The Demise of the Patch Window: How AI is Rewriting Cybersecurity

When Anthropic revealed that its Claude Mythos model could generate a fully functional exploit on its first try 83% of the time, the cybersecurity industry didn’t just witness a new technical benchmark—it witnessed the obituary of the traditional patch window. In April 2026, Anthropic disclosed that a preview iteration of Mythos had autonomously identified thousands of severe vulnerabilities across major platforms, including Apple, AWS, Cisco, Microsoft, and JPMorgan Chase. Astoundingly, the model unearthed a 27-year-old zero-day flaw in OpenBSD—an operating system famous for its rigorous security—simply by executing roughly 1,000 automated test loops. Fortunately, this discovery was made by AI, not an adversary. However, the implication is clear: this is a severe warning regarding the future of security strategy.

How AI Discovery Dismantled the Patching Paradigm

Historically, security operations have relied on a comfortable, predictable cadence: a vulnerability is announced, a patch is engineered, and IT teams deploy it over a span of weeks or months. This entire rhythm was predicated on the assumption that discovering vulnerabilities was a slow, manual process, allowing defenders enough time to stay ahead of the curve.

The OpenBSD incident shatters this assumption on an individual level, but the sheer scale of AI discovery destroys it entirely. Following the Mythos Preview disclosure, participants in Anthropic’s Project Glasswing (including Google, Cisco, and the Linux Foundation) unearthed over 10,000 high and critical-severity flaws across critical infrastructure and widespread open-source projects in mere weeks. As Anthropic noted, AI models now possess coding capabilities that surpass all but the most elite human researchers. Vulnerabilities no longer trickle in one by one; they flood in by the thousands.

The Evaporating Gap Between Discovery and Weaponization

The volume of newly discovered flaws is only half the crisis; the other half is the speed of weaponization. An 83% first-attempt success rate for exploit generation means the most time-consuming phase of a cyberattack—converting a known flaw into a usable weapon—has been reduced to near-zero latency when executed by a Mythos-class AI model.

Cybersecurity has always grappled with an inherent asymmetry: defenders must be flawless every time, while attackers only need to succeed once. This dynamic was survivable when both sides operated at human speed. Today, AI vulnerability discovery fundamentally fractures that symmetry. Attackers can now operate at machine speed, while defenders remain bottlenecked by change-management approvals, testing protocols, and deployment delays.

Why a Remediation-First Strategy is No Longer Viable

Patching remains critically important, but it is no longer sufficient on its own. A reliance on remediation fails in the age of AI for three distinct reasons:

• Speed Disadvantage: Defenders can no longer reliably win the race between a vulnerability’s disclosure and its active exploitation.
• Incomplete Coverage: Not all assets can be patched on demand. Industrial Control Systems (ICS), medical equipment, legacy infrastructure, and unmanaged BYOD endpoints often cannot receive immediate updates—if they can be updated at all.
• Deployment Lags: Even the most highly optimized patch cycles suffer from a lag between “patch available” and “patch universally applied.” This specific window is exactly where AI-accelerated exploits inflict their damage.

The True Solution: Upstream Identity and Access Control

Because patching cannot reliably precede exploitation—especially when zero-days are discovered in the wild—the most resilient security controls must sit entirely upstream of the vulnerability. This requires absolute certainty regarding exactly who and what is connecting to the network, whether it is a user, a laptop, a cloud workload, or an AI agent.

Organizations must verify the identity and security posture of every entity before granting network access, and rigorously restrict lateral movement once inside. An identity that is denied access to sensitive systems from the outset requires no post-breach containment. The exposure is neutralized before it begins.

Operationalizing the Strategy

Security executives must pivot away from viewing high patch-compliance scores as the ultimate metric of security health. Instead, real-time visibility into devices and their underlying identities must become the new baseline. This mandates maintaining a dynamic, real-time inventory of every user, device, and AI agent requesting access; continuously verifying their posture throughout the duration of the session; and enforcing conditional network access. If a device is unpatched or an identity falls out of compliance, its access should be restricted automatically in real-time, not merely flagged for a future helpdesk ticket.

Governing Agentic Identity: Why Security Must “Assume Misbehavior”

During my tenure directing a Security Operations Center for a highly autonomous, fast-moving engineering firm, I eventually surrendered the illusion of maintaining a perfect asset inventory. Tracking “what’s out there” was an exercise in futility; shadow IT was powered by tribal knowledge, and new services were routinely spun up over holiday weekends without a word to security. Recognizing this, I pivoted to asking two far more practical questions:

• What is the blast radius? (What systems and data can this asset actually touch?)
• Where is the kill switch? (How rapidly can I sever its access if it goes rogue?)

This wasn’t born from a grand security philosophy, but from the pragmatic reality of defending an environment where absolute control is a luxury you simply don’t have.

I reflect on this because the industry is currently grappling with a similar existential crisis regarding Artificial Intelligence. With AI lowering the barrier to entry for attackers and accelerating the threat landscape, security leaders are constantly asking how to defend against unpredictable, machine-speed threats. The honest answer? You stop trying to predict them. Instead, you architect your defenses for a world where your threat forecasts will inevitably be wrong.

The Inventory Crisis, Amplified by AI Agents

Today, almost every enterprise falls somewhere on a spectrum between aggressively deploying AI agents and secretly having AI agents deployed by employees without IT’s knowledge. Many organizations have embraced a high risk tolerance, deciding that the productivity gains of giving autonomous agents broad, standing access are worth the potential security trade-offs. I am not here to condemn that choice—I have defended environments built on exactly that premise.

However, we must recognize the fundamental difference between human recklessness and machine autonomy. Humans experience fatigue, they second-guess their decisions, and they fear losing their jobs. AI agents possess none of these natural friction points. They execute tasks at the speed and scale they were programmed for, utilizing whatever access they have been granted, entirely devoid of hesitation.

If a rogue human engineer is a five-alarm fire, a rogue AI agent with identical privileges is that same fire—only this time, no fire department is coming, because security monitoring is historically calibrated to watch human behaviors, not autonomous processes.

A New Paradigm: Assume Misbehavior

For years, “assume breach” has been the gold standard of cybersecurity postures. In the era of agentic AI, we must evolve this concept further: assume misbehavior.

This doesn’t necessarily mean the AI has malicious intent. It simply means the agent is executing its exact instructions, but applying them in an unforeseen context that results in unauthorized data access or system manipulation. At enterprise scale, this isn’t a rare anomaly; it is an inevitable operational reality.

So, how do we establish governance over this chaos? It requires a structural shift in how we manage non-human identities:

• Strict, Just-in-Time Scoping: An AI agent should never possess broad, standing access “just in case” it needs it later. It must be granted the exact permissions required for its current task, and nothing more. While this dynamic scoping is operationally heavier than granting permanent broad access, it is non-negotiable for minimizing risk.
• Instant Revocability: Every agentic identity must be engineered with the assumption that you will need to terminate it instantaneously. If revoking an agent’s access requires submitting an IT ticket, scheduling a meeting, or waiting for approvals, you do not possess a security control; you have an administrative bottleneck.
• Authentic Zero Trust: We must move past the marketing buzzword and implement true Zero Trust. This means continuously verifying an agentic identity and its specific requests at every transaction, rather than trusting it indefinitely simply because it passed an initial provisioning check.

This philosophy aligns with the frameworks being advanced by organizations like CoSAI (Coalition for Secure AI). We must stop treating AI agents like neglected service accounts and start treating them as first-class identities within our IAM infrastructure—identities that are continuously audited, strictly governed, and instantly revocable.

Enablement with a Leash

The solution to the proliferation of AI agents is not to become the “Department of No.” Blanket bans are rarely a successful strategy for a CISO looking to retain a seat at the executive table. The modern mandate is to enable the business while keeping it on a tight operational leash.

Allow the business to innovate and move quickly, but architect the underlying access model so that when an agent inevitably misbehaves, the blast radius is microscopic and containment is immediate.

I will concede that this strategy has an expiration date. “Enablement with a leash” works right up until AI agents operate at a level of autonomy and speed that completely outpaces human intervention. Nobody truly knows exactly where that tipping point lies. But I would much rather build the organizational muscle now—enforcing scoping, rapid revocation, and rigorous zero trust—while our current controls still function, rather than waiting for an AI-driven disaster to prove our defenses obsolete.

We cannot predict or fully govern the capabilities of the technology that is coming. We can only control what that technology is permitted to touch, and how rapidly we can sever its access when it behaves unexpectedly. In an era defined by profound unpredictability, establishing that baseline of control is everything.

Rethinking Zero Trust: Why AI Agents Require a “Digital Birth Certificate”

For decades, the zero-trust security paradigm has been anchored by a simple rule: verify every user and device, and enforce the principle of least privilege. This framework is highly effective when managing human logins or standard corporate endpoints. However, it quickly deteriorates when introduced to agentic AI—autonomous programs designed to operate independently, at machine speed, across a web of interconnected systems simultaneously.

This escalating friction was recently thrust into the spotlight. At the Defense Intelligence Agency’s DoDIIS conference, Douglas Cossa, CIO of the Intelligence Community, openly addressed the elephant in the room. As reported by Breaking Defense, Cossa admitted that agentic AI has “completely spun zero trust on its head.” Rather than defaulting to restricted access, enterprises are outfitting AI agents with broad capabilities to fulfill their autonomous tasks. To bridge these two conflicting security postures, Cossa proposed a definitive solution: a unified identity framework.

His proposed fix is as memorable as it is necessary: a digital birth certificate. This concept must extend beyond human users and hardware to encompass every AI agent capable of requesting, storing, or manipulating data.

A Structural Enterprise Crisis, Not Just a Government Problem

It would be a critical mistake for private enterprises to dismiss this as merely an isolated public-sector dilemma. Cossa’s observations highlight a structural vulnerability that every corporate security team is currently facing.

Traditional zero-trust architectures were engineered for static populations—employees, contractors, servers, and laptops. These entities undergo predictable lifecycles of provisioning, auditing, and offboarding. AI agents, conversely, defy these rules. They are generated dynamically (sometimes autonomously by other agents) to execute hyper-specific tasks, and then they vanish. There is no standard HR onboarding process for a bot spun up via a developer’s script an hour ago, leaving it entirely absent from conventional active directories.

This is the exact vulnerability Cossa is highlighting. If an organization cannot clearly define what an agent is, who deployed it, and what its operational boundaries are, traditional defenses like network segmentation become obsolete. The agent remains a ghost, effectively invisible to the governance systems designed to police it.

Identity Must Precede Access Control

Security teams frequently attempt to solve the access problem first by simply trying to restrict what a bot can do. However, assigning permissions is futile without a persistent, verifiable identity to anchor them to. You cannot effectively enforce least privilege on an entity you cannot consistently recognize.

This is precisely why Cossa framed the solution as an identity system rather than a standard access-control policy. An AI agent’s “birth certificate” must establish several core attributes before any access is granted:

• Origin: Who or what system created the agent?
• Authorization Scope: What specific tasks and systems is it permitted to interact with?
• Time-to-Live (TTL): How long is this agent authorized to exist before it expires?
• Accountability: How can its actions be definitively traced back to a human operator or system of record?

The broader cybersecurity market is already voting with its wallet on this issue. Non-Human Identity (NHI) management has surged as one of the fastest-growing sectors for venture funding and acquisitions. Billion-dollar deals underscore how urgently the private sector is scrambling to secure machine and agent identities. Government framing and market spending are rapidly converging on the exact same conclusion.

The Necessity of Real-Time Enforcement

Establishing an identity is only half the battle. An AI’s birth certificate is useless unless systems can continuously verify it the exact moment the agent attempts to interact with a network, endpoint, or dataset. Issuing an identity and enforcing its boundaries are two very different operational challenges.

This is where network-based access controls must seamlessly integrate with Identity and Access Management (IAM) and Privileged Access Management (PAM) platforms. While IAM and PAM define the entity and its entitlements, the actual enforcement—the split-second decision to permit or deny access—must occur continuously at the network layer. Agentic AI operates far too rapidly to be governed by static, quarterly access reviews.

The Road Ahead

Ultimately, every AI agent is an identity, demanding the exact same rigorous governance historically applied to humans and hardware. The US Intelligence Community’s stance confirms that securing non-human identities is no longer a theoretical exercise—it is a mandatory evolution of the zero-trust model.

The defining question is no longer whether AI agents need identities, but how rapidly organizations can deploy the infrastructure needed to issue, verify, and enforce them before these invisible gaps are actively exploited by threat actors.

The First AI Insider Threat Has Arrived, and We Are Unprepared

The Invisible Runway: An offensive exploit or external threat actor is no longer required to trigger a catastrophic data breach. In an environment defined by broken access control, an autonomous AI agent merely executing its legitimate, pre-assigned tasks can inadvertently compromise entire data tiers by leveraging over-privileged access states at machine speed.

The Agentic Catalyst: Redefining the Blast Radius

While identity architects have focused heavily on assigning distinct machine identities to AI pipelines, the underlying exposure often exists long before the agent is deployed. Over-permissioned service accounts and unvetted server-side APIs act as a pre-built runway for autonomous escalation.

When an autonomous agent interacts with these misconfigured boundaries, the traditional risk calculus changes completely. The presence of machine-speed, multi-step workflows operating without real-time human intervention introduces variables that legacy telemetry is completely unequipped to manage.

—

The Telemetry Blind Spot

The most critical variable in modern enterprise security is time-to-detection. Because AI agents utilize authentic credentials, traditional security monitoring solutions fail to flag their activity. If the access permissions exist on an API endpoint, a SIEM or XDR platform will view the transaction as completely authorized.

Most organizations currently have no automated method to distinguish between an AI agent operating within its correct functional parameters and one that is systematically harvesting unauthorized datasets simply because the underlying access controls were left wide open. The risk is no longer theoretical; it is an active production vulnerability.

—

Remediation Architecture: Moving to Enforceable Security

Mitigating this acute risk vector requires moving away from aspirational policy documentation and focusing on strict, foundational infrastructure hardening. Security operations must implement a multi-layered defensive posture:

1. Dynamic, Task-Bound Least Privilege: Entitlements must be programmatically restricted to the immediate, atomic requirements of the agent’s current task lifecycle, rather than granted as broad, perpetual access roles.
2. Network-Layer Micro-Segmentation: Access controls must be enforced directly at the network and transport layers, not merely within the application interface layer. If an API is misconfigured, network-level micro-segmentation must actively block unauthorized machine entities from reaching it.
3. Continuous Behavioral Attestation: Security monitoring must evolve from basic, point-in-time authentication checks to continuous verification models. Security controls must constantly evaluate whether an agent’s real-world actions align with its intended operational mandates.

Operational Architecture Pillars

Capability Matrix

Securing the BYOD Boundary

By bypassing the heavy management profiles required by traditional MDM deployments, AgentP ensures a clean cryptographic separation between corporate assets and personally owned devices, maximizing edge security without infringing on user privacy.

Operational Impact

Zero Trust Ready

In modern, perimeter-less environments, consistent verification is essential. Portnox Connect ensures that every Windows device is properly provisioned and verified before gaining network access—seamlessly aligning your fleet with a Zero Trust security framework.