GUEST OPINION: The emergence of advanced AI systems capable of identifying and exploiting software vulnerabilities is forcing a rethink of how organisations understand cyber risk.
Rather than simply increasing the speed of vulnerability discovery, new systems are compressing the entire pathway from weakness identification to real-world exploitation.
Recent testing of the AI system Mythos highlights a more significant shift: the reduction in time and expertise required to convert individual vulnerabilities into functional, multi-step attack chains capable of delivering full system compromise.
For boards and security teams, the implication is clear. Risk is no longer defined by isolated flaws, but by how easily those flaws can be combined into an actionable attack path.
From vulnerabilities to attack paths
Traditional cybersecurity practice has long centred on cataloguing vulnerabilities, assigning severity scores, and prioritising remediation based on perceived impact. However, the Mythos findings challenge this linear approach.
In controlled testing, the system was able to identify zero-day vulnerabilities across major operating systems and browsers, then chain multiple weaknesses together to achieve outcomes such as remote code execution and privilege escalation. In several cases, it progressed from code analysis through hypothesis formation and exploit generation with limited human input.
Crucially, this process was not dependent on a single critical flaw. Instead, success emerged from sequences of smaller weaknesses that, when combined, formed a viable attack route.
This reflects how real-world adversaries operate as attackers rarely rely on one perfect vulnerability. They move through systems step-by-step, gaining initial access, enumerating environments, escalating privileges, and moving laterally until they reach a valuable target.
The key insight is that security outcomes are increasingly determined by chains and not individual issues.
Exploitability is a function of context
A central theme emerging is that severity ratings alone are no longer sufficient to understand risk. A vulnerability’s exploitability depends heavily on environmental conditions such as identity configurations, access permissions, exposed interfaces, and system architecture.
A flaw that appears low priority in isolation can become highly critical when combined with adjacent weaknesses. Conversely, a technically severe vulnerability may be effectively neutralised by strong access controls or segmentation.
This reinforces a broader challenge facing security teams in that visibility is often fragmented. Organisations may know what vulnerabilities exist, but not how they interact or whether they form an exploitable sequence. In practice, this creates a gap between known issues and actual risk exposure.
AI reducing the friction of exploitation
Perhaps the most significant development highlighted by the Mythos testing is not improved discovery, but reduced friction.
Historically, moving from vulnerability identification to working exploit required deep specialist knowledge and significant time investment. The new generation of AI-assisted systems compresses this process.
Advertisement
Mythos has demonstrated the ability to analyse codebases, identify weaknesses, generate exploit logic, and combine multiple issues into working exploit chains more efficiently than previous approaches. It also enabled users without formal security training to produce functional exploits.
Importantly, many of the vulnerabilities identified were not novel classes of bugs. They were long-standing implementation flaws and logic errors that had persisted in systems for extended periods.
This suggests the shift is not about new types of risk emerging, but about existing weaknesses becoming easier to activate.
Implications for Australian organisations
For Australian companies and private-sector organisations, the implications are structural rather than incremental. Most organisations already operate in environments containing misconfigurations, identity weaknesses, and legacy system dependencies. The difference now is that these conditions can be analysed and combined more rapidly into viable attack paths.
This places increased pressure on traditional vulnerability management programs, which often prioritise remediation based on severity scores alone. That approach may no longer reflect actual risk exposure.
Security leaders will need to shift focus to a number of factors including:
-
How vulnerabilities connect across systems and identities
-
Whether combinations of weaknesses create escalation paths
-
How quickly an attacker could move from entry to impact
-
Where segmentation and identity controls can interrupt chains of compromise
If attackers can more easily find and chain vulnerabilities, then preventing every initial compromise becomes less realistic than limiting the blast radius once access is achieved. This shifts emphasis towards detection, response, identity governance, and architectural containment.
From Understanding Attack Paths to Continuously Validating Them
Attack paths are not static. They evolve as identities change, systems are added, permissions shift, and new vulnerabilities emerge. Understanding where attack paths could exist is only the first step.
Organisations increasingly need to continuously validate which attack paths are actually exploitable, understand the business impact those paths could have, and verify that remediation has eliminated meaningful paths to compromise.
As AI reduces the time required to identify and chain weaknesses together, security programs built around periodic assessments and theoretical risk assumptions will struggle to keep pace. Instead, resilience will increasingly depend on continuously validating real-world exposure and adapting defenses as environments change.
Risk is now about connectivity
The broader conclusion is that cyber risk is no longer best understood as a catalogue of discrete vulnerabilities. Rather, it is a question of connectivity and whether weaknesses can be linked into a sequence that leads to meaningful impact.
For enterprises, the critical question is no longer “how many vulnerabilities do we have?” but “which of these can be combined into a path that leads to compromise?”
The underlying weaknesses have always existed. What is changing is how quickly they can be found, connected, and used.