**Navigating the AI Cybersecurity Surge: Speed, Risk, and the OT Challenge**
The landscape of cyber defense and offense is shifting beneath our feet. Over the past few weeks, the release of “frontier” AI models has accelerated the arms race, forcing a necessary re-evaluation of our current security strategies. While these models promise to revolutionize how we find and fix flaws, they also introduce a significant “velocity problem” that is particularly acute for Operational Technology (OT) and Internet of Things (IoT) environments.
—
### The New AI Arms Race: Mythos and Daybreak
Two major announcements have recently set the pace for this transition: **Mythos** and **Daybreak**. Anthropic’s Claude *Mythos* Preview was launched on April 7th. This model is paired with “Project Glasswing,” an initiative aimed at giving defenders early access to stay ahead of the “avalanche” of vulnerabilities Mythos is capable of uncovering. OpenAI’s *Daybreak* was announced shortly after, on May 11th. Daybreak ups the ante by not only discovering vulnerabilities but also generating patches for them using the OpenAI Codex engine.
While there is some debate as to whether these frontier models can find vulnerabilities that human researchers cannot, it is clear that the volume and velocity of finding vulnerabilities, even complex ones, is orders of magnitude larger than before these frontier models. For operators of OT systems, the most devastating aspect is that AI can be both operating system (OS) and application agnostic. While IT systems have a handful of OSes in use, the OT and IoT ecosystem comprises over **150,000 different operating systems**.
—
### The Speed Trap and the OT Reality Check
It is important to recognize that these models don’t fundamentally change the nature of cybersecurity; they change its **velocity**. We have long lived in a world where vulnerabilities are discovered faster than they can be patched. AI simply widens that gap.
This “churn” is magnified in the worlds of OT and IoT. While AI-generated patches might work well for generic, open-source software, the custom and unique nature of OT systems presents a massive hurdle. Consider the scale: while IT relies on a handful of standard operating systems, the OT and IoT ecosystem is fragmented into over 150,000 different operating systems. The other characteristic of OT and IoT systems is the tight coupling of devices and the applications that manage them. For an approach like Daybreak to work requires deep and context-sensitive understanding of that device-to-application integration; otherwise, the patches generated on the fly could render a mission-critical system inoperative.
—
### The Missing Piece: Emulation and Testing
The concept of automated patch generation “on the fly” isn’t entirely new. Programs like ARPA-H’s **UPGRADE** are pursuing similar goals for medical systems. However, there is a critical difference: UPGRADE focuses on creating detailed **emulators** to test patches before they are deployed.
OpenAI’s Daybreak currently lacks this critical emulator step. In an OT environment—where a bad patch can lead to physical downtime or safety hazards—deploying AI-generated code without rigorous, environment-specific testing is a non-starter. Compounding this issue is the fact that neither Mythos nor Daybreak currently have direct OT partners to bridge this domain-knowledge gap.
—
### Confidence vs. Competence
Early experiences with AI code generation reveal a recurring pattern: the AI is often “brimming with confidence” but lacks the nuanced understanding to execute complex tasks flawlessly. When faced with a roadblock, AI agents tend to “hallucinate” solutions—creating a chain of new code (like endless WordPress plugins) to fix issues created by previous iterations. In these early days, relying on AI for automated patch code generation risks creating a “steaming mass of technical debt and complexity” rather than a secure system. This is a serious danger of automated code generation within the echo chamber of a frontier AI model; it can create complexity that even the device manufacturer will have trouble sorting out.
—
### Moving Toward “Targeted Autonomous Remediation”
We must adapt our objectives to match the current maturity of these tools. The industry is on a path that starts with **automated Vulnerability Assessment and Risk-Based Prioritization**, moving toward **Targeted Autonomous Exposure Remediation**. AI is also following that path but it does not mean it is here today, safe, or the best solution. Organizations should be getting their hands dirty with all of these (especially autonomous remediation) in order to properly assess AI for this, but it should be with significant human oversight and in lab (not production) environments.
Until then, we must remember that **Defense in Depth** remains more important than ever. Patching is just one piece of the puzzle. Foundational controls—including managing credentials, updating vulnerable software, and non-human identity management—must work in tandem to provide compensatory protection when patching gaps exist.
Ultimately, exposure management is a balancing act between operational needs, opportunities, and cybersecurity risks. AI is a powerful tool to increase our velocity, but in the unique world of OT, **speed without precision is just another vulnerability**.
—
### About the Author
John Gallagher is the VP of Viakoo Labs at Viakoo Inc. He is head of Viakoo Labs, a research unit focused on OT (operational technology) vulnerability remediation and best practices. John is a member of SIA’s Cybersecurity Advisory Board and has presented at industry events including ISC West, ISC East, GSX, HIMSS, and is a frequent blogger and webinar host. John has BS in Engineering and MBA from Cornell University and has lived and worked in Europe and Asia and speaks (basic) Japanese.
John can be reached online at [email protected] or on LinkedIn and at our company website.
—
## FAQ
**Q: What are “frontier” AI models in cybersecurity?**
Frontier AI models refer to large-scale, advanced artificial intelligence systems designed to perform complex tasks such as identifying and patching software vulnerabilities. Examples include Anthropic’s Mythos and OpenAI’s Daybreak, which are being used to accelerate vulnerability discovery and remediation.
**Q: What is the “velocity problem” mentioned in the article?**
The velocity problem refers to the increasing speed at which vulnerabilities are discovered and exploited, particularly accelerated by AI models. This creates a gap where systems—especially OT and IoT environments—cannot be patched quickly or safely enough to prevent potential breaches.
**Q: How does OT and IoT complicate AI-driven patching?**
Unlike IT environments, which typically run on a handful of standardized operating systems, OT and IoT environments consist of over 150,000 unique and often custom operating systems. This fragmentation, combined with tight device-to-application coupling, makes automated patch generation risky without deep contextual understanding and testing.
**Q: What is the difference between Mythos and Daybreak?**
Mythos, launched by Anthropic, focuses on early access for defenders to uncover vulnerabilities. Daybreak, from OpenAI, not only identifies vulnerabilities but also automatically generates patches using the OpenAI Codex engine. Daybreak has broader public access, while Mythos uses a more controlled distribution model.
**Q: Why is emulation important in patching?**
Emulation allows patches to be tested in a virtual replica of the target environment before deployment. This is critical in OT systems where a faulty patch can cause physical downtime or safety hazards. Current AI models like Daybreak lack this crucial step.
**Q: What is “confidence vs. competence” in AI code generation?**
AI tools often produce code with high confidence but may lack the nuanced understanding required for complex tasks. This can lead to “hallucinations” or the creation of tangled, unmanageable code that introduces technical debt and potential security risks.
**Q: What is “Targeted Autonomous Remediation”?**
It represents the next stage in vulnerability management: moving from automated detection and prioritization to AI-assisted, or eventually autonomous, patching. The article emphasizes proceeding with caution, human oversight, and lab testing before applying such tools in production.
**Q: What is Defense in Depth?**
Defense in Depth is a cybersecurity strategy that uses multiple layers of security controls to protect systems. It ensures that if one layer (like patching) fails, other measures—such as credential management and software updates—can still mitigate risks.
—
## Conclusion
The advent of frontier AI models like Mythos and Daybreak marks a transformative shift in cybersecurity, offering unprecedented speed in vulnerability detection and remediation. However, this acceleration comes with significant challenges, especially for OT and IoT environments where system complexity and safety implications demand precision over speed. While AI is a powerful ally, it is not a silver bullet. Organizations must balance technological innovation with rigorous testing, human oversight, and layered security strategies. In the evolving cyber landscape, prudence and preparation remain our strongest defenses.
