"A 'passed' audit tells you where you've been, not where you are," wrote Rinki Sethi, crystallizing the central fracture between old security measures and a new, AI-accelerated threat environment.
Anthropic's Claude Mythos Preview as an early-warning signal
Sethi points to recent reports about Anthropic’s Claude Mythos Preview as a clear signal of how quickly the threat landscape is changing. According to the account cited, Claude Mythos Preview was described as so effective at vulnerability discovery that access has been restricted. That description illustrates the core concern: tools powered by advanced AI can discover and exploit weaknesses at speeds and scales that outpace traditional measurement methods. What once took attackers days or weeks, Sethi argues, can now happen in minutes and increasingly without human intervention.
Runtime visibility and the limits of static checkpoints
The essay challenges long-standing success metrics — passing audits, closing vulnerabilities, and maintaining compliance — as measures designed for a “predictable, linear” threat landscape. Those markers retain value, but they are static. Sethi emphasizes the difference between configuration tools that tell you what should be true and runtime visibility that shows what is true right now. She offers a pointed follow-up: if an attacker starts moving laterally in a cloud environment today, do defenders know in minutes or days? The implication is clear: posture dashboards, pen tests and audits are snapshots; they do not substitute for continuous, real-time observation.
Identity sprawl and making least privilege measurable
Sethi calls attention to a practical and expanding risk: identities beyond employees. Vendors, contractors, service accounts, API keys, automations, machine identities and cloud principals create a sprawl that attackers exploit because stealing credentials is often easier than writing malware. Over-permissioned accounts, she warns, "act like master keys: convenient until they’re compromised." Her prescription reframes identity management as infrastructure work — inventory every human and non-human identity, map which ones can access sensitive data or modify critical infrastructure, and make least-privilege demonstrable rather than aspirational. A concrete follow-up she suggests: identify the highest-risk access paths and show what can be removed or tightened within 30 days.
Using AI to reduce noise, speed decisions, and rehearse the hard day
Many security teams are drowning in alerts; Sethi argues that adding AI should not become "just another screen." Instead, AI must add context — for example, linking a risky identity with a vulnerable workload and an exposed secret — so responders can act on composite signals rather than chasing disconnected warnings. She recommends measuring alert volume, the percentage that is actionable, and the effect on response time. Equally important, Sethi stresses resilience: incidents are inevitable, and organizations must rehearse realistic incident scenarios end to end. Her suggested walk-throughs include credential theft, ransomware and vendor compromise, with specific attention to decision points: who decides, when executive leadership must be informed, and what customers need to know.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: Prioritize runtime visibility for systems supporting critical services and sensitive resident data; inventory identities and instrument continuous monitoring to reduce high-risk access paths quickly.
- Policymakers and regulators: Focus measurement on outcomes — time to detect, contain and restore — rather than activity metrics like tickets closed or controls checked, per Sethi’s recommendation for more meaningful accountability.
- Affected enterprises and procurement leaders: Treat identity like infrastructure when purchasing or configuring cloud and automation services, and demand demonstrable least-privilege controls and AI tools that reduce alert noise rather than amplify it.
Sethi’s practical closing prescription is both tactical and organizational: prioritize runtime visibility on critical systems, treat identity as infrastructure, shift measurement toward detection and recovery outcomes, and rehearse the “hard day” with both technical teams and leadership. She leaves readers with a pointed, operational challenge: "The defining question now is how quickly you can identify a risk, understand its impact, and respond before it escalates." The organizations that answer that question in minutes rather than days will hold the advantage in an era where attackers can move at AI speed.
https://cyberscoop.com/ciso-strategy-ai-real-time-risk-op-ed/
