cycle.

Shall I state the obvious here? This is bad. Like how Egon from Ghostbusters explains that crossing the streams of their proton packs would be “bad.” Like, total protonic reversal and every molecule in your body exploding at the speed of light kind of bad. I’m being a touch dramatic. But you get my point.

The Building Blocks Are Already Here

This isn’t just the fever dream of a cybersecurity-educated marketer. The components exist and are documented in the wild.

On November 13, 2025, Anthropic published a disclosure that should have stopped the security industry cold: “Disrupting the First Reported AI-Orchestrated Cyber Espionage Campaign” [1]. In mid-September 2025, Anthropic detected a Chinese state-sponsored group that had jailbroken Claude Code and used it to autonomously infiltrate roughly thirty global targets including large tech companies, financial institutions, chemical manufacturers, and government agencies. The attack was not AI-assisted. It was AI-executed.

The specifics matter for what I am about to argue.

The attackers broke their campaign into small, seemingly innocent tasks that Claude executed without being given the full context of their malicious purpose. At peak activity, the AI made thousands of requests, often multiple per second. The threat actor performed 80 to 90 percent of the campaign using AI, with human intervention required only sporadically, for approximately four to six critical decision points per hacking campaign. That is a nearly fully autonomous attack, with humans providing strategic direction and little else.

Later, in the final phase, the attackers had Claude produce comprehensive documentation of the attack to include files of stolen credentials, analyzed systems, and identified high-privilege accounts, specifically to assist in planning the next stage of operations. The agent was not just executing the current attack. It was actively preparing the next one while the current campaign was still running.

That is the “attrition model,” documented in a primary Anthropic disclosure, in September 2025.

Malwarebytes’ 2026 State of Malware report documents the broader shift in attack economics: AI agents can now run multiple simultaneous intrusions autonomously, create exploits from patches in minutes, and outperform elite human researchers. Small crews or single operators can now execute reconnaissance, lateral movement, and extortion at a scale and speed previously reserved for large, experienced intrusion teams [2].

The persistence property is the key differentiator. Barracuda’s 2026 threat analysis found that agentic AI can plan, adapt, and persist autonomously, turning multi-stage attacks into continuous operations. It doesn’t stop after a failed attempt. It continues trying until it finishes the operation or is shut down. The agent must be purged completely to be contained [3].

Read that last sentence again. The agent must be purged completely to be contained. Not just the encrypted files restored. Not just the compromised account reset. The agent and every foothold it had established must be identified and eliminated. That is a fundamentally different containment requirement than anything current incident response playbooks are built around.

The government and critical infrastructure attack data further substantiates this threat. Since March 2026, an Iranian-affiliated APT group has disrupted programmable logic controllers deployed across multiple US critical infrastructure sectors including government services, water and wastewater systems, and energy, causing operational disruption and financial loss [4]. CISA and allied agencies confirmed these efforts were designed to “cause disruptive effects within the United States.”

My point is that persistent, AI-augmented operational disruption against critical infrastructure is happening now.

The Leverage This Creates for Attackers

The attacker in this scenario doesn’t need to encrypt anything. They don’t need to exfiltrate anything. They only need to demonstrate that they can keep you offline indefinitely. One successful attrition cycle, where Attack 2 lands before full recovery from Attack 1, is proof of concept. Then the demand arrives.

The demand isn’t “pay us to decrypt your data.” It’s “pay us and we stop.”

That demand is backed by demonstrated capability, not just a threat. And the amount they can credibly demand is not “what is your data worth to you?” It’s “what is every hour of operational unavailability costing you, with no natural endpoint?” For a large enterprise at $14,056 per minute of downtime, the math is catastrophic. For a healthcare system that cannot process patient records, a financial institution that cannot execute transactions, or a logistics company that cannot move product, it’s game over.

Intel 471 found extortion breaches surged 63% in 2025, with Qilin RaaS introducing “structured data analysis audits designed to increase leverage over targets.” The extortion ecosystem is innovating on leverage mechanisms. The attrition model is the logical next innovation in that progression [5].

The victim’s negotiating position in this scenario is weaker than any ransomware situation, because there is no recovery path that resolves the underlying threat. You can restore from backups after ransomware and be done with it. You cannot restore your way out of an adversary who can reliably trigger the next incident before you finish recovering from the last one. The leverage is not in the data. It is in the cadence.

Resilience Insurance predicted that the extortion-only model with no encryption, only pure operational disruption as leverage, may represent the majority of extortion incidents by the end of 2026. We are already watching this transition happen. The attrition model is where it leads when AI removes the cost constraint on repeated attacks [6].

The Reference Point Everyone Is Working From

Ransomware has been the defining threat model of the last decade. It has a known playbook. Security teams have practiced it. Cyber insurance was built around it. Regulators have guidance for it. Negotiators specialize in it.

The ransomware model is the attacker gets in, identifies and encrypts your data, disables backup agents, erases recovery points, and presents a demand. You can pay the ransom or restore from backups. Either way, there is a defined endpoint. The attack is over. The damage is quantifiable. The clock starts on recovery.

That model, as damaging as it has been, assumes that the attacker wants a transaction. They want payment. Once they have it, or once you’ve restored and they’ve moved on, the incident concludes.

Palo Alto’s Unit 42 2026 Global Incident Response Report, analyzing over 750 major cyber incidents across 50 countries, documents that encryption-based extortion declined 15% as more attackers skip encryption entirely and move to operational disruption as their primary leverage mechanism. The industry is already shifting away from the model we’ve practiced for [7].

VikingCloud describes where it’s heading: “Ransomware gangs have figured out that encrypting files is only one way to hold a business hostage. They prioritize availability, not just data. If 800 stores go down for six hours, the financial impact far exceeds the ransom amount” [8].

And Resilience Insurance’s Tom Egglestone tells us that “Cyber extortion is entering its next phase. By 2026, attacks will no longer rely solely on encryption or data theft but will combine multiple tactics in sequence. Adversaries are discovering that the most effective leverage comes from sustained, multi-layered disruption that touches every part of an organisation’s operations” [6].

This is the direction of travel. The threat model everyone has been preparing for is already being replaced by something worse.

Why Current Backup, Recovery, and Business Continuity Plans Would Be Useless

This is the rabbit hole I found as I was thinking about the business continuity problem when agentic adversaries enter the picture.

Current backup and recovery architectures are designed to survive one bad event with immutable backups, clean recovery points, cleanroom restoration environments, and rapid identification of uncompromised data. These are all valuable, necessary, and partially effective for a single catastrophic event. They are not designed for sustained attrition attacks.

Commvault’s cleanroom recovery creates an on-demand, secure, isolated environment where organizations can test recovery plans, conduct forensic investigations, and execute production recoveries without risking further disruption [9]. That is a good approach for single-event resilience. But a cleanroom gives you clean data to restore to. It doesn’t solve the problem that the environment you are restoring into is being actively probed for the next attack while you are still in the cleanroom. What if the restoration and the next attack are running in parallel?

Keiser University’s BCDR analysis notes that disaster recovery and business continuity “skyrocketed from not even in the top 10 in 2024 to number three in 2025” among CISO priorities, and that the average cost of downtime is $14,056 per minute. Organizations are paying attention to this. But paying attention to single-event recovery speed is a different problem from designing for repeated attack cycles [10].

Current Recovery Point Objective and Recovery Time Objective frameworks were designed for one bad day. They tell you how much data you can afford to lose and how quickly you need to restore. They do not tell you what to do when the next attack arrives before the current restoration is complete. They do not account for a scenario where the question is “what is our RTO relative to the attacker’s next strike cadence?”

When it comes to business continuity plans, what does your organization do while primary systems are in recovery? Most organizations have given this insufficient thought for a single event, let alone what it should look like when a campaign of continuous attacks renders backup and recovery methods useless.

Like I said, I don’t have the full answer to this. I don’t think anyone does yet. The vendors building recovery tooling are doing important work. Veeam’s Intelligent ResOps, Cohesity’s clean room, Commvault’s synthetic recovery, and Rubrik’s threat hunting are real innovations addressing real problems. But they are all solving for single-event resilience. The sustained attrition scenario is a different engineering problem, and I don’t see evidence that anyone has fully designed for it yet.

The Government and Critical Infrastructure Dimension

I cannot help imagining another terrible use case for this type of attack.

A private company facing operational attrition loses revenue, reputation, and customer trust. That is serious. It is potentially existential for smaller organizations. It is recoverable over time for larger ones.

A government agency facing operational attrition loses the ability to deliver services that citizens depend on. The downstream human cost of extended operational unavailability is not measured in dollars. It is measured in people who don’t receive medical care, emergency response that doesn’t arrive, critical infrastructure that stops functioning.

The ODNI’s Annual Threat Assessment 2026 makes the geopolitical context explicit. China, Russia, Iran, and North Korea are all actively targeting US critical infrastructure. Ransomware groups are shifting to faster, high-volume attacks. AI’s influence is deepening across offensive operations [11].

On April 23, 2026, the Executive Office of the President issued a memorandum to heads of all executive departments warning of threats from foreign entities engaged in “deliberate, industrial-scale campaigns” to attack US systems [12].

The Atlantic Council adds an institutional vulnerability that compounds the threat: CISA is operating without a confirmed director, has seen significant workforce reductions, CIRCIA’s final rule has been delayed to May 2026, and the Cybersecurity Information Sharing Act lapsed in September 2025 with only a temporary extension. The threat is escalating at precisely the moment institutional capacity to respond has been weakened [13].

The scenario of a coordinated, AI-orchestrated attrition campaign against multiple government agencies simultaneously, making critical services unavailable on demand, is not science fiction. It is a logical application of capabilities that are documented in the wild today, directed at a target set that is publicly acknowledged to be under sustained attack, at a moment when the defensive institutional infrastructure is under-resourced.

I find that genuinely frightening. I think you should too.

The Insurance Gap Nobody Has Closed

Cyber insurance was built for the ransomware model involving a defined incident, quantifiable loss, and a recoverable situation. TechTarget’s analysis of the next generation of attacks is that cyber insurance won’t cover them. Full stop. The GAO has identified a gap in the Terrorism Risk Insurance Program. Cyberattacks must be violent or coercive to qualify, which is a threshold most state-sponsored operations don’t meet. 23% of private-sector organizations already rate their cyber resilience as insufficient [14].

Insurers are now defining “widespread events” in ways that limit aggregate exposure, adding exclusions that may restrict coverage when multiple policyholders are affected simultaneously [15]. A coordinated attrition campaign that affects multiple organizations through shared infrastructure fits exactly this exclusion.

The attrition scenario breaks every assumption insurance was built around. When does the incident start? When does it end? What is the quantifiable loss when the attacker never encrypts anything, only keeps triggering recovery cycles? How do you file a claim for “we were intermittently unavailable for three weeks due to repeated AI-orchestrated attacks with no defined endpoint”?

The answer is you probably can’t. Not under any policy that currently exists. And there is no federal backstop for it.

Starting Points, Not Solutions

I have not found a viable solution to the attrition problem. I did find starting points. These are ways to begin thinking and building that are better than what most organizations are doing right now. The full solution requires innovation that hasn’t happened yet.

Ask the question nobody is asking about your RTO. Your Recovery Time Objective was designed for one event. Ask instead: what is our RTO relative to likely attack cadence? A four-hour RTO is excellent if attacks arrive every three days. It is operationally useless if attacks arrive every two hours. You cannot answer this question until you ask it.

Map your Minimum Viable Operations before an incident. What does your organization need to function at the bare minimum while primary systems are in recovery? What can you do manually, in degraded mode, or through alternate channels? What are the three to five systems or processes that, if you could only keep those running, you could survive? In a sustained attrition scenario, this answer is the difference between functioning and collapse.

Treat backup infrastructure as outside the blast radius of your entire agentic environment. Policy-isolated isn’t going to cut it. We need architecturally isolated with separate credentials and separate network paths. No agent in your production environment should be able to reach your backup infrastructure. If any agent can reach it, assume it eventually will. Immutability is necessary but not sufficient. An immutable backup system that is reachable for enumeration is still giving an attacker a map.

Use short-lived credentials everywhere that touches recovery. This means every backup service account, recovery tool, and administrative credential that touches backup infrastructure. A credential that expires in fifteen minutes has a fraction of the usefulness of one valid for four years when the scenario involves repeated exploitation cycles. GitGuardian found that 64% of valid secrets from 2022 are still active and exploitable in 2026. That is the population of credentials sitting in your environment that an agentic attacker can use to reset after each recovery cycle [16].

Test recovery under realistic degraded conditions. Organizations that regularly test disaster recovery plans recover 50% faster from cyber incidents. But the relevant test for attrition isn’t a scheduled, fully-staffed DR drill under calm conditions. It’s a simulated second incident arriving before the first one is resolved. It’s a deliberately understaffed response team making decisions under pressure at hour six. It’s a verification step that gets skipped. Test the conditions you will actually face, not the conditions under which your plan works perfectly.

Pre-authorize containment actions and build playbooks for sustained incidents. The Five Eyes guidance is that human approval loops are too slow for machine-speed attack cadence. Decisions that can be pre-authorized should be. Playbooks for sustained multi-incident scenarios should exist before they are needed [17].

Have the board conversation about the cost model. The financial model for attrition is categorically different from ransomware. There is no ransom payment to budget for. There is no defined recovery point after which normal operations resume. The cost is pure operational loss with no natural endpoint. Boards that have modeled one catastrophic event have not modeled thirty-six hours of intermittent unavailability with no endpoint. Those are different numbers. They need to be in front of the people making investment decisions.

A Call to the Community

The thought of an agentic-powered adversary running repeated attack sequences against an organization or a government agency, while current backup, recovery, and business continuity plans prove completely inadequate to the cadence of the attack is, to me, one of the most urgent unsolved problems in security today.

And it is unsolved. Some vendors are working on pieces of it. The researchers are circling adjacent problems. The regulators are writing frameworks for single-event resilience that don’t contemplate this scenario. The insurance industry is acknowledging coverage gaps without designing products for what comes next.

If you are thinking about this, I want to hear from you. If your organization is working on it, I want to know. If you have TTPs that defenders can use today, even partial ones, share them. The community needs them.

The operational attrition threat model needs dedicated attention from people with the expertise and resources to build defenses against it. I’ve described it as clearly as I can. Now I’m asking the people who can actually build the response to take it seriously.

Because the alternative, waiting until this scenario plays out at scale against a major enterprise or a critical government agency, is not a risk I’m comfortable accepting.

-- Laura Kenner

Share

References

[1] Anthropic, “Disrupting the First Reported AI-Orchestrated Cyber Espionage Campaign,” Anthropic News, Nov. 13, 2025. https://www.anthropic.com/news/disrupting-AI-espionage

[2] Malwarebytes, “2026 State of Malware Report,” Malwarebytes, 2026. https://www.malwarebytes.com/resources/files/2026/02/malwarebytes-2026-state-of-malware-report.pdf

[3] Barracuda, “Agentic AI: The Next Frontier in Cybersecurity,” Barracuda Blog, Feb. 2026. https://blog.barracuda.com/2026/02/27/agentic-ai-the-next-frontier-in-cybersecurity/

[4] Industrial Cyber, “Ongoing cyberattacks targeting internet-connected PLCs disrupt US critical infrastructure,” Industrial Cyber, Apr. 8, 2026. https://industrialcyber.co/cisa/ongoing-cyberattacks-targeting-internet-connected-plcs-disrupt-us-critical-infrastructure-agencies-warn/

[5] Intel 471, “2026 Cyber Threat Trends & Outlook,” Intel 471, Feb. 2026. https://industrialcyber.co/reports/intel-471-reports-extortion-breaches-surged-63-in-2025-with-sustained-activity-expected-in-2026/

[6] T. Egglestone, “Cybersecurity and Insurance Predictions for 2026,” Resilience, Feb. 24, 2026. https://cyberresilience.com/blog/cybersecurity-and-insurance-predictions-2026/

[7] Palo Alto Networks Unit 42, “2026 Global Incident Response Report,” Feb. 2026. https://www.paloaltonetworks.com/blog/2026/02/unit-42-global-ir-report/

[8] VikingCloud, “7 Cybersecurity Trends That Will Define 2026,” VikingCloud Blog, Jan. 12, 2026. https://www.vikingcloud.com/blog/7-cybersecurity-trends-that-will-define-2026

[9] Commvault, “Cleanroom Recovery Innovations Enable a New Era in Cyber Resilience,” Commvault Blog, Nov. 19, 2025. https://www.commvault.com/blogs/cleanroom-recovery-innovations-enable-a-new-era-in-cyber-resilience

[10] Keiser University, “Business Continuity vs Disaster Recovery,” Keiser University Blog, Feb. 25, 2026. https://www.keiseruniversity.edu/business-continuity-vs-disaster-recovery/

[11] ODNI, “Annual Threat Assessment 2026,” Office of the Director of National Intelligence, Mar. 2026. https://industrialcyber.co/reports/odni-report-us-critical-infrastructure-faces-escalating-cyber-risks-from-china-russia-iran-and-north-korea/

[12] Epstein Becker Green, “Critical Infrastructure at Risk: Project Glasswing Urges Attention to AI-Driven Cyber-Risks,” Workforce Bulletin, May 2026. https://www.workforcebulletin.com/critical-infrastructure-at-risk-project-glasswing-urges-attention-to-ai-driven-cyber-risks

[13] Atlantic Council, “Securing Cloud Infrastructure for AI,” Issue Brief, Mar. 31, 2026. https://www.atlanticcouncil.org/in-depth-research-reports/issue-brief/securing-cloud-infrastructure-ai/

[14] TechTarget, “Why Cyber Insurance Won’t Cover the Next Generation of Attacks,” TechTarget, Mar. 26, 2026. https://www.techtarget.com/searchcio/feature/Why-cyber-insurance-wont-cover-the-next-generation-of-attacks

[15] Insurance Thought Leadership, “Cyber Insurance Exclusions to Expect in 2026,” Dec. 4, 2025. https://www.insurancethoughtleadership.com/cyber/cyber-insurance-exclusions-expect-2026

[16] GitGuardian, “State of Secrets Sprawl 2026,” GitGuardian, Mar. 17, 2026. https://www.gitguardian.com/state-of-secrets-sprawl-report-2026

[17] CISA, NSA, ASD ACSC, Canadian Centre for Cyber Security, NCSC-NZ, NCSC-UK, “Careful Adoption of Agentic AI Services,” Joint Guidance, Apr. 30, 2026. https://media.defense.gov/2026/Apr/30/2003922823/-1/-1/0/CAREFUL%20ADOPTION%20OF%20AGENTIC%20AI%20SERVICES_FINAL.PDF

[18] Resilience, “Cyber Risk Shifts From Disruption to Long-Tail Losses,” Insurance Journal, Feb. 25, 2026. https://www.insurancejournal.com/news/national/2026/02/25/859511.htm

[19] Defense One, “Pro-Iran hackers appear to increase critical infrastructure cyberattacks,” Defense One, Apr. 17, 2026. https://www.defenseone.com/threats/2026/04/iran-hackers-infrastructure-cyberattacks/412941/

[20] Object First, “Object First Survey: 89% of IT Leaders Fear AI-Powered Cyberattacks Will Cost Them Their Data,” Press Release, Mar. 31, 2026. https://www.businesswire.com/news/home/20260331825488/en

[21] Veeam, cited in TechRadar, “Ransomware attackers are going after backup storage to force you to pay up,” TechRadar, 2025. https://www.techradar.com/news/ransomware-attackers-are-going-after-backup-storage-to-force-you-to-pay-up

[22] Vantagepoint, “Cyber Resilience: Building Business Continuity in an Era of Inevitable Breaches,” Mar. 18, 2026. https://vantagepoint.io/blog/sf/cyber-resilience-building-business-continuity-in-an-era-of-inevitable-breaches

[23] CSA CISO Community et al., “The ‘AI Vulnerability Storm’: Building a ‘Mythos-ready’ Security Program,” v1.0, May 1, 2026. https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/05/mythosreadyv1.0.pdf

I’ve spent the last several weeks deep in the research on Claude Mythos, Project Glasswing, and what the security community is saying about what comes next. The most honest, well-sourced voices in cybersecurity are all circling the same uncomfortable question. What now?

This piece is my attempt to synthesize what I found. My goal is to give you enough grounding in the evidence that you can think through the implications yourself, and enough links that you can go further on your own. Practical recommendations will follow in separate articles. This one is about understanding the problem clearly first.

This is a long one because there’s a lot to cover, so hang in there. Turn on that screen reader and let’s do this.

Subscribe now

About Mythos

On April 7, 2026, Anthropic announced Claude Mythos (Preview) alongside Project Glasswing, described as possibly the largest multi-party vulnerability coordination effort in history [1]. The reaction was immediate and unusually broad, reaching boardrooms, legislative offices, and national security agencies within days.

By May 1, six national cybersecurity agencies had issued the first-ever joint guidance specifically on agentic AI security: CISA, the NSA, Australia’s ASD ACSC, the Canadian Centre for Cyber Security, New Zealand’s NCSC, and the UK’s NCSC all signed on to “Careful Adoption of Agentic AI Services” [2]. When six governments move that fast on something, it’s worth paying attention to why.

So what did Mythos actually demonstrate? Three things, specifically.

1. Discovery velocity changed. Mythos generated 181 working Firefox exploits under conditions where Claude Opus 4.6 succeeded only twice [3]. It autonomously identified a 27-year-old vulnerability in OpenBSD, a 16-year-old flaw in FFmpeg that had survived five million automated test runs, and a remote code execution vulnerability in FreeBSD. These weren’t edge cases found under ideal conditions. The Anthropic red team technical disclosure is worth reading in full.

2. The skill floor collapsed. A 3.6 billion parameter model costing $0.11 per million tokens can now detect complex bug classes [4]. Mythos-class capability isn’t confined to Anthropic or well-resourced state actors. AISLE’s “jagged frontier” analysis shows that many of the vulnerability classes Mythos identifies can be reproduced by small, inexpensive open-weight models [5]. The controlled access Glasswing established is time-limited.

3. Chained exploitation became accessible. Mythos identifies vulnerabilities composed of multiple primitives chained together -- scenarios requiring multiple memory corruption bugs combined into a single exploit path -- in a single prompt, without scaffolding [3]. Prior to this, chained exploitation required patient, skilled adversaries with time to burn. That constraint no longer applies.

The autonomous exploitation rate trajectory tells the story clearly: GPT-5 achieved 18% in September 2025, Claude Sonnet 4.5 achieved 22% the same month, GPT-5.4 hit 90% by March 2026, and Claude Opus 4.6 hit 98% by February 2026 [4]. That is not a gradual progression. That is a cliff.

The Problem Mythos Exposed, Not Created

The CSA CISO Community briefing, co-authored by Gadi Evron, Robert T. Lee of SANS, and contributions from Jen Easterly, Bruce Schneier, Heather Adkins, Phil Venables, and roughly seventy CISO reviewers, frames the situation this way: Current patch cycles, response processes, and risk metrics are not ready for AI-driven discovery and exploitation of vulnerabilities [1]. Mythos exposed a structural failure that was already present.

The evidence for that pre-existing failure is substantial.

The National Vulnerability Database enriched a record 42,000 CVEs in 2025. CVE submissions increased by 263% in the same period [4]. FIRST forecasts up to 100,000 new CVEs in 2026. On April 15, 2026, NIST formally acknowledged the math wasn’t working by shifting to a risk-based enrichment model, immediately moving 29,000 backlogged CVEs to “Not Scheduled” status. The system built to track vulnerabilities at scale has thrown in the towel.

Chris Hughes of Resilient Cyber presented a structural equation at the CSA Agentic AI Security Summit [4]: 14 billion GitHub commits projected for 2026, multiplied by a 2.74x AI bug rate, divided by a 4-hour exploit window. He calls the result “the Vulnpocalypse.” It’s a pointed way of describing something that is, unfortunately, just math.

The Zero Day Clock, launched in March 2026 by Sergej Epp and others, tracks median time from vulnerability disclosure to confirmed exploitation using 3,529 CVE-exploit pairs [6]. The trend line is unambiguous: 771 days in 2018, 10.8 months in 2021, 4 hours in 2024. IBM’s analysis of the Mythos moment concludes that, for the first time, response is now the binding constraint, not discovery [7].

The entire market category of risk-based vulnerability management (EPSS, CISA KEV, CTEM) exists because the security industry implicitly acknowledged decades ago that complete patching was unachievable. Mythos makes that acknowledgment explicit and urgent.

What Glasswing Doesn’t Solve

Project Glasswing is, as described, likely the largest coordinated vulnerability disclosure effort in history. But, let’s be clear about what it is and what it isn’t.

Glasswing is a discovery and hardening initiative applied to code. It patches software in the systems of participating vendors. As of late April 2026, VulnCheck found only one CVE directly credited to Glasswing in the public record: CVE-2026-4747 [8]. Chris Hughes’ conclusion: fewer than 1% of vulnerabilities found by Mythos have been patched [8]. Picus Security arrives at the same place independently. Glasswing solved the finding problem, but nobody solved the fixing problem [9].

Beyond the remediation gap, there are three layers Glasswing simply doesn’t touch.

The human layer. Social engineering attacks require no CVE, no exploit, and no vulnerability scanner. In 2023, MGM Resorts lost approximately $100 million when attackers who did not exploit a single technical vulnerability called the help desk, impersonated an employee, and convinced an agent to reset credentials [10]. That same year, a 3CX employee installed a trojanized software package on a personal computer, initiating the first confirmed cascading supply chain compromise [11]. No amount of code hardening addresses this. As code from participating vendors gets cleaner, the path of least resistance shifts toward the humans and trust chains underneath.

The coverage gap. The CSA briefing warns that the world’s exploitable attack surface is vastly larger than what any curated partner ecosystem can cover [1]. The 40 vendors in the Glasswing early access program represent a fraction of the software dependencies running in any medium or large organization. Everyone outside that consortium remains fully exposed.

The agentic ecosystem itself. This is the one I think is getting the least attention. Disesdi Shoshana Cox, AI Policy Lead at the OWASP AI Exchange and a practitioner I’ve been following closely, explains that most organizations deploying AI agents lack proper access controls, experimentation logging, data and inference monitoring, and AI-specific threat models [12]. The result is two sets of systems effectively unguarded. Classical infrastructure and AI infrastructure are both now exploitable, and connected.

Where the Research Points

I want to be careful here not to turn a research synthesis into a vendor recommendations list. The practical “where to focus” articles are coming separately. But the research does point clearly in certain directions, and it would be intellectually dishonest not to say so.

Gartner named agentic AI oversight the number-one cybersecurity trend for 2026 [13]. Their January 2026 report “How to Secure Enterprise Agentic AI Ambition” by Jeremy D’Hoinne and Dionisio Zumerle identifies Non-Human Identity security as the foundational control layer for machine actors [14]. The Five Eyes guidance makes the same call, identifying privilege risk as the first and most consequential risk category for agentic deployments [2].

I’d encourage you to read the Five Eyes guidance yourself. Six national cybersecurity agencies collectively saying “prioritize resilience, reversibility and risk containment over efficiency gains“ is a meaningful signal. That is a government-level statement that prevention-first thinking is no longer the primary frame.

OWASP’s Agentic Top 10 for 2026 [15], particularly ASI02 (Tool Misuse and Exploitation) and ASI03 (Identity and Privilege Abuse), maps the specific threat categories that matter most in this environment.

Ken Huang’s secure harness architecture and Shoshana Cox’s least capability principle, developed independently from different analytical traditions, converge on the same insight. Least privilege (giving an identity only the permissions it needs) is necessary but not sufficient when the identity in question is an AI agent operating autonomously [12][16]. The additional requirement is least capability, which is an architectural constraint on what an agent can structurally do, not merely what it is permitted to do. Permissions can be misconfigured, inherited, escalated, or exploited. Architecture is harder to bypass.

I found a lack of new strategy around backup and recovery in a post-Mythos world, and that bothers me. The established attacker playbook against backup infrastructure is equally executable by a compromised AI agent using valid credentials, indistinguishable from legitimate administrative activity [17][18][19]. Immutability needs to be architectural, not a configuration setting. And there’s a threat scenario the literature hasn’t fully addressed yet, but I think it should be. How would a backup/restoration cycle be possible if it’s not a single catastrophic event, but repeated disruption cycles triggered faster than restoration can complete? Current RPO and RTO frameworks were designed for one bad day. They don’t account for ten consecutive ones. I’m treating this as its own research project. Stay tuned.

Voices I’m Following and Recommend

The research on this topic is genuinely good. These are the people and organizations whose work I found most substantive:

Chris Hughes / Resilient Cyber - The most consistently rigorous independent analyst voice on this topic. His newsletter issues 92-96 are the best ongoing coverage of Mythos implications I’ve found.

Disesdi Shoshana Cox / Angles of Attack - Technically credible, openly skeptical of vendor hype, regulatory-forward. The only voice I found explicitly connecting Mythos to the standards and policy conversations happening in Washington right now, including the formation of MOSAIC (Multi-Organization Secure AI Coordination).

Bruce Schneier - The essential skeptic. Called Glasswing “very much a PR play by Anthropic -- and it worked.” Worth reading for the counterargument, especially because Schneier is also a contributing author on the CSA briefing. He can hold both views at once.

CETaS / Alan Turing Institute - Chris Hicks, Connor Attridge, Ardi Janjeva, and Carolyn Ashurst produced the most rigorous academic treatment of Mythos I found [20].

WEF “AI and Cyber: Empowering Defenders” - Published May 4, 2026, in collaboration with KPMG. 94% of cyber leaders identify AI as the defining force in their field. Draws on 20 real-world case studies across 84 organizations [21].

The CSA CISO Community v1.0 briefing remains the anchor document for this topic. If you read nothing else, read that.

Not the End

I started this research expecting to write about Mythos as a new threat. What I found instead is that Mythos is more like a floodlight pointed at an old one.

The security industry was built around an organizing premise. You find vulnerabilities, patch them before attackers exploit them, and that was always partially unachievable at scale. The tools that proliferated around that premise (CVSS, NVD, periodic pen tests, reactive patch management) were responses to an impossible problem, not solutions to it. Mythos didn’t make that premise impossible. It made the impossibility undeniable.

What comes after this reckoning? The research points toward a security posture organized around limiting damage rather than preventing entry. Some examples include limiting blast radius by design, identity governance for machine actors, and behavioral detection calibrated for non-human speed. I’d also like to see plans for recovery architectures that don’t assume a single bad event on a human timeline.

Those are topics I will dig into next. If you’ve found sources or research I should have included, I want to hear about it. That’s what the community is for.

-- Laura Kenner

References

[1] CSA CISO Community, SANS, [un]prompted, and OWASP Gen AI Security Project, “The ‘AI Vulnerability Storm’: Building a ‘Mythos-ready’ Security Program,” Cloud Security Alliance, v1.0, May 1, 2026. https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/05/mythosreadyv1.0.pdf

[2] CISA, NSA, ASD ACSC, Canadian Centre for Cyber Security, NCSC-NZ, NCSC-UK, “Careful Adoption of Agentic AI Services,” Joint Guidance, Apr. 30, 2026. https://media.defense.gov/2026/Apr/30/2003922823/-1/-1/0/CAREFUL%20ADOPTION%20OF%20AGENTIC%20AI%20SERVICES_FINAL.PDF

[3] Anthropic Red Team, “Mythos Preview: Technical Disclosure,” Anthropic, Apr. 2026. https://red.anthropic.com/2026/mythos-preview/

[4] C. Hughes, “The Vulnpocalypse Is Here. Now What?” Presentation, CSA Agentic AI Security Summit, May 2026. [Slide deck, on file]

[5] AISLE, “AI Cybersecurity After Mythos: The Jagged Frontier,” AISLE, Apr. 2026. https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jagged-frontier

[6] S. Epp et al., Zero Day Clock, Mar. 2026. https://zerodayclock.com

[7] IBM, “The Mythos Moment When Discovery Outpaces Defense,” IBM Think Insights, Apr. 2026. https://www.ibm.com/think/insights/the-mythos-moment-when-discovery-outpaces-defense

[8] C. Hughes, Resilient Cyber Newsletter, Issues #92-#96, Apr.-May 2026. https://www.resilientcyber.io

[9] Picus Security, “The Glasswing Paradox: The Thing That Can Break Everything Is Also The Thing That Fixes Everything,” Picus Security Blog, Apr. 2026. https://www.picussecurity.com/resource/blog/anthropics-project-glasswing-paradox

[10] Trusona, “Prevent the Next $100M MGM-Style Breach,” Trusona Blog, Oct. 9, 2025. https://www.trusona.com/blog/prevent-mgm-style-breach

[11] 3CX, “Security Update Thursday 20 April 2023 -- Initial Intrusion Vector Found,” 3CX Blog, Apr. 20, 2023. https://www.3cx.com/blog/news/mandiant-security-update2/

[12] D. S. Cox, “Mythos, Legends, and Outright Lies,” Angles of Attack: The AI Security Intelligence Brief, Edition 49, May 6, 2026. https://disesdi.substack.com/p/mythos-legends-and-outright-lies

[13] Gartner, Inc., “Gartner Identifies the Top Cybersecurity Trends for 2026,” Press Release, Feb. 5, 2026. https://www.gartner.com/en/newsroom/press-releases/2026-02-05-gartner-identifies-the-top-cybersecurity-trends-for-2026

[14] J. D’Hoinne and D. Zumerle, “How to Secure Enterprise Agentic AI Ambition,” Gartner Research, Jan. 5, 2026. [Gartner client access]

[15] OWASP GenAI Security Project, “OWASP Top 10 for Agentic Applications 2026,” Agentic Security Initiative, Dec. 2025. https://genai.owasp.org/initiatives/agentic-security-initiative/

[16] K. Huang, “What a Secure Harness for Agentic AI Actually Is,” Agentic AI (Substack), May 6, 2026. https://kenhuangus.substack.com/p/what-a-secure-harness-for-agentic

[17] S. Rao, “Why Ransomware Attacks Succeed Even When Backups Exist,” BleepingComputer, sponsored by Acronis, May 2026. https://www.bleepingcomputer.com/news/security/why-ransomware-attacks-succeed-even-when-backups-exist/

[18] Object First, “Object First Survey: 89% of IT Leaders Fear AI-Powered Cyberattacks Will Cost Them Their Data,” Press Release, Mar. 31, 2026. https://www.businesswire.com/news/home/20260331825488/en

[19] Veeam, cited in TechRadar, “Ransomware attackers are going after backup storage to force you to pay up,” TechRadar, 2025. https://www.techradar.com/news/ransomware-attackers-are-going-after-backup-storage-to-force-you-to-pay-up

[20] C. Hicks, C. Attridge, A. Janjeva and C. Ashurst, “Claude Mythos: What Does Anthropic’s New Model Mean for the Future of Cybersecurity?” CETaS Expert Analysis, Apr. 2026. https://cetas.turing.ac.uk/publications/claude-mythos-future-cybersecurity

[21] World Economic Forum and KPMG, “AI and Cyber: Empowering Defenders,” WEF White Paper, May 4, 2026. https://www.weforum.org/press/2026/05/new-report-shows-how-ai-gives-cybersecurity-competitive-advantage/

Share

Welcome. I’m genuinely glad you’re here. Let me tell you what this is and why it exists.

Why Out of Band exists

There’s no shortage of cybersecurity news. There’s a real shortage of people willing to say what they actually think about it without a vendor contract, a conference sponsorship, or a marketing budget shaping the narrative.

Out of Band is my attempt to fix that.

I spend a lot of time researching, producing video, and talking with practitioners. This is where I write down what I’m thinking after all of that. It’s my perspective on what it means for the people in the trenches.

What to expect

Out of Band is built around deep research. Each research piece kicks off a series of follow-on articles that dig into the subtopics, the implications, and the questions raised.

You’ll get two types of pieces here:

Straight research: This is where I like to start. I may start with a thesis or be inspired by the “talk on the street” (usually LinkedIn) and I dig in. I gather as much data as I can from as many sources as I can, and then piece together my original analysis. These take time and they show it. Properly cited, linked, unsponsored.

Colorful POV: After doing the research and ruminating on it a bit, I generally have more thoughts to share. A lot of times I have more questions than answers. Sometimes I want to test my ideas against community feedback. I share my thought process so we can have these important conversations.

Who I am

I’m Laura Kenner, founder of Bootstrap Cyber. I came to cybersecurity from an unrelated field (medical office admin). I had a mid-life crisis and went for a total career change. I achieved a BS in Computer Networking and Cybersecurity, as well as CCNA, CompTIA Network+, and Security+ certifications. I “broke into” the field via my first job in a technical marketing role for a cybersecurity vendor. I now run content, social, and video strategy for cybersecurity startups.

The combination of a cybersecurity education and content marketing experience has given me a very unique perspective. I can read the research, understand what practitioners are dealing with, and translate it into something useful, maybe even entertaining.

I also started Bootstrap Cyber Media LLC as a channel for the practitioners, the boots on the ground, doing the work every day. It’s my side hustle, my passion project, and I love it. Try to stop me.

My written content mostly lives here on Substack. My video content lives on YouTube. And the community page is on LinkedIn. Please connect, follow, subscribe!

One ask

I’m just getting started here. Comments are most welcome, even when you disagree. I appreciate feedback and I read everything. I look forward to the conversations more than the subscribes.

Welcome to Out of Band.

— Laura Kenner

Bootstrap Cyber Media LLC at https://www.bootstrapcyber.com

YouTube at http://www.youtube.com/@BootstrapCyber

LinkedIn at https://www.linkedin.com/company/bootstrap-cyber