Zero Trust Was Best Practice Before Mythos. Now It’s Your Best Defense.

When did you last revisit your risk thresholds? If the answer is before April 7, 2026, they’re probably wrong.

The likelihood of every flaw in your environment being found and exploited just increased dramatically and for good.

In our recent discussion on The Segment podcast with Neil Robinson, CISO at Virgin Money, he was clear that the security controls you accepted as adequate six months ago may no longer hold up. The odds of an attacker finding your gaps and chaining them together just went through the roof.

We’re at a real inflection point. The fight used to be fair — human against human and tool against tool. But Mythos ended that. Zero Trust is the architecture that gives defenders a fighting chance.

Zero Trust before Mythos: promise versus practice

To understand what Mythos changes, you need to understand what Zero Trust was already up against.  

For too long, vendors chased perfect prevention, and it became what customers expected. The result was slow adoption and a false belief that Zero Trust was correct in theory but impossible in practice.

The shift came when the industry finally acknowledged that they need to move from expecting perfection to reducing risk. Separating dev from production, closing risky open ports, and breaking flat networks into smaller zones each reduced the attack surface meaningfully.  

That reframing finally unlocked progress. Regulations like DORA, NIS2, and the SEC’s cybersecurity disclosure rules pushed the market further, demanding genuine resilience over security theatre.

Mythos arrived just as that momentum was building.

What machine speed actually means

Mythos finds flaws at machine speed and at a scale no human attacker could match. Anthropic decided the model was too dangerous to release. That call is itself the clearest proof of its power.

An analogy from Illumio CEO and founder Andrew Rubin reframes the problem well. When COVID hit, the world focused on developing a vaccine and moved faster than anyone thought possible. But the day the vaccine was ready, the real challenge began: getting billions of doses to every person on earth.

Writing a patch is the vaccine. Deploying it across billions of connected devices — some that can’t reboot, some owned by third parties, some buried in systems that can’t go offline — is the hard part. Multiply that by hundreds of thousands of flaws found at once, and the math stops making sense.

Peers who have seen Mythos firsthand expect open-source models to match it within 12 months. Most security programs aren’t built to move that fast.

Zero Trust means building resilience, not just prevention

The security industry has run on a prevention model for 50 years. But year over year, security spend grows, and year over year, breach costs grow faster.  

Pure prevention, or even relying heavily on detection, is no longer a viable strategy.

The real question is what happens when an attacker gets in, and how fast your team can contain it. That’s where Zero Trust earns its place.  

A Zero Trust strategy grounded in microsegmentation works to limit how far an attacker can move once they’re inside.  

Look at this April’s Marks and Spencer breach. They projected £350 million in profit last year but only reported £3 million, with months offline from the attack explaining the gap.  

Keeping a breach small is what separates a hard week from a business-ending event.

Surviving Mythos starts with Zero Trust

At RSAC, weeks before Anthropic announced Mythos, Sherrod DeGrippo of Microsoft predicted the rise of the unicorn threat actor: one person operating an attack tool with massive reach, automation, and speed.

That now reads like a product description for frontier AI models like Mythos.

The gap between attacker and defender is growing. The teams that come through this well are the ones already limiting lateral movement, building resilience in, and treating Zero Trust as something they do, not something they plan to do.  

Want to be ready for Mythos? The work towards building a Zero Trust infrastructure needs to start now.